When a Record Stops Being an Education Record

Put simply, when a record stops being an education record is about control over an education record that belongs, in a practical sense, to a student and is retained in trust by an institution. The institution may use it for the purpose it was collected for, share it where the law or a valid permission allows, and must safeguard it everywhere else. Everything in this guide is a way of making that sentence workable at a desk, stage by stage.

Alumni records do not lose safeguarding at graduation, and the rules for former students deserve the same care as for current ones.

A notification that no student can find, or that no student can understand, does not do the work of consent or of a directory designation.

Oversight fails quietly when nobody owns a decision, and the first fix in most institutions is naming an owner, not writing a new policy.

Research uses of education files need their own authorization analysis, and a research exception is narrower than researchers sometimes assume.

Disclosures to other schools where a student seeks to enrol are permitted, but the student should be told that such disclosures occur, through the annual notice.

Backups are copies too, and a removal process that ignores backups leaves the file in place under another name.

Subpoenas and court orders for student records have their own procedure, and employees ought not to disclose on the strength of a letter alone.

Attendance data, participation logs and advising notes may all be education files when they are maintained regarding an identifiable student.

Housing systems retain residence and roommate data, and sharing of residence information needs particular care for student safety.

Employment files for student employees sit in a distinct category, and the distinction matters when a record is requested.

Bound accrediting releases to the scope of the exemption, and send solely what the accreditation objective needs.

Retain a privacy committee that may actually stop a project, since a committee that solely advises shall be ignored when it matters.

Review assistive technology vendors for the usage data they collect, since that data can reveal disability.

Design age screening to collect as little as possible, since screening that collects more than it needs becomes the problem it was meant to solve.

Locate each copy before deciding, including the vendor copy, the backup copy and the copy in the disclosed drive.

Analyse mixed-audience platforms for their younger users separately, because a policy documented for adults does not cover children.

Name a person to request when the answer is unclear, and welcome escalation, because punished escalation produces quiet non-adherence.

Map information flows for each major system, and update the map when integrations change, since integrations change quietly.

Consider an university that merges two campuses and discovers that each site held the same files under different retention schedules.

In that illustration the review finds recordings retained far beyond the exam period, and the institution deletes the backlog and shortens storage prospectively.

A second illustration, again hypothetical, demonstrates the same adoption done badly: the institution signs on standard consumer terms and discovers a right to use de-identified data for product improvement.

In that illustration the files are removed from the general platform, the affected students are told, and the integration is fixed so it can not happen again.

Consider an employer who asks an institution to confirm a graduate's degree and is given only the directory facts the institution has designated, not the transcript.

Distributing a sensitive survey without settling anonymity and storage first is an error that cannot be repaired by a later apology.

Treating alumni records as unprotected history is an error, because graduation does not end the institution's duty.

Obstructing a student's habit of keeping personal copies of their records is an error, since a student who may track their own file spots errors early.

Disclosing a full file when a summary would serve is a mistake, because the extra information adds risk without adding value to the objective.

Leaving access in place after a role change is a mistake that compounds quietly, because the former access looks legitimate in every log.