LMS Data: What the Platform Records by Default

For lms data: what the platform records by default, think in terms of a chain: a student, an education file, an objective, an authority, a receiver, a safeguard and a storage date. Break any link and the sharing fails, even if each other link is sound. This guide walks that chain link by link, so the reader may see exactly where a proposed sharing retains and where it breaks.

Design-stage review catches problems when they are still cheap to fix, and late review catches them when they are expensive to undo.

AI tutors used by younger students raise both COPPA and FERPA issues, and both analyses must be done before the pilot, not after it.

Outside organisations conducting surveys on campus need authority analysis of their own, separate from the institution's own survey requirements.

Free tools are not free of privacy cost, and the price is often paid in information uses the institution never reviewed.

State biometric laws add duties that vary by state, and a site operating across states must not assume one state's requirement covers another's.

Audit and evaluation disclosures must be limited to the audit or evaluation objective, and the recipient must be bound to that objective.

Early alert platforms combine academic, attendance and support information to flag students, and the combination itself is a privacy decision with consequences for the student flagged.

Event and attendance systems hold location information regarding students, and that information may reveal patterns that deserve protection.

International student platforms retain visa and immigration information, and the sensitivity of that information ought to shape each disclosing decision about it.

Biometric systems retain templates that cannot be altered if compromised, and that permanence ought to drive the decision to deploy them at all.

Need a court order or subpoena process for compelled releases, and do not disclose on the strength of a letter alone.

Train employees on the decisions they really make, using cases from their own office, rather than generic slides about a statute.

Test phishing resilience for staff who handle records, because social engineering targets people, not firewalls.

Require documented agreements for studies conducted on behalf of the university, with limits on use, de-identification where possible, and destruction on schedule.

Limit accommodation letters to what a lecturer needs to provide the accommodation, and do not include the underlying diagnosis.

Map data flows for each major platform, and update the map when integrations alter, since integrations alter quietly.

Audit AI tools for data storage, prompt handling and output storage, because AI systems produce files that routine audits miss.

Prepare documentation a regulator would request for, and keep it in one place, because scattered documentation reads as no documentation.

Consider a campus that installs cameras in a residence hall entrance and writes retention, access and disclosure rules before the cameras are switched on.

In that illustration students who decline biometrics are not disadvantaged, and the biometric templates of students who leave are deleted on schedule.

Consider a student who asks for a record that has already been lawfully disclosed to another department, and who is told where it went and why.

In that illustration the university must retrofit an alternative under pressure, and the students affected have already lost trust in the procedure.

In that illustration the request is answered for the employment capacity only, and the academic record is not disclosed by mistake.

Auditing AI tools only for accuracy, and not for data retention and prompt handling, is an error, since AI platforms create files that ordinary audits miss.

This guide does not substitute for an institution's own policies or counsel, and a conflict between the two should be resolved in favour of the institution's own advice.

Answering a complaint regarding denied access without reasons is an error, since an unexplained refusal can not be challenged or learned from.

Forgetting that a studies agreement must limit use and require destruction is a mistake that leaves research data in circulation after the study ends.

Writing a policy that staff cannot state without opening the document is a mistake, because the policy shall not be followed under time pressure.