FERPA and Enrolled Students, Applicants and Alumni

The direct answer to ferpa and enrolled students, applicants and alumni is less regarding memorising a statute and more regarding a repeatable verify before information moves: confirm what the education record is, confirm the purpose, confirm the authority, confirm that the recipient needs it, and confirm the safeguard. Five confirmations, done in writing where the stakes are high, prevent most of the errors this ledger exists to describe.

Security controls safeguard a file from unauthorised access, but they do not make an unauthorised sharing lawful, and the two questions must be asked separately.

Students hold rights over their files even when they never exercise them, and an university's duty does not depend on a student asking about it.

Information minimisation is the cheapest control available: information never collected can not be breached, misused or retained too long.

Health and safety exceptions are for genuine emergencies, judged on the facts at the time, and they do not create a standing permission to share broadly.

Proctoring integrations collect video, audio, screen and sometimes biometric information, and the sensitivity of that collection should set the review standard.

Email can be an education file when it is maintained about a student, and the fact that it lives in a mailbox does not remove it from the category.

Counselling files raise the same boundary issue, and employees ought to check the exception before treating such a record as a routine file.

Public files requests may reach student information, and staff handling them need to know which files are protected before responding.

Research systems retain datasets that may be de-identified in name but identifiable in combination, especially in small programmes.

Title IX files involve complainants, respondents and witnesses, and confidentiality handling there affects safety as well as adherence.

Include event notification in vendor contracts with a stated timetable measured in hours or days, not in vague promptness language.

Answer complaints about access in writing, with reasons, since an unexplained refusal cannot be challenged or learned from.

Separate health and counselling platforms from broad student platforms, with access limited to the employees who provide the care.

Analyse outside survey requests separately from institutional surveys, because the authorization for one does not cover the other.

Review a decision following it is made: was the information used for the specified purpose, does the receiver still need it, has storage expired?

Apply disciplinary disclosure limits carefully, because the outcome that may be disclosed depends on the offence and on the recipient.

Review privacy governance after a merger or system alter, since the information map from before the alter shall no longer be accurate.

Test the actual information flow of an integration, rather than trusting a diagram, because integrations routinely pass more than intended.

Consider an education app for younger students that tracks behaviour across sessions and discloses aggregates with a third party, without a confidentiality review.

Consider a campus card system whose transaction logs were kept indefinitely, and a review that sets a storage period tied to the objectives of those logs.

Consider a counseling service that keeps notes in a personal file and is asked whether those notes are education records, and that checks the exception before answering.

In that illustration the error is corrected, the original entry is retained with the challenge noted, and the student may see what altered.

Consider a student who asks for a record that has already been lawfully disclosed to another department, and who is told where it went and why.

Treating internal sharing as unrestricted is a mistake, since internal receivers still need an objective and authority for the record.

Responding to a media request from the first department that answers is an error, since the first department is rarely the department that knows the sharing limits.

Letting a privacy committee exist solely to advise is an error, because a committee that can not stop a project will be ignored when it matters.

Procuring a system before privacy review is an error that is expensive to undo, since contracts, migrations and student notices all follow the purchase.

Conversely, a lawful sharing can still be handled carelessly, in an unencrypted attachment or an open distribution list, and the harm is the same.