State Attorney General Enforcement for Student Data

The first thing to settle in state attorney general enforcement for student information is the identity of the student file under state law and the reason it is retained, because every later question regarding consent, exemption or contract depends on those two facts. Where the file is unclear, the rest of the analysis wobbles with it; where the file is clear, the determination usually follows without drama.

Analytics may improve teaching, but analytics built on identifiable student information need the same authorization analysis as any other use.

Fees and formats for file inspection must not become barriers, or the right of access becomes theoretical.

Students hold rights over their files even when they never exercise them, and an institution's duty does not depend on a student asking about it.

Course evaluations can become education records when they are maintained about identifiable students, and that possibility should be checked, not assumed away.

Parents of independent students do not acquire access by asking, however strongly they feel the request is justified.

Language access matters for privacy notices, because a student who cannot read a notice cannot meaningfully consent or opt out.

Accessibility data in an education platform can reveal disability status, and access to it ought to be limited to staff who need it for support.

Single sign-on creates an identity record of its own, including authentication events that can reveal patterns of student activity.

Medical treatment files retained by a campus clinic have their own treatment exception, and the exception ends when the file is used for another objective.

Accommodation letters ought to disclose solely what an instructor needs to provide the accommodation, not the underlying diagnosis.

Segment networks so that a compromise in one platform does not automatically expose student file systems.

Audit releases against the log, and treat a sharing missing from the log as a finding, not as a clerical gap.

Separate health and counseling systems from general student systems, with access limited to the employees who provide the care.

Monitor student record systems for anomalous access, and investigate anomalies, since uninvestigated anomalies teach employees that nobody watches.

Support students who keep personal copies of their records, since a student who can track their own file is a student who can spot errors early.

Detect events early through tracking, because early detection limits the number of students affected.

Review confidentiality governance following a merger or system change, because the information map from before the change shall no longer be accurate.

Put vendor terms in the contract, not in a sales deck, and verify that the contract names the data, limits its use and needs removal on exit.

Consider a site that installs cameras in a residence hall entrance and writes retention, access and sharing requirements before the cameras are switched on.

Consider an admissions office that holds applicant information for students who never enrolled, and that deletes those files when the specified schedule expires.

In that illustration the study proceeds on the extract, the agreement limits use and needs destruction, and no identifiable file leaves the institution.

Consider an education app for younger students that tracks behavior across sessions and shares aggregates with a third party, without a confidentiality review.

In that illustration the faculty member pauses, the privacy officer reviews the tool, and the course adopts a tool whose contract excludes training use.

Redacting access responses without explaining the redactions is an error, since an unexplained gap teaches a student that records are edited at will.

Retaining information just in case is a mistake dressed as caution, because information kept without purpose is information exposed without benefit.

Disclosing on the strength of a letter alone, without a court order or subpoena process, is an error that can be avoided by a single phone call to the confidentiality officer.

Treating a course evaluation as anonymous without checking whether it is maintained regarding identifiable students is an error.

Treating aggregates as anonymous when the underlying data remains identifiable is an error, since re-identification risk does not vanish at the dashboard.