The School Official Exception for Vendors

Put simply, the school official exemption for vendors is about control over a student data held by a vendor that belongs, in a practical sense, to a student and is held in trust by an university. The university may use it for the objective it was collected for, share it where the law or a valid permission allows, and must safeguard it everywhere else. Everything in this guide is a way of making that sentence workable at a desk, stage by stage.

A notice that no student can find, or that no student can understand, does not do the work of consent or of a directory designation.

Role alters must trigger access reviews, or former access quietly becomes current risk.

Subprocessors multiply risk because each one is another holder of the file, and the contract must reach them or the chain breaks.

Security safeguards safeguard a file from unauthorised access, but they do not make an unauthorised disclosure lawful, and the two questions must be asked separately.

Parents of dependent students may receive files under an exception, but dependency must be established, not assumed from a family relationship.

Learning management systems file clicks, views, submissions and time on task, and each of those information points needs an objective before it is collected.

Facial recognition on site raises identification risks that go beyond ordinary photography, and its use needs a documented justification and a review procedure.

Law enforcement files created by a campus police unit for a law enforcement objective are treated separately from education files, with their own limits.

What counts as directory information varies by institution, since each institution designates its own list within the federal framework.

Undocumented students face serious consequences from file disclosure, and staff should be especially careful about disclosing that could reveal status.

Limit the sharing to the minimum the objective needs, and treat extra information as extra risk rather than extra helpfulness.

Identify the authorization before the information moves, not following, since retrospective authorization is usually no authorization at all.

Trigger access reviews on role changes automatically where possible, and treat manual review as a fallback, not as the plan.

Audit surveillance systems for access, retention and sharing, since cameras generate files continuously, even when nobody watches.

Delete on schedule, and make deletion verifiable, since a deletion that can not be shown is a deletion that shall be doubted.

Secure employees devices that hold student information, with encryption and remote wipe, because a lost laptop can hold a filing cabinet of files.

Turn audit findings into a remediation plan with priorities, because a list of findings without a plan is a list of known risks left open.

Run penetration tests on student platforms, and treat the findings as a work list with owners and dates, not as a report to file.

The cost of fixing the badly done adoption, in renegotiation, migration and lost trust, is far higher than the cost of the review that was skipped.

Consider a college that adopts the same platform without an alternative, and that discovers too late that some students cannot or shall not enroll.

Consider a vendor that suffers a breach affecting student files, and an institution whose contract required notification within three days.

In that illustration the review finds recordings retained far beyond the exam period, and the university deletes the backlog and shortens storage prospectively.

In that illustration the instructor shares the summary, the colleague's advice improves, and no record leaves the instructor's office.

Publishing a directory without checking the opt-out list is a mistake that is apparent to every student who opted out, and to their peers.

Sharing a full file when a summary would serve is an error, since the extra information adds risk without adding value to the purpose.

Obstructing a student's habit of keeping personal copies of their files is a mistake, because a student who can track their own file spots errors early.

Treating silence as informed agreement is a mistake, especially for students who are less familiar with privacy notices and opt-outs.

Answering a complaint regarding denied access without reasons is an error, since an unexplained refusal can not be challenged or learned from.