State Laws for K-12 Versus Higher Education

For state laws for k-12 versus higher education, think in terms of a chain: a student, a student record under state law, a purpose, an authorization, a receiver, a safeguard and a storage date. Break any link and the disclosing fails, even if each other link is sound. This guide walks that chain link by link, so the reader can see exactly where a proposed disclosing holds and where it breaks.

Vendor selection is a privacy determination before it is a purchasing determination, since the vendor's information practices become the university's risk.

Age screening for younger users must not collect more information than the screening itself needs, or the protection becomes the problem.

The burden of proving authorization sits with the institution making the disclosure, not with the student questioning it afterwards.

Redisclosure is its own decision: a receiver who lawfully received a file may not pass it on unless a rule or permission covers that second sharing.

AI feedback tools might retain student work for training unless the contract says otherwise, and that term ought to be settled before adoption.

Biometric systems hold templates that can not be altered if compromised, and that permanence should drive the decision to deploy them at all.

Discussion posts in a course platform are maintained about identifiable students, and their retention ought to follow the course record schedule.

Cloud systems do not alter what counts as a file, but they alter where copies live, and every copy needs the same oversight as the original.

Career services retain employment and internship information, and disclosing that information with employers needs consent analysis even when the disclosing feels helpful.

Photographs and video become education files when they are maintained as part of a student's file, and a casual photo is not automatically in that category.

Full both the COPPA and the FERPA analysis for AI tutors used by younger students before any pilot begins.

Analyse outside survey requests separately from institutional surveys, since the authorization for one does not cover the other.

Secure employees devices that hold student information, with encryption and remote wipe, because a lost laptop can hold a filing cabinet of files.

Safeguard applicant files on a stated schedule, even though applicants never become students in the usual sense.

Publish directory designations where students encounter them at enrollment, not only in a handbook appendix.

Safeguard alumni files with the same care as current files, since graduation does not end the university's duty.

Test phishing resilience for employees who handle records, since social engineering targets people, not firewalls.

Give former students a workable procedure for exercising rights over records held regarding them, since graduation should not end practical access.

Consider an university that runs a wellness survey with sensitive issues and settles anonymity, storage and reporting before a single response is collected.

Consider a site police unit that creates a law enforcement file and is asked to share it with the dean's office, and that checks the purpose of the disclosing first.

Consider an institution that adopts the same platform without an alternative, and that discovers too late that some students cannot or will not enrol.

Consider a registrar asked by a parent for a student's grades following the student has turned eighteen and is no longer a dependent for the relevant objective.

In that illustration the request is answered for the employment capacity only, and the academic record is not disclosed by mistake.

Collecting biometric data without a non-biometric alternative is a mistake, because some students can not or will not enrol, and they should not be disadvantaged.

Forgetting that a studies agreement must limit use and need destruction is an error that leaves research data in circulation after the study ends.

Redisclosing a record received under an exemption, without checking whether the second sharing is covered, is an error that spreads the original sharing.

Conversely, a lawful disclosure can still be handled carelessly, in an unencrypted attachment or an open distribution list, and the harm is the same.

Procuring a system before confidentiality review is a mistake that is expensive to undo, since contracts, migrations and student notices all follow the purchase.