Vendor Mergers, Acquisitions and Student Data

The direct answer to vendor mergers, acquisitions and student data is less about memorising a statute and more about a repeatable check before data moves: confirm what the student data retained by a vendor is, confirm the purpose, confirm the authority, confirm that the recipient needs it, and confirm the safeguard. Five confirmations, done in writing where the stakes are high, prevent most of the errors this ledger exists to describe.

Copies of records given to students ought to be full enough to be useful, and redactions of third-party information ought to be explained.

Cloud hosting does not move responsibility: the college remains answerable for a record even when another company stores it.

Governance fails quietly when nobody owns a decision, and the first fix in most institutions is naming an owner, not writing a new policy.

Surveillance on campus alters behavior even when it is lawful, and that chilling effect belongs in the determination, not outside it.

Grades, transcripts, enrollment facts and disciplinary outcomes are the clearest education records, but the category reaches well beyond them.

Media requests for student information should go through the confidentiality officer, not through the first department that picks up the phone.

An opt-out, once exercised, must be honoured across platforms, including directories, publications and data feeds that were built before the opt-out arrived.

State biometric laws add duties that vary by state, and a campus operating across states must not assume one state's rule covers another's.

International student systems hold visa and immigration data, and the sensitivity of that data should shape each sharing determination about it.

Biometric systems hold templates that can not be changed if compromised, and that permanence should drive the decision to deploy them at all.

Require a court order or subpoena procedure for compelled disclosures, and do not disclose on the strength of a letter alone.

Require written agreements for studies conducted on behalf of the institution, with limits on use, de-identification where possible, and destruction on schedule.

Train staff on the decisions they actually make, using cases from their own department, rather than generic slides regarding a statute.

Detect events early through tracking, because early detection limits the number of students affected.

Patch platforms on a stated timetable, and prioritise patches for platforms holding identifiable student information.

Test vendor data flows in a staging environment where possible, since production testing risks the very records being safeguarded.

Separate health and counseling platforms from broad student platforms, with access limited to the staff who provide the care.

Include subprocessors in vendor contracts by name or by category with notification of alters, since an unnamed chain is an uncontrolled chain.

Consider a proctoring tool adopted during a rush to online teaching, and reviewed properly solely a year later, following thousands of recordings were stored.

Where the full file is genuinely required in such a case, the sharing is limited, explained to the student where required, and noted in the file.

Consider an employer who asks an institution to confirm a graduate's degree and is given only the directory facts the institution has designated, not the transcript.

Consider a survey of younger users on an education platform that collects birth dates for age screening and then retains them indefinitely.

In the badly done illustration, sensitive comments were included in the export, no removal date was agreed, and the student notice still described the old system.

Accepting a vendor's consumer confidentiality policy as a substitute for a contract is a mistake, because consumer policies describe the vendor's own practices, not the college's purposes.

Forgetting to review privacy oversight after a merger or platform change is a mistake, since the information map from before the change will no longer be accurate.

Leaving access in place following a role alter is a mistake that compounds silently, since the former access looks legitimate in each log.

Procuring a system before confidentiality review is a mistake that is expensive to undo, since contracts, migrations and student notices all follow the purchase.

Collecting disability data through assistive technology without reviewing the vendor is a mistake, since usage data may reveal disability.