Privacy Risk Assessments, Done Properly
A plain-language guide to privacy risk assessments, done properly: the record, the purpose, the authority and the safeguard.
- Record
- privacy audit record in audits, documentation and readiness
- Data
- Privacy Risk Assessments, Done Properly
- Safeguard
- an inventory, a trail of disclosures and findings tracked to closure
- First check
- State the purpose in a sentence a student could understand.
The short answer
A practical way to approach privacy risk assessments, done properly is to ask what a student would expect if they saw the sharing described in plain language. Where the sharing matches that expectation and the authorization supports it, it can proceed with a log entry; where it surprises, it needs consent, an identified exemption or a fresh decision, not a quiet assumption.
Single sign-on reduces password risk but concentrates identity risk, and the safeguards around the identity provider deserve matching attention.
Directory information is the one category where a published designation can alter the answer, and solely where the designation and the opt-out were done properly.
Role alters must trigger access reviews, or former access quietly becomes current risk.
Analytics can improve teaching, but analytics built on identifiable student information need the same authority analysis as any other use.
What this covers
AI grading tools create a new record in the form of the grade and the feedback, and that record inherits the protections of the underlying submission.
An education record is defined by how it is maintained and whom it is regarding, not by the folder it sits in or the platform that holds it.
Video surveillance holds images of identifiable students, and its storage, access and sharing requirements ought to be written before cameras are installed.
What counts as directory information varies by university, because each university designates its own list within the federal framework.
Title IX files involve complainants, respondents and witnesses, and privacy handling there affects safety as well as adherence.
Photographs and video become education records when they are maintained as part of a student's file, and a casual photo is not automatically in that category.
How to work through it
Plan for remote work explicitly, with controls that travel with the file to staff homes and personal devices.
Settle survey protections before distribution, including anonymity, storage and reporting, because retroactive protection is rarely credible.
Monitor student file platforms for anomalous access, and investigate anomalies, because uninvestigated anomalies teach employees that nobody watches.
Encrypt records in transit and at rest, and treat encryption as a baseline, not as a substitute for access control or purpose limits.
Own every group mailbox membership list, since an unowned list is an access control failure waiting to be discovered.
Write notices in plain language, and test them on students, since a notice that confuses its readers has failed its purpose.
Need verifiable parental permission for younger users, and do not accept a checkbox that anyone can tick as verification.
Test the actual information flow of an integration, rather than trusting a diagram, because integrations routinely pass more than intended.
A worked illustration
In that illustration the officer verifies the disciplinary sharing limits, confirms what might be shared, and provides the media a documented, limited answer.
Consider an employer who asks an university to confirm a graduate's degree and is given solely the directory facts the university has designated, not the transcript.
Consider a faculty member who wants to use a free AI grading tool and discovers the tool retains submissions for training by default.
In that illustration the project is paused, the information uses are documented in plain language, and the dashboard is rebuilt around a stated purpose.
Consider an alumni office that wants to publish a class directory and that verifies opt-outs and designations for former students before publishing.
Where guides go wrong
Punishing escalation is a mistake, since staff who are punished for asking will stop asking and start deciding quietly.
Mixing health or counseling records into general student platforms is an error that is hard to undo once the information has spread.
Auditing AI tools only for accuracy, and not for information retention and prompt handling, is an error, since AI systems produce files that routine audits miss.
Treating aggregates as anonymous when the underlying data remains identifiable is an error, since re-identification risk does not vanish at the dashboard.
Sending an accrediting body more than the accreditation objective needs is a mistake, because the exemption bounds what might be sent.
Sources and evidence on the record
- Family Educational Rights and Privacy Act regulations, 34 CFR Part 99, text on eCFR.
- US Department of Education, Student Privacy Policy Office, studentprivacy.ed.gov - FERPA guidance, FAQs and model notices.
- National Institute of Standards and Technology, Computer Security Resource Center - control guidance used here as method, not as law.
Evidence basis: Department of Education guidance and audit practice Applies when: When a college holds, uses or discloses a privacy audit record in the context of audits, documentation and readiness