Saying No to an AI Tool: The Privacy Case

For saying no to an ai tool: the privacy case, think in terms of a chain: a student, a student input to an AI tool, a purpose, an authority, a recipient, a safeguard and a storage date. Break any link and the disclosing fails, even if each other link is sound. This guide walks that chain link by link, so the reader may see exactly where a proposed disclosing holds and where it breaks.

Cloud hosting does not move responsibility: the institution remains answerable for a file even when another company stores it.

Removal at contract end must be verifiable, not merely promised, and the verification method ought to be agreed before signing.

Accessibility tools can collect personal information about disability, and their privacy review must be as careful as their accessibility review.

An incident response that starts with notification and skips containment will notify students about a problem that is still getting worse.

Name, enrollment status and field of study are commonly designated, while grades, disciplinary outcomes and financial facts are not directory information.

Accessibility data in an education platform can reveal disability status, and access to it should be limited to employees who need it for support.

Voice data in support and proctoring systems is biometric in substance, even when vendors describe it as audio processing.

What counts as directory information varies by university, because each university designates its own list within the federal framework.

Video surveillance holds images of identifiable students, and its storage, access and disclosure requirements should be documented before cameras are installed.

Disability documentation is among the most sensitive data a college retains, and it ought to never travel with broad academic files by default.

Require verifiable parental permission for younger users, and do not accept a checkbox that anyone may tick as verification.

Retain inventories current, and treat an inventory that is a year out of date as no inventory at all.

Assess new systems before purchase, with privacy review as a gate, not as a comment added after the contract is signed.

Test vendor information flows in a staging environment where possible, since production testing risks the very files being protected.

Full both the COPPA and the FERPA analysis for AI tutors used by younger students before any pilot begins.

Settle survey protections before distribution, including anonymity, retention and reporting, since retroactive safeguarding is rarely credible.

Retain audit evidence on a specified schedule, since evidence deleted too early cannot support a later defense, and evidence kept too long becomes a file of its own.

Explain redactions in access responses, since an unexplained gap teaches a student that files are edited at will.

Consider a vendor that suffers a breach affecting student records, and an institution whose contract required notification within three days.

In that illustration students who decline biometrics are not disadvantaged, and the biometric templates of students who leave are deleted on schedule.

Consider a labelled illustration: a mid-sized college adopts a new advising platform and maps which fields it will retain before signing anything.

In that illustration the files are removed from the broad system, the affected students are told, and the integration is fixed so it cannot happen again.

In that illustration the parent provides the evidence, the disclosure is made and logged, and the student is told what was shared.

A third is confusing security with confidentiality: a well-encrypted system may still disclose a record to a recipient who had no right to it.

Accepting a vendor's consumer confidentiality policy as a substitute for a contract is an error, since consumer policies describe the vendor's own practices, not the institution's purposes.

Letting a confidentiality committee exist only to advise is an error, because a committee that cannot stop a project shall be ignored when it matters.

Accepting a vendor's self-assessment as evidence, where the data is personal, is an error, because self-assessment answers the issues the vendor chose to request.

Sharing a disciplinary outcome beyond the limits for that offence and recipient is a mistake that can harm a student long following the procedure ends.