Privacy, Confidentiality and Security: Three Different Jobs

The direct answer to confidentiality, confidentiality and security: three different jobs is less about memorising a statute and more about a repeatable check before data moves: confirm what the education record is, confirm the objective, confirm the authority, confirm that the receiver needs it, and confirm the safeguard. Five confirmations, done in writing where the stakes are high, prevent most of the errors this ledger exists to describe.

Annual notifications are not a formality: they are the moment students learn what directory information means and how to opt out.

Purpose limitation is the thread through the whole subject: information collected for teaching should not drift into marketing, product development or unrelated research without fresh authority.

An exception that fits the facts of one case does not automatically fit the next case, even when the two cases involve the same platform or the same office.

Health surveys on campus may trigger additional protections, and the survey design should settle those protections before distribution.

A note kept only for its author's personal use, never shared, sits outside the category, and the moment it is shared that safeguarding may fall away.

Equity in privacy means recognising that the same sharing harms different students differently, and that uniform procedures may still produce unequal risk.

Photographs and video become education files when they are maintained as part of a student's file, and a casual photo is not automatically in that category.

Audit and evaluation releases must be limited to the audit or evaluation objective, and the recipient must be bound to that objective.

Studies conducted on behalf of an university need documented agreements that limit use, require de-identification where possible, and require destruction on schedule.

An education record is defined by how it is maintained and whom it is about, not by the folder it sits in or the system that holds it.

Complete both the COPPA and the FERPA analysis for AI tutors used by younger students before any pilot begins.

Apply the highest notice and consent standard to personal survey topics, since the injury of unwanted sharing is greatest there.

File the determination where a log is required, and keep the log in a place a future reviewer can really find.

Establish dependency before disclosing to parents of a student, and do not assume it from a family relationship or a disclosed surname.

Test vendor information flows in a staging environment where possible, since production testing risks the very records being protected.

Analyse outside survey requests separately from institutional surveys, since the authorization for one does not cover the other.

Set security baselines before a new platform launches, because retrofitting controls after adoption rarely restores data previously shared.

Train employees on the decisions they really make, using cases from their own department, rather than generic slides regarding a statute.

Consider a department that wants to publish a directory of student contact details for a course, and that checks the directory designation and opt-out list first.

Consider a parent who requests for a dependent student's records and is asked, politely, for evidence of dependency, since the exception needs it.

In the badly done illustration, personal comments were included in the export, no deletion date was agreed, and the student notice still described the old system.

In that illustration a review finds the retention unjustified, the birth dates are deleted, and the screening is redesigned to collect the minimum required.

Consider a health centre that shares treatment files with a general student platform by accident, and that treats the accident as an incident, not as a clerical slip.

Approving a disclosure without recording it is a mistake, because a reviewer, auditor or student will eventually request what happened and why.

Writing a policy that employees cannot state without opening the document is a mistake, since the policy will not be followed under time pressure.

Disclosing to a parent on the basis of family relationship alone, without establishing dependency, is a mistake that recurs each enrolment season.

Sharing a disciplinary outcome beyond the limits for that offence and receiver is a mistake that may harm a student long following the process ends.

A second common mistake is relying on a permission that was never particular, never explained, or obtained following the disclosure it was meant to authorise.