Disclosure Without Consent: The Exceptions Map
Disclosure Without Consent: The Exceptions Map: what it means for an education record, who may use it, and the check to make before it moves.
- Record
- education record in consent and disclosure exceptions
- Data
- Disclosure Without Consent: The Exceptions Map
- Safeguard
- written consent, or an exception that fits the facts, recorded in the log
- First check
- Check that the recipient is bound to use the data only as agreed.
The short answer
The first thing to settle in disclosure without consent: the exemptions map is the identity of the education record and the reason it is held, since every later issue about consent, exception or contract depends on those two facts. Where the record is unclear, the rest of the analysis wobbles with it; where the record is clear, the determination usually follows without drama.
State law can add duties on top of federal law, and an institution operating in several states must track the strictest applicable rule for each file.
Alumni records do not lose safeguarding at graduation, and the requirements for former students deserve the same care as for current ones.
Copies of records given to students should be complete enough to be useful, and redactions of third-party information should be explained.
Support employees access to live files is a disclosure in substance, even when the vendor describes it as maintenance.
What this covers
Financial aid releases to other institutions and agencies follow their own exception, and the sharing ought to be limited to what the aid decision needs.
Residence hall surveillance involves students in their homes, and the confidentiality standard there should be higher than in a public quad.
Photographs and video become education files when they are maintained as part of a student's file, and a casual photo is not automatically in that category.
An education file is defined by how it is maintained and whom it is regarding, not by the folder it sits in or the platform that retains it.
Admissions data involves applicants who might never enrol, and their files deserve protection even though they never become students in the usual sense.
Cloud systems do not alter what counts as a record, but they alter where copies live, and each copy needs the same governance as the original.
How to work through it
Route media requests for student information via the confidentiality officer, and do not let the first department to answer become the sharing decision.
Support students who keep personal copies of their files, since a student who may track their own file is a student who may spot errors early.
Establish dependency before disclosing to parents of a student, and do not assume it from a family relationship or a disclosed surname.
Need documented agreements for studies conducted on behalf of the institution, with limits on use, de-identification where possible, and destruction on schedule.
Encrypt employees devices, enable remote wipe, and test both, since an untested control is a hope, not a control.
Give former students a workable procedure for exercising rights over records held about them, because graduation should not end practical access.
Honour deletion rights for children's information promptly, and make deletion reach backups and subprocessors on a specified timetable.
Check consent for specificity, freedom and revocability, and do not rely on a blanket consent that was never explained.
A worked illustration
In that illustration the logs are released only to the extent the procedure needs, with redactions for students not involved.
In that illustration the employer receives a prompt, limited answer, and the graduate is not surprised by a broader disclosure.
In that illustration the request is answered for the employment capacity only, and the academic record is not disclosed by mistake.
Consider an education analytics project that begins with a question regarding storage and ends with a dashboard that nobody can explain to a student.
In that illustration the parent provides the evidence, the sharing is made and logged, and the student is told what was disclosed.
Where guides go wrong
Mixing health or counselling files into general student platforms is a mistake that is hard to undo once the information has spread.
Adopting a free tool without reviewing its data practices is an error, since the price is often paid in data uses nobody reviewed.
Screening younger users by collecting more data than the screening needs is an error, because the safeguarding then becomes the problem.
Collecting disability information via assistive technology without reviewing the vendor is an error, since usage information may reveal disability.
A reader who applies that structure, and who escalates the cases it can not settle, shall make better determinations than a reader who memorises any single rule in this ledger.
Sources and evidence on the record
- Family Educational Rights and Privacy Act regulations, 34 CFR Part 99, text on eCFR.
- US Department of Education, Student Privacy Policy Office, studentprivacy.ed.gov - FERPA guidance, FAQs and model notices.
- Family Educational Rights and Privacy Act, 20 U.S.C. 1232g, statutory text.
Evidence basis: 34 CFR Part 99, disclosure and consent provisions Applies when: When a college holds, uses or discloses a education record in the context of consent and disclosure exceptions