The FERPA Definition of an Education Record

In short, the ferpa definition of an education record turns on one question: which education record is involved, who retains it, and what objective justifies the next step with it. Get those three answers right and most of the rest of the decision follows; miss any one of them and the requirement applied shall be the wrong requirement for the facts in front of you.

A contract with a vendor may authorise processing on the college's behalf, but it cannot authorise uses the college itself could not authorise.

A policy that nobody has read is not a control, and the test of a policy is whether employees can state its central requirement without opening the document.

Surveillance on site changes behaviour even when it is lawful, and that chilling effect belongs in the determination, not outside it.

Data minimisation is the cheapest control available: data never collected cannot be breached, misused or retained too long.

Single sign-on creates an identity record of its own, including authentication events that may reveal patterns of student activity.

Emergency releases require a real emergency and a judgment that the sharing is necessary to protect health or safety, documented at the time.

Parents of dependent students may receive files under an exemption, but dependency must be established, not assumed from a family relationship.

State biometric laws add duties that vary by state, and a campus operating across states must not assume one state's requirement covers another's.

Students who are also employees have records in both capacities, and the capacity in which a record was created matters to its treatment.

International student platforms hold visa and immigration information, and the sensitivity of that information ought to shape each sharing determination regarding it.

Settle survey protections before distribution, including anonymity, retention and reporting, because retroactive protection is rarely credible.

Review a decision following it is made: was the information used for the specified purpose, does the recipient still need it, has storage expired?

Test the actual data flow of an integration, rather than trusting a diagram, since integrations routinely pass more than intended.

Assess new platforms before purchase, with confidentiality review as a gate, not as a comment added following the contract is signed.

Delete on schedule, and make deletion verifiable, because a deletion that can not be shown is a deletion that shall be doubted.

Contain removal verification in vendor contracts, with a method and a timetable, because a promised removal without verification shall be doubted.

Honour removal rights for children's information promptly, and make removal reach backups and subprocessors on a stated timetable.

Establish dependency before disclosing to parents of a student, and do not assume it from a family relationship or a shared surname.

In that illustration the officer checks the disciplinary sharing limits, confirms what might be shared, and gives the media a documented, limited answer.

In that illustration the parent provides the evidence, the disclosure is made and logged, and the student is told what was disclosed.

In that illustration the answer depends on whether the notes were ever disclosed, and the service records the reasoning for future cases.

Consider a parent who requests for a dependent student's records and is asked, politely, for evidence of dependency, since the exception requires it.

Consider an university that adopts a biometric attendance system and offers a card alternative that works just as well as the biometric option.

Obstructing a student's habit of retaining personal copies of their records is an error, since a student who may track their own file spots errors early.

Disclosing a full file when a summary would serve is an error, because the extra data adds risk without adding value to the purpose.

Procuring a system before privacy review is a mistake that is expensive to undo, because contracts, migrations and student notifications all follow the purchase.

Disclosing financial aid details beyond what the aid determination requires is an error, since the file frequently retains more than the determination needs.

Publishing a directory without checking the opt-out list is a mistake that is visible to each student who opted out, and to their peers.