Auditing Surveillance Systems on Campus

The first thing to settle in auditing surveillance platforms on site is the identity of the privacy audit file and the reason it is retained, because each later issue regarding consent, exception or contract depends on those two facts. Where the file is unclear, the rest of the analysis wobbles with it; where the file is clear, the determination usually follows without drama.

Logs turn a correct decision into a defensible one, since a reviewer, an auditor or a student will eventually request what happened and why.

Opt-out processes that are hard to find or hard to use shall be treated, fairly, as if they did not exist.

Monitoring in learning tools used by younger students deserves special scrutiny, because behavioural information grows silently over a school year.

Directory information is the one category where a published designation can alter the answer, and solely where the designation and the opt-out were done properly.

Alumni systems hold giving, employment and contact information, and former students should be able to correct and limit that information.

Library platforms hold borrowing and access data that may reveal interests and beliefs, and that data should not be treated as low sensitivity by default.

Video surveillance holds images of identifiable students, and its storage, access and disclosure requirements should be written before cameras are installed.

Network logs hold connection information that may reveal student activity patterns, and access to those logs ought to be logged in turn.

Admissions information involves applicants who might never enrol, and their files deserve protection even though they never become students in the usual sense.

Disciplinary releases to victims and others have particular limits, and the outcome that may be disclosed depends on the offence and the recipient.

Review shared folders periodically, and treat shared-folder review as a confidentiality task with an owner, not as housekeeping.

Run internal audits on a stated cycle, and track findings to closure with owners and dates.

Put vendor terms in the contract, not in a sales deck, and verify that the contract names the data, limits its use and requires removal on exit.

Identify the authority before the information moves, not after, because retrospective authority is usually no authority at all.

Trigger access reviews on role changes automatically where possible, and treat manual review as a fallback, not as the plan.

Analyse outside survey requests separately from institutional surveys, since the authorization for one does not cover the other.

Patch platforms on a stated timetable, and prioritise patches for platforms holding identifiable student data.

Delete on schedule, and make removal verifiable, since a removal that can not be shown is a removal that will be doubted.

The contract in that illustration names the data, limits use to the college's objectives, bans advertising use, and sets removal ninety days after the contract ends.

Consider a vendor audit that finds a subprocessor nobody had recorded, holding a copy of student files for a retired integration.

In that illustration the answer depends on whether the notes were ever disclosed, and the service records the reasoning for future cases.

In that illustration the audit finding becomes a remediation task with an owner and a date, and the subprocessor's copy is deleted on a verified timetable.

Consider a campus that installs cameras in a residence hall entrance and writes retention, access and disclosure requirements before the cameras are switched on.

Screening younger users by collecting more data than the screening needs is a mistake, because the protection then becomes the problem.

Publishing a directory without verifying the opt-out list is a mistake that is visible to every student who opted out, and to their peers.

Running an audit that finds problems and then monitoring nothing to closure is worse than running no audit, since it proves the institution knew.

Auditing AI tools only for accuracy, and not for data retention and prompt handling, is a mistake, since AI systems create files that routine audits miss.

Sharing a full file when a summary would serve is a mistake, because the extra information adds risk without adding value to the objective.