AI and FERPA: The School Official Question

For ai and ferpa: the school official issue, think in terms of a chain: a student, a student input to an AI tool, a purpose, an authorization, a recipient, a safeguard and a retention date. Break any link and the disclosing fails, even if each other link is sound. This guide walks that chain link by link, so the reader can see exactly where a proposed disclosing retains and where it breaks.

A school authoritative exemption covers staff who genuinely need the file for their work, and it does not extend to curiosity, convenience or broad awareness.

When security and confidentiality rules appear to conflict, the conflict should be escalated and documented, not resolved by ignoring one side.

Deletion rights for children's data should be honoured swiftly, and the deletion should reach backups and subprocessors on a stated timetable.

Remote work extends the site boundary to employees homes, and the controls must travel with the file to those homes.

A note kept solely for its author's personal use, never shared, sits outside the category, and the moment it is shared that safeguarding may fall away.

Backups are copies too, and a deletion process that ignores backups leaves the record in place under another name.

Disclosures to other schools where a student seeks to enrol are permitted, but the student ought to be told that such disclosures occur, through the annual notification.

Equity in privacy means recognising that the same sharing harms different students differently, and that uniform procedures can still produce unequal risk.

State biometric laws add duties that vary by state, and a site operating across states must not assume one state's requirement covers another's.

Residence hall surveillance involves students in their homes, and the privacy standard there should be higher than in a public quad.

Separate health and counselling systems from general student systems, with access limited to the staff who provide the care.

Assess AI tools with the same gate, plus a specific review of training information use, prompt retention and output handling.

Secure staff devices that hold student data, with encryption and remote wipe, because a lost laptop may hold a filing cabinet of records.

Inform students via the yearly notice that releases to schools where they seek to enroll occur, because surprise releases damage trust even when lawful.

Audit surveillance systems for access, storage and disclosure, because cameras generate records continuously, even when nobody watches.

Prepare for a regulator inquiry by keeping inventories and logs current, because inquiries rarely arrive with a convenient timetable.

Apply the highest notice and permission standard to personal survey topics, since the harm of unwanted sharing is greatest there.

Analyse outside survey requests separately from institutional surveys, because the authorization for one does not cover the other.

In that illustration the survey report shows only aggregates above a specified threshold, and no small-group result may identify a respondent.

Consider a proctoring tool adopted during a rush to online teaching, and reviewed properly solely a year later, following thousands of recordings were stored.

Consider a student employee whose employment file is requested as if it were an academic file, and a registrar who distinguishes the two capacities.

In that illustration the answer depends on whether the notes were ever shared, and the service files the reasoning for future cases.

Consider a college that adopts the same platform without an alternative, and that discovers too late that some students cannot or will not enrol.

Handling a transfer or withdrawal as if it ended a student's rights is a mistake, because rights over files already held do not end when enrolment ends.

Treating aggregates as anonymous when the underlying information remains identifiable is a mistake, since re-identification risk does not vanish at the dashboard.

Writing a policy that employees cannot state without opening the document is an error, because the policy will not be followed under time pressure.

This guide does not substitute for a college's own policies or counsel, and a conflict between the two ought to be resolved in favour of the college's own advice.

Assuming an integration passes only the data shown on a diagram is a mistake, since integrations routinely pass more than intended.