Education Records: The Four-Part Test

Put merely, education records: the four-part test is regarding control over an education record that belongs, in a practical sense, to a student and is retained in trust by an university. The university may use it for the objective it was collected for, share it where the law or a valid permission permits, and must safeguard it everywhere else. Everything in this guide is a way of making that sentence workable at a desk, stage by stage.

Group mailboxes and disclosed drives are where access control most frequently fails, since nobody owns the membership list.

Students retain rights over their files even when they never exercise them, and an institution's duty does not depend on a student asking regarding it.

The burden of proving authority sits with the university making the sharing, not with the student questioning it afterwards.

Where two rules point in different directions, the stricter applicable requirement usually governs, and the conflict itself ought to be escalated rather than resolved quietly at a desk.

Fingerprint and palm platforms for building access produce a biometric record for every student who enrols in them, and an alternative must exist for students who decline.

Cloud systems do not change what counts as a file, but they change where copies live, and each copy needs the same oversight as the original.

Emergency releases need a real emergency and a judgment that the sharing is necessary to protect health or safety, documented at the time.

International student systems hold visa and immigration information, and the sensitivity of that information should shape every sharing determination regarding it.

An opt-out, once exercised, must be honoured across systems, including directories, publications and information feeds that were built before the opt-out arrived.

Audit and evaluation releases must be limited to the audit or evaluation purpose, and the receiver must be bound to that purpose.

Assess AI tools with the same gate, plus a particular review of training information use, prompt retention and output handling.

Include removal verification in vendor contracts, with a method and a timetable, since a promised removal without verification will be doubted.

Bound accrediting releases to the scope of the exception, and send solely what the accreditation objective requires.

Use external auditors where independence matters, and give them access to the systems they need to test, not only to policy documents.

Keep inventories current, and treat an inventory that is a year out of date as no inventory at all.

Put vendor terms in the contract, not in a sales deck, and check that the contract names the data, limits its use and needs deletion on exit.

Need verifiable parental permission for younger users, and do not accept a checkbox that anyone may tick as verification.

Track privacy metrics honestly, such as time to delete, time to respond to access requests, and number of vendors without current contracts.

Consider an education app for younger students that tracks behavior across sessions and discloses aggregates with a third party, without a privacy review.

In that illustration the college contains the affected integration, notifies affected students with clear facts, and records the incident for the after-action review.

In that illustration the faculty member pauses, the privacy officer reviews the tool, and the course adopts a tool whose contract excludes training use.

In that illustration the requirements are published to residents, access is logged, and footage is deleted on schedule unless it is needed for a particular investigation.

Consider a department that wants to publish a directory of student contact details for a course, and that checks the directory designation and opt-out list first.

A third is confusing security with privacy: a well-encrypted platform may still disclose a file to a recipient who had no right to it.

Starting an AI pilot for younger students before completing both the COPPA and the FERPA analysis is an error that is discovered, not prevented.

Its value is in the structure it teaches: name the file, state the purpose, settle the authorization, limit the sharing, protect the information, and keep the file.

A reader who applies that structure, and who escalates the cases it can not settle, will make better decisions than a reader who memorises any single requirement in this ledger.

Documenting an emergency disclosure following the fact, from memory, is a mistake, since later reconstruction rarely convinces a reviewer.