AMS CampusBase is replacing Clubhouse. One new feature is access to 40,000 students’ personal emails.

The AMS will launch CampusBase on August 24 — but three days before the launch, The Ubyssey found that the Clubhouse replacement allows some users to view other students’ personal email addresses.

The AMS chose to retire the Clubhouse system because it was no longer financially viable and was difficult for clubs to use. Many clubs raised concerns about difficulties with form submissions, room bookings and student engagement.

CampusBase will allow clubs to manage memberships and roles, as well as provide a centralized platform where students can explore various organizations, clubs and groups.

“For students, the AMS wants to provide a community that makes them feel more connected with student groups and activities on campus,” said AMS VP Administration Sylvester Mensah Jr in an emailed statement. “For AMS subsidiary executives, we want to ensure that their operational interactions with the AMS and their engagement with students is as fluid and effortless as possible.”

It offers a variety of new features for both students and clubs, such as enhanced communication and a campus-wide mobile app. Virtual involvement fairs will play a role in online orientation events. Other features include a newsletter builder, discussion forums and group pages.

The AMS said CampusBase can act as a “social network” with students able to build their profile pages and an event management feature.

Emails displayed without consent

Under part 3 of the Personal Information Protection Act (PIPA), a private organization like the AMS is required to obtain consent from individuals before collecting or disclosing their personal information.

In a pre-launch version of CampusBase, users were able to view the full name and email address of everyone in the CampusBase group they are a member of, and search other users by partial name or email.

The service officially launches August 24, but Ubyssey editors had access since August 19. Those with campus-wide logins (CWLs) were able to log in if they had the CampusBase link at least before August 21.

Users designated as Club Officers while adding members were able to search all other users. Officers could view users’ associated email addresses in the search results.

Other users who are members of the AMS group — as of when The Ubyssey viewed the group at noon on August 21, almost 40,000 members — could have seen the email addresses of every other member of that group.

PIPA defines personal information as “information about an identifiable individual and includes employee personal information,” excluding contact information.

Christopher Gillespie, senior policy analyst at the Office of the Information and Privacy Commissioner for BC, said there’s a distinct difference between business contact information and personal contact information, noting that personal email addresses would fall into the latter category.

As of publishing, users can no longer view the other members of the AMS group, but personal email addresses are still viewable when officers add members to any group.

AMS President Cole Evans said that system testing has been ongoing for the past two months. However, he said CWL information was uploaded to CampusBase beginning last night, which is why the society did not notice the privacy issue until contacted by The Ubyssey.

While the AMS has since hidden information for the nearly 40,000 members in the AMS group, Evans said that club executives are not able to see personal email addresses while adding members.

“To my knowledge, club executives will only be able to see contact information once a user has accepted the fact they’ve been added to a club,” he said. “So club executives will not be able to access a general list of everybody. They will only be able to access information relating to their own club members.”

The Ubyssey found that these email addresses were still viewable at the time of publishing.

Some students can be seen in search results with what appears to be student numbers instead of email addresses.

The Ubyssey also found trans students listed with their deadnames on the system. Evans said that the AMS had asked UBC for students’ preferred names and that this was an issue on the university’s side.

But when contacted by The Ubyssey, the registrar’s office said it had provided both given and preferred names to the AMS to use within CampusBase.

“The issue of ‘deadnames’ appearing via CampusBase is a matter of how AMS set up the system to display the data provided,” the office wrote in a statement.

“It would appear that AMS did not implement the system in a way that would by default show preferred names.” The office said it would be reaching out to the AMS on the matter.

It’s unclear how many students viewed the email addresses before the AMS changed the visibility of the members in the AMS group. Evans said the society is working with UBC to determine the figure, but he was “confident that it is not a significant number.”

“We make sure that everything we do, especially with this project, is compliant with PIPA, and we’re confident that by the time CampusBase launches, there’ll be no further issues relating to student data and privacy with the system,” Evans said. He added that he did not expect any delays to the August 24 launch date.

Gillespie said that legislation like PIPA allows for the protection of “vital liberties that are guaranteed to us in the charter.”

“Privacy, really, is fundamental to our democracy,” he added. “I think this sort of legislation is vitally important because it really does speak to some of the foundations of the freedoms that we enjoy.”

The AMS faced a similar privacy incident in March 2020. The student society had sent an email to clubs encouraging them to vote ‘yes’ on a referendum question, accidentally revealing recipients’ email addresses in the CC field.

At the time, AMS Marketing & Communications Manager Eric Lowe called the incident an “unfortunate mistake” and said the referendum coordinator had meant to use the BCC field.

Transition underway

While the AMS faces privacy issues with CampusBase, problems with its predecessor were plenty.

Israel On Campus President Adam Dobrer said in a statement to The Ubyssey that Clubhouse didn’t work for his organization.

“Clubhouse was difficult to even locate and clunky to use. Though intended to streamline the operation of a club, in practice we ended up abandoning it in favour of group chats on Facebook Messenger and a shared Gmail account,” he said.

Without any in-person events or orientation in the fall, many AMS clubs are looking forward to the new CampusBase platform. However, many clubs worry they will struggle to attract new members.

“We’re excited for roll-out and being able to find all the requisite forms we need to keep up our obligations to the AMS in one place. Given the pandemic and most things going virtual, we’re hoping to see plenty of chatter and buzz on the platform,” Dobrer said.

UBC Dance Horizons President Lauren Liao said her club has been working through the transition to CampusBase.

“It is nice that everything is now consolidated into one platform where we can interact with our members, but I think that since we are so used to doing everything spread across our various platforms [like] Facebook, [Dance Horizons’] website, email newsletter, etc., it’s been tough to decide what we want to do through CampusBase, keep on our old platforms, or some combination of both.”

UBC Dance Horizons is still going through the onboarding process and determining how much it will move its focus from existing social media accounts to the new system.

“Since CampusBase is brand new, we’re mostly just curious to see how the system will potentially be able to aid in sharing information directly with our members,” Liao said.

This article was updated to clarify that Evans said deadnames were an issue on UBC’s side. The Ubyssey has contacted UBC for confirmation. This article was further updated to reflect that some users had what appears to be their student number visible, to add a comment from the Office of the Information and Privacy Commissioner and to add a comment from UBC.

Share this article copied!