State Laws on Student Data and Vendors

The direct answer to state laws on student information and vendors is less regarding memorising a statute and more regarding a repeatable verify before information moves: confirm what the student file under state law is, confirm the objective, confirm the authorization, confirm that the recipient needs it, and confirm the safeguard. Five confirmations, done in writing where the stakes are high, avoid most of the errors this ledger exists to describe.

The burden of proving authorization sits with the institution making the disclosure, not with the student questioning it afterwards.

Annual notifications are not a formality: they are the moment students learn what directory information means and how to opt out.

AI tutors used by younger students raise both COPPA and FERPA issues, and both analyses must be done before the pilot, not following it.

Security baselines for new systems should be set before launch, because retrofitting controls after adoption rarely restores the data already disclosed.

Health and counselling systems ought to be segregated from general student systems, with access limited to the staff who provide the care.

Photographs and video become education files when they are maintained as part of a student's file, and a casual photo is not automatically in that category.

Assistive technology may collect usage information that reveals disability, and vendors of such tools should be reviewed with that sensitivity in mind.

Audit and evaluation disclosures must be limited to the audit or evaluation purpose, and the receiver must be bound to that purpose.

AI grading tools create a new record in the form of the grade and the feedback, and that record inherits the protections of the underlying submission.

First-generation students may have less familiarity with confidentiality notices and opt-outs, and institutions ought not to treat silence as informed agreement.

Review assistive technology vendors for the usage data they collect, since that data may reveal disability.

Review third-party access routinely, and remove access that is no longer required, rather than leaving it in place for convenience.

Give small colleges a shared-service option for confidentiality review, since an institution without a dedicated officer still carries the same duties.

Analyse mixed-audience platforms for their younger users separately, because a policy written for adults does not cover children.

Map information flows for each major platform, and update the map when integrations alter, because integrations alter silently.

Apply disciplinary disclosure limits carefully, since the outcome that might be shared depends on the offence and on the recipient.

Retain audit evidence on a stated schedule, since evidence deleted too early can not support a later defence, and evidence kept too long becomes a record of its own.

Start each decision by naming the record in plain terms, since a decision regarding an unnamed record is a decision regarding nothing in particular.

In that illustration the sharing is limited to the disciplinary objective, and the file is not treated as an ordinary student file afterwards.

In the badly done illustration, personal comments were included in the export, no removal date was agreed, and the student notice still described the old system.

In that illustration the merged institution reconciles the schedules before migrating information, and deletes files that both schedules agreed had expired.

In that illustration the review, when it finally happens, finds monitoring that was never disclosed, and the institution must withdraw the app mid-term.

Consider a network team that holds connection logs and is asked for them during a disciplinary procedure, and that verifies the disclosure requirements before releasing any log.

Treating internal sharing as unrestricted is a mistake, since internal recipients still need an objective and authority for the file.

Installing surveillance without written retention and access rules is an error, because cameras generate records continuously, even when nobody watches.

Forgetting that a studies agreement must limit use and require destruction is an error that leaves research information in circulation following the study ends.

Disclosing to a parent on the basis of family relationship alone, without establishing dependency, is an error that recurs every enrollment season.

Documenting an emergency sharing after the fact, from memory, is a mistake, since later reconstruction rarely convinces a reviewer.