When State and Federal Rules Conflict

In short, when state and federal requirements conflict turns on one issue: which student record under state law is involved, who retains it, and what objective justifies the next step with it. Get those three answers right and most of the rest of the determination follows; miss any one of them and the requirement applied shall be the wrong requirement for the facts in front of you.

AI tutors used by younger students raise both COPPA and FERPA issues, and both analyses must be done before the pilot, not following it.

Analytics may improve teaching, but analytics built on identifiable student data need the same authorization analysis as any other use.

Oversight fails quietly when nobody owns a determination, and the first fix in most institutions is naming an owner, not writing a new policy.

Security safeguards safeguard a record from unauthorised access, but they do not make an unauthorised disclosure lawful, and the two questions must be asked separately.

Early alert platforms combine academic, attendance and support information to flag students, and the combination itself is a confidentiality determination with consequences for the student flagged.

Disability documentation is among the most sensitive information a college retains, and it ought to never travel with broad academic records by default.

Disclosed drives accumulate copies that outlive their purpose, and periodic review of disclosed folders is a privacy task, not housekeeping.

Bluetooth beacons in classrooms may record attendance silently, and silent collection deserves explicit notice to the students affected.

Directory information is a defined subset that an university might designate and publish, and the designation must be published before it is relied on.

Survey platforms hold responses that can be personal, and the survey design ought to settle anonymity, retention and reporting before distribution.

Patch platforms on a specified timetable, and prioritise patches for platforms holding identifiable student data.

Separate duties so that the person who approves a sharing is not the only person who can see that it happened.

Own each group mailbox membership list, since an unowned list is an access control failure waiting to be discovered.

Detect events early through monitoring, since early detection limits the number of students affected.

Distinguish employee records from student records for student employees, because the capacity in which a file was created matters.

Apply the highest notification and permission standard to personal survey topics, because the injury of unwanted disclosure is greatest there.

Build opt-out into data feeds, so that an opt-out exercised in one platform propagates to each platform that publishes the data.

Track confidentiality metrics honestly, such as time to delete, time to respond to access requests, and number of vendors without current contracts.

Consider a parent who requests for a dependent student's records and is asked, politely, for evidence of dependency, since the exemption requires it.

Consider a college that adopts the same system without an alternative, and that discovers too late that some students can not or shall not enrol.

Consider the same breach without a notification term: the university learns regarding it weeks later from a press report, and students learn regarding it at the same time.

In that illustration the request is answered for the employment capacity solely, and the academic file is not disclosed by mistake.

In that illustration the parent provides the evidence, the disclosure is made and logged, and the student is told what was shared.

Accepting a vendor's self-assessment as evidence, where the information is personal, is a mistake, because self-assessment answers the issues the vendor chose to ask.

Collecting biometric data without a non-biometric alternative is an error, because some students can not or will not enrol, and they should not be disadvantaged.

Starting an AI pilot for younger students before completing both the COPPA and the FERPA analysis is an error that is discovered, not prevented.

Retaining audit evidence too long is a mistake of its own, because evidence kept beyond its schedule becomes a record that itself needs safeguarding.

Giving a small college no disclosed-service option for confidentiality review is an error, because a college without a dedicated officer still carries the same duties.