LMS Third-Party Tools and LTI Data Flows
LMS Third-Party Tools and LTI Data Flows explained for colleges: the rule, the exceptions, and the record an institution should keep.
- Record
- learning record in lms platforms and learning data
- Data
- LMS Third-Party Tools and LTI Data Flows
- Safeguard
- role-based access and retention tied to the course term
- First check
- Limit the sharing to the minimum the purpose requires.
The short answer
In short, lms third-party tools and lti data flows comes down to one issue: which learning file is involved, who holds it, and what objective justifies the next step with it. Get those three answers right and most of the rest of the determination follows; miss any one of them and the requirement applied shall be the wrong requirement for the facts in front of you.
Health surveys on site can trigger additional protections, and the survey design should settle those protections before distribution.
Cloud hosting does not move responsibility: the university remains answerable for a file even when another company stores it.
Security baselines for new systems should be set before launch, because retrofitting controls following adoption rarely restores the data already shared.
Small disclosures add up: a series of minor sharings may reveal a picture of a student that no single disclosing intended to produce.
What this covers
AI grading tools create a new file in the form of the grade and the feedback, and that file inherits the protections of the underlying submission.
Bluetooth beacons in classrooms may file attendance quietly, and silent collection deserves explicit notice to the students affected.
Directory information is a defined subset that an university might designate and publish, and the designation must be published before it is relied on.
Subpoenas and court orders for student files have their own process, and employees ought not to disclose on the strength of a letter alone.
Assistive technology may collect usage information that reveals disability, and vendors of such tools should be reviewed with that sensitivity in mind.
Third-party tools connected to a learning system may receive more data than the integration was meant to pass, and the actual data flow should be tested, not assumed.
How to work through it
State the purpose in a sentence a student could understand, and if the sentence can not be documented plainly, the purpose is probably too broad.
Audit vendor adherence, and do not accept a vendor's self-assessment as a substitute for evidence where the information is sensitive.
Secure staff devices that retain student information, with encryption and remote wipe, because a lost laptop may retain a filing cabinet of files.
Route media requests for student information through the privacy officer, and do not let the first department to answer become the disclosure determination.
Detect events early via monitoring, because early detection limits the number of students affected.
Complete both the COPPA and the FERPA analysis for AI tutors used by younger students before any pilot begins.
Separate health and counselling systems from broad student systems, with access limited to the employees who provide the care.
Map information flows for each major platform, and update the map when integrations change, since integrations change quietly.
A worked illustration
In that illustration the disclosing is limited to the disciplinary purpose, and the file is not treated as a routine student file afterwards.
In that illustration the parent provides the evidence, the disclosure is made and logged, and the student is told what was shared.
The contract in that illustration names the information, limits use to the college's purposes, bans advertising use, and sets removal ninety days following the contract ends.
Consider a registrar asked by a parent for a student's grades following the student has turned eighteen and is no longer a dependent for the relevant purpose.
In that illustration the review, when it finally happens, finds monitoring that was never disclosed, and the university must withdraw the app mid-term.
Where guides go wrong
Answering a complaint about denied access without reasons is an error, because an unexplained refusal can not be challenged or learned from.
This guide does not interpret the law for a particular institution, and readers should escalate cases it cannot settle rather than treating its structure as a determination.
Its value is in the structure it teaches: name the record, state the purpose, settle the authorization, limit the disclosing, safeguard the information, and retain the record.
Auditing releases without verifying the log is an error, because a disclosure missing from the log is a finding, not a clerical gap.
Screening younger users by collecting more data than the screening needs is a mistake, since the protection then becomes the problem.
Sources and evidence on the record
- Family Educational Rights and Privacy Act regulations, 34 CFR Part 99, text on eCFR.
- US Department of Education, Student Privacy Policy Office, studentprivacy.ed.gov - FERPA guidance, FAQs and model notices.
- US Department of Education, ed.gov - guidance, Dear Colleague letters and enforcement information.
Evidence basis: 34 CFR Part 99 and Department of Education guidance Applies when: When a college holds, uses or discloses a learning record in the context of lms platforms and learning data