What is privacy? What is security? How do you establish the difference between the two? Popular conceptions of these terms may shift due to a variety of factors. The people who create and sell technologies have a vested interest in shifting our conceptions of privacy. In response to these corporate interests, the public interest of the European Union in data protection has created the General Data Protection Regulation. You may have noticed its effect in 2018, which includes the right to be forgotten.
Educators who teach in the real world need to always consider the privacy and security of their students and themselves.
Despite events such as Equifax, the United States has no single, comprehensive federal (national) law regulating the collection and use of personal data. Amid the patchwork of laws is the Family Educational Rights and Privacy Act (FERPA), which has a direct impact on The University of Alabama. The consequences for violating this federal law are severe.
Our University Registrar provides information and relevant policies on FERPA. The FERPA fact sheet includes this important counsel to UA employees:
- Access to student information via Banner or other computer software does not authorize unrestricted use of that information.
- Curiosity is not a valid reason to view student information.
- Parenthood is not a valid reason to view student information on one’s son or daughter (Parents are third parties).
- Records should only be used in the context of official business.
Basic FERPA Compliance
What are some best practices to comply with FERPA? It is actually quite easy:
- Don’t distribute grades in any way that other students can view them. Not even if students are only identified by CWID (or worse again SSN).
- Do use Blackboard to post grades and return work individually to students.
Essential FERPA Considerations
Carefully consider whether you should connect with students through social media. If your department uses social media, then adopt and stay within the scope of your department’s social media strategy.
Consult with the Faculty Technology Liaison or the Faculty Resource Center prior to deploying third-party platforms in your class.
Read the University’s World Wide Web policy. Section 3.0 very likely applies to social media and third-party platforms.
Closely read all the policies related to these platforms. They will have an impact on how companies use the data streams of you and your students:
- Terms of Service
- Terms of Use
- Acceptable Use
The U.S. Department of Education has something to say about social media and third-party platforms and best practices. As Ian O’Byrne writes, knowing how to read and consider these policies ought to be a given in today’s world. Educators should consider teaching these skills to their students, too. It’s actually quite easy.
Exceptions to FERPA
Exceptions to FERPA include students from Early College and Student-Athletes. Before you share any records with a third party (e.g., parents, social media, etc.), check to see if the student has submitted a FERPA Release & Attribute Information form. Here are the steps to do so:
- Login to myBama.
- Click the Faculty option.
- Find the Banner Self-Service box, click on Faculty & Advisors.
- Click on Student Information Menu.
- From the drop-down menu, choose the Student Information.
- Select the current/appropriate.
- Provide the student’s CWID &/or name information. When the correct student info pops up, click Submit.
- Under General Student Information for (Name of Student), scroll down to FERPA Release & Attribute Information. Look for the status of the student’s Record Release Form. If a blank space/no text is featured, then there is no form on file for the student. If there is text information, this indicates that the student has submitted a form & dictates with whom we may share the student’s personal, academic information.
Example Scenarios
Parent: I am Jim’s mother and I pay his tuition, so I have a right to know whether Jim has been attending class.
If you have to check attendance records to see if Jim has been absent, then you are NOT allowed to share this info. If you can remember that you haven’t seen Jim in a while, then you are allowed to tell the parent.
Parent: I am Jessica’s dad, and I want to know how she is doing in your course.
No. Jessica’s grades are Jessica’s business and not anyone else’s. Try to be nice when you tell the parent this. You might want to come up with a canned response to this type of inquiry, letting the inquirer know about FERPA restrictions on sharing student information and that you would be glad to discuss the issue with the student if s/he would like to set an appointment.
Athletic Academic Advisor: I have sent you a UA webmail email asking to share a student’s academic performance records.
Yes. You may share academic performance records requested with their Athletic Academic Advisor since athletes sign away their right to academic privacy when they sign with the athletic department. It’s not a free-for-all on information, but we are encouraged to share information on their performance with the Athletic Academic Advisors.
This resource is part of the Teaching Basics series. For more information, contact Nathan Loewen at nrloewen@ua.edu.