It is very important that MCards be handled with care, similar to the way care is taken with driver’s licenses or credit cards. MCards should last four to five years without failure. 

Do:

• Always carry it with you
• Keep it protected – store by itself in a purse, wallet, or cardholder
• Avoid keeping it in a cardholder attached to a smart device (cell, tablet, etc.) when accessing a building card reader.
• Deactivate services if it is lost or stolen
• Bring damaged cards, expired cards, & cards that require data changes to an MCard Issuing Station 

Don’t:

• Keep it with your phone and charge the battery
• Bend it
• Punch holes in it
• Apply any stickers
• Keep it in your pocket
• Lend it to others
• Commingle it with other cards, keys, etc.
• Throw it away

It is advised that MCards not be placed next to any embossed cards (e.g., ATM, Debit, or credit cards) as the raised characters can cause damage to the MCard black magnetic stripe. MCards that are turned in to an MCard Issuing Station because of normal wear and tear are replaced for free. Cardholders could be charged the MCard replacement fee if it is apparent that the card was damaged from abnormal wear and tear. 

Examples of abused MCards

Release of MCard Digitized Photographs

When a photograph is taken for the issuance of an MCard, the digitized photo will be stored electronically for identification and security purposes. In addition, the photo may be used for approved internal university business purposes (i.e., class rosters, seating charts, academic advising rosters, and business uses that may be approved in the future). 

MCard digitized photographs will only be released to university departments/schools/units without cardholder’s written/electronic authorization if the following conditions apply:

• The photo is stored electronically in the ID card database
• The use of the photo is an approved internal university use (i.e., class rosters, seating charts, academic advising rosters, and other approved business uses).
• Photographs used for these purposes will not be shared with anyone outside of the university without written/electronic permission from the cardholder except as required by law.

The university may release the photograph externally from the ID card database only in the following cases:

• In compliance with written/electronic authorization from the cardholder
• To comply with valid legal requests or orders to produce the photograph as approved by the Office of the General Counsel
• To otherwise comply with applicable federal, state, or local laws or regulations as approved by the Office of the General Counsel.

Requesting Deletion of MCard Photograph

Cardholders may withdraw consent at any time and request to delete their photo by completing the Request for Deletion of MCard Photo Form (also available at any MCard issuing station). Once the form is completed and presented in person to the MCard issuing station, the digital photo will be deleted from the ID card database. In this situation, the university will have no photograph to use for purposes of reissuing an MCard, for validating access to certain university buildings and events, or for approved university business uses

Cardholders wishing to change their original decision will need to return to an MCard issuing station to have a new photo taken for electronic storage purposes. Before the photo can be stored, the Request for Restoration of MCard Photo Form will need to be completed. 

Refer to Standard Practice Guide 601.13 and MCard Photo Purge Policy for further explanation.

There are three types of requests for MCard photos. 

1. Class Rosters: Ann Arbor faculty and their support staff may obtain student photo class rosters for their classes as allowed by the MCard Photo Use Policy through Faculty Business in Wolverine Access.
    
2. Departmental MCard Photo Request:
   • The MCard Program Team may (upon written request) distribute to departments and units student and staff MCard photos per SPG policy 601.13.
   • A brief description of the process is as follows:
     • The department or unit emails a request to MCard Administration at [email protected].
     • Department/Unit provides written authorization requests to their MCard holders giving Dept/Unit permission to use their MCard photo for the specified purpose. These forms can be physically submitted on paper or through emails (the MCard holder must submit their authorization to their department/unit from their official “umich.edu” email account). 
     • Email authorizations are forwarded by the Dept/unit to MCard Administration (if more than five requests at a time, group authorizations into a single email request is preferred).
     • Written authorizations are sent to MCard Administration [email protected] along with an Excel spreadsheet listing each cardholder with UMID number and name.
     • MCard administration verifies the data compared to the submitted form(s), then processes the data.
     • MCard images are attached to an email and sent to the authorized requestor.
     • Note: Departments/units that seek MCard photos on a frequent basis may request an RDA link to the MCard photo database. This is a technical solution that would require you to obtain IT support on your own and may take some time to implement.  There is very minimal assistance available for RDA links. Please email [email protected] for additional information.
        
3. Individual MCard Photo Request: University faculty and staff requesting their own MCard photo follow the same process as the Departmental MCard Photo Request process (listed above).

Note: All MCard photos are a very small file size (32 k) and may not be appropriate for print or resizing. They all contain a white “Block M” watermark (which cannot be removed) in the lower left hand corner. Student MCard photo backgrounds and colors will vary.

Photograph Consent Requirements 

SPG 601.13 Identification Photos; Identification and Access Control concerning photos taken of university members for reasons other than the production of an MCard states:

It is also the policy of the University of Michigan that any individual or organization engaged in taking identification photos of any faculty member, staff member, student or other person(s) acting on behalf of the University outside of the central MCard process shall obtain written/electronic authorization from the individual before using the photo for that specific purpose.

The individual or organization taking the photo may release the photograph for other purposes only in the following cases:

• In compliance with written/electronic authorization from the individual
• To comply with valid legal requests or orders to produce the photograph as approved by the Office of the General Counsel
• To otherwise comply with applicable federal, state or local laws or regulations as approved by the Office of the General Counsel.

Individuals wishing to change their original authorization have the option to withdraw their authorization at any time. The individual or organization taking the photo needs to communicate this option and provide a process for individuals to withdraw their authorization.

In addition to the SPG 601.13, the SPG 601.12 Institutional Data Resource Management Policy contains additional associated references regarding rights and responsibilities for institutional data.

Photo Consent/Authorization Form Guidelines

University members who take their own photos for a particular purpose will need to create a specific authorization form and a mechanism for deletion of authorization. It is very important that the authorization form be written with distinct detail. Photos cannot be used beyond what is stated on the authorization form without the individual’s further written or electronic authorization. Authorization forms also cannot be vague or ambiguous.

The photo consent/authorization form must contain all of the following pertinent requirements:

• Complete description of the photo use, including exactly
  • Who (individual or department/unit taking photo)
  • When (immediately, 7/14/14, every semester, annually, etc.)
  • Where (dept roster on the bulletin board, staff bio on internal dept Web site, etc.)
  • How (printed annual board report, attached in an electronic unit newsletter, etc.)
• A sentence indicating: “This photograph will not be used for any other purpose without my express permission.”
• A sentence indicating: “I am aware that I can submit in writing to <dept/unit> and revoke authorization of my photograph. I understand that photos previously used by <dept/unit> to this point in printed materials may not be retractable.”
• Language indicating “I approve of the use of my photo for said use(s) by <dept/unit>.”
• Line for individual’s signature
• Line for individual’s printed name
• Line for individual’s date

Revocation of Authorization

A mechanism to revoke previous photo authorization must be made available to individuals. Once department/unit has received an individual’s written or electronic revocation of authorization, department/unit can no longer use individual’s photo effective immediately. If possible, individual’s photo should be retracted from previous use (taken off bulletin board, web site, etc.).