PPRA and Course Evaluations

The first thing to settle in ppra and course evaluations is the identity of the survey response and the reason it is retained, because every later issue regarding permission, exception or contract depends on those two facts. Where the file is unclear, the rest of the analysis wobbles with it; where the file is clear, the determination usually follows without drama.

Outside organisations conducting surveys on campus need authority analysis of their own, separate from the university's own survey requirements.

When security and privacy requirements appear to conflict, the conflict ought to be escalated and documented, not resolved by ignoring one side.

A disclosure is lawful only when its purpose, its authorization and its recipient all line up, and a gap in any one of those three is a reason to pause.

Design-stage review catches problems when they are still cheap to fix, and late review catches them when they are expensive to undo.

Equity in confidentiality means recognising that the same disclosure harms different students differently, and that uniform procedures may still produce unequal risk.

Site card platforms retain transaction and location information, and their retention ought to reflect that sensitivity rather than the convenience of indefinite logs.

Students who are additionally employees have files in both capacities, and the capacity in which a record was created matters to its treatment.

Financial aid systems retain income and family data, and access to them should be among the most tightly controlled on campus.

Disciplinary disclosures to victims and others have specific limits, and the outcome that may be disclosed depends on the offence and the recipient.

Media requests for student information ought to go via the confidentiality officer, not via the first office that picks up the phone.

Turn audit findings into a remediation plan with priorities, since a list of findings without a plan is a list of known risks left open.

Refuse parental access for independent students politely and in writing, with the reason stated, since an unexplained refusal invites repeated requests.

Start each determination by naming the file in plain terms, because a determination regarding an unnamed file is a determination regarding nothing in particular.

Verify permission for specificity, freedom and revocability, and do not rely on a blanket permission that was never explained.

Test the actual information flow of an integration, rather than trusting a diagram, since integrations routinely pass more than intended.

Review disclosed folders periodically, and treat disclosed-folder review as a privacy task with an owner, not as housekeeping.

State the purpose in a sentence a student could understand, and if the sentence cannot be documented plainly, the purpose is probably too broad.

Identify the authorization before the data moves, not following, because retrospective authorization is usually no authorization at all.

Consider an admissions department that retains applicant information for students who never enrolled, and that deletes those records when the specified schedule expires.

In that illustration a review finds the storage unjustified, the birth dates are deleted, and the screening is redesigned to collect the minimum required.

In that illustration the project is paused, the information uses are documented in plain language, and the dashboard is rebuilt around a stated objective.

In that illustration the parent provides the evidence, the sharing is made and logged, and the student is told what was shared.

The contract in that illustration names the data, limits use to the institution's objectives, bans advertising use, and sets deletion ninety days after the contract ends.

Forgetting to review privacy governance following a merger or system change is an error, since the information map from before the change will no longer be accurate.

Procuring a system before confidentiality review is a mistake that is expensive to undo, since contracts, migrations and student notices all follow the purchase.

Installing surveillance without written retention and access requirements is an error, since cameras generate files continuously, even when nobody watches.

A second common mistake is relying on a permission that was never particular, never explained, or obtained following the disclosure it was meant to authorise.

Analysing a marketing use as routine, and therefore authorised, is an error, since routine is not authority.