LMS Access: Who Sees What, and When

A practical way to approach lms access: who sees what, and when is to ask what a student would expect if they saw the sharing described in plain language. Where the sharing matches that expectation and the authorization supports it, it can proceed with a log entry; where it surprises, it needs consent, a named exception or a fresh determination, not a quiet assumption.

AI tutors used by younger students raise both COPPA and FERPA questions, and both analyses must be done before the pilot, not following it.

When security and privacy rules appear to conflict, the conflict should be escalated and documented, not resolved by ignoring one side.

Permission, an identified exemption, or a contract term must cover the particular sharing in front of you, not a similar sharing from last term.

Language access for confidentiality notifications is a confidentiality control, since a notice a student cannot read cannot inform consent or an opt-out.

Title IX records involve complainants, respondents and witnesses, and privacy handling there affects safety as well as adherence.

Medical treatment files retained by a site clinic have their own treatment exception, and the exception ends when the record is used for another purpose.

Facial recognition on site raises identification risks that go beyond routine photography, and its use needs a documented justification and a review process.

Third-party tools connected to an education system may receive more information than the integration was meant to pass, and the actual information flow ought to be tested, not assumed.

Permission for biometrics should be specific, documented and revocable, with a non-biometric alternative that is genuinely usable, not merely nominal.

Counselling files raise the same boundary question, and staff ought to check the exemption before treating such a record as an ordinary file.

Retain audit evidence on a specified schedule, since evidence deleted too early cannot support a later defense, and evidence kept too long becomes a record of its own.

Retain applicant files on a specified schedule, and delete them when that schedule expires, rather than retaining them indefinitely.

Answer complaints about access in writing, with reasons, because an unexplained refusal cannot be challenged or learned from.

Build opt-out into information feeds, so that an opt-out exercised in one platform propagates to each platform that publishes the information.

Apply the highest notification and permission standard to sensitive survey topics, since the injury of unwanted sharing is greatest there.

Design age screening to collect as little as possible, since screening that collects more than it needs becomes the problem it was meant to solve.

Contain students in oversight, because students notice confidentiality problems that staff have normalised.

Limit financial aid disclosures to what the aid determination requires, and do not contain unrelated file details since they happen to be in the same file.

In the badly done illustration, sensitive comments were included in the export, no deletion date was agreed, and the student notice still described the old system.

Consider an education app for younger students that tracks behavior across sessions and discloses aggregates with a third party, without a confidentiality review.

Consider a small college without a dedicated privacy officer that discloses the role with a neighbouring university through a formal arrangement.

In that illustration the older logs are deleted, the new period is published, and future logs expire automatically.

Consider a student who asks to see an advising note that contains a factual error, and who receives the note, the correction procedure and a written decision.

Writing a policy that employees cannot state without opening the document is an error, since the policy will not be followed under time pressure.

Auditing surveillance systems solely for image quality, and not for access and storage, is a mistake, because cameras generate files continuously.

Including a diagnosis in an accommodation letter, when a lecturer only needs to know the accommodation, is an error that discloses more than the purpose requires.

Auditing releases without checking the log is a mistake, because a disclosure missing from the log is a finding, not a clerical gap.

Excluding students from confidentiality governance is a mistake, since students notification problems that staff have normalised.