Archives Versus Active Records

The first thing to settle in archives versus active files is the identity of the retained student file and the reason it is retained, because every later issue regarding permission, exemption or contract depends on those two facts. Where the file is unclear, the rest of the analysis wobbles with it; where the file is clear, the decision usually follows without drama.

Redisclosure is its own decision: a recipient who lawfully received a record may not pass it on unless a rule or permission covers that second sharing.

Vendor selection is a privacy decision before it is a purchasing decision, because the vendor's information practices become the college's risk.

Cloud hosting does not move responsibility: the college remains answerable for a file even when another company stores it.

Parental consent for younger users must be verifiable, and a checkbox that anyone may tick does not meet that standard.

Systems that feed directory information to outside directories need an opt-out check built into the feed, not added as a manual afterthought.

An education file is defined by how it is maintained and whom it is regarding, not by the folder it sits in or the platform that retains it.

Third-party tools connected to a learning platform can receive more data than the integration was meant to pass, and the actual data flow ought to be tested, not assumed.

Grades, transcripts, enrolment facts and disciplinary outcomes are the clearest education files, but the category reaches well beyond them.

Mobile tools for student services can collect location, contacts or device data beyond the service itself, and that collection needs its own review.

Studies conducted on behalf of an institution need documented agreements that limit use, require de-identification where possible, and require destruction on schedule.

Start each determination by naming the record in plain terms, because a determination regarding an unnamed record is a determination regarding nothing in particular.

Review access when roles change, and treat a role change without an access review as an open incident, not an administrative delay.

Review confidentiality oversight after a merger or platform change, since the data map from before the change shall no longer be accurate.

Scrutinise tracking in learning applications for younger students, because behavioral data grows quietly over a school year.

Encrypt files in transit and at rest, and treat encryption as a baseline, not as a substitute for access control or purpose limits.

Establish dependency before disclosing to parents of a student, and do not assume it from a family relationship or a disclosed surname.

Review assistive technology vendors for the usage information they collect, because that information can reveal disability.

Make privacy notifications available in the languages students really read, because an unread notice cannot inform permission.

Consider a registrar asked by a parent for a student's grades after the student has turned eighteen and is no longer a dependent for the relevant objective.

In that illustration the tutor discloses the summary, the colleague's advice improves, and no record leaves the tutor's department.

Consider a network team that retains connection logs and is asked for them during a disciplinary process, and that verifies the sharing rules before releasing any log.

In that illustration the platform shall retain grades, attendance and advising notes, but the college excludes sensitive comments from the export and keeps them in the existing platform.

In that illustration the review finds recordings retained far beyond the exam period, and the university deletes the backlog and shortens retention prospectively.

Obstructing a student's habit of keeping personal copies of their files is a mistake, because a student who can track their own file spots errors early.

Writing a notice that no student may find, or that no student may understand, is an error that undermines each later reliance on that notice.

Disclosing on the strength of a letter alone, without a court order or subpoena procedure, is a mistake that may be avoided by a single phone call to the privacy officer.

Keeping applicant records indefinitely is a mistake, because applicants who never enroll still have records that deserve a stated schedule.

Disclosing a full record when a summary would serve is a mistake, because the extra information adds risk without adding value to the objective.