Student Privacy Laws: How are Students Being Protected?

Nowadays, organizations are powered by data — and the higher education industry is no exception. To enhance their students’ academic experience, it’s necessary for educational institutions to track data about enrollment, admissions, academic scores and degree completion. There are federal and state laws that protect this information, and it’s the responsibility of educational institutions to safeguard their students’ data.

Data collection is rampant in the education industry. And with the development of technologies meant to enhance learning, we see an increase of sensitive data processed. While colleges and universities are at the forefront of this, primary and secondary education institutions are also collecting and using more data than ever before. Federal laws that apply to students’ data privacy include the following.

Family Educational Rights and Privacy Act (FERPA)

FERPA protects student privacy by limiting who can access student records. Anyone who accesses records must specify the purpose for accessing that data. Additionally, specific guidelines must be followed when accessing student records.

Protection of Pupil Rights Amendment (PPRA)

PPRA requires parental approval to administer data-collection tools like surveys, analysis, and evaluations funded by the US Department of Education to students.

Children’s Online Privacy Protection Rule (COPPA)

Operators of websites, mobile apps, smart toys and other online services must follow COPPA rules regarding the collection, use and disclosure of personal information of children under the age of 13. This includes posting a clear and comprehensive online privacy policy, obtaining verifiable parental consent, providing parents access to their child’s personal information, and maintaining the confidentiality and privacy of the information collected from children.

California Consumer Privacy Act (CCPA)

This CCPA impacts how for-profit organizations handle private information. Non-profit educational institutions may be exempt, but their vendors and third-party service providers may not be.

A good example is the Pearson hack that occurred in 2019. Pearson, a company that creates educational software, experienced a data breach that affected more than 13,000 school and university accounts — some accounts with thousands of students each. Educational software, learning management systems, and other similar tools will likely process private student information on behalf of your institution. If they are not compliant or experience a data breach, you may share some responsibility. It’s important to thoroughly vet the vendors you work with and ensure that they are actively protecting your students’ data.

Health Insurance Portability and Accountability Act (HIPAA)

HIPAA protects individually identifiable health information, which includes information relating to the individual’s physical or mental health, medical conditions and demographic data. This private information should only be disclosed to the individual, an individual’s personal representatives or to the U.S. Department of Health and Human Services for compliance investigations or reviews.

Most institutions have collected some form of their students’ medical data, such as allergy information. On-campus health clinics also collect private student information protected under HIPAA.

Payment Card Industry Data Security Standard (PCI DSS)

PCI DSS is a set of security standards that require any organization that accepts, processes, stores or transmits credit card information and cardholder data to maintain a secure environment. This applies to all organizations regardless of size.

College and university campuses need to ensure that their payment processing systems and databases properly protect this information. Many payments by students are made at their campus’ financial aid office or admissions office.

Whether it’s for admissions, enrollment or educational technologies, colleges and universities collect a tremendous amount of students’ data. Below are examples of the types of sensitive data collected from students that need to be safeguarded.

• Academic records
• Student ID number
• Social security number
• Billing information
• Credit card information
• Medical records
• Mailing address
• Driver’s license
• Birthday
• Student’s name
• Name of the student’s parents or family members
• Address of the student or student’s family

In order for educational institutions to offer better academic experiences for their students, collecting data is inevitable. When collected properly, an institution can see great success and growth. Although there are a lot of laws and regulations your institution needs to be aware, compliance doesn’t have to be an exhaustive endeavor if you have an organized strategy and the right tools to help aid your security teams. Below are several steps an institution can take to protect student data and ensure legal compliance.

1. Understand the data you’re dealing with

Many organizations believe that they know what types of data they are collecting, where that data lives and who has access to it. But, as organizations create and process greater quantities of hard-to-find unstructured data, the reality is that it’s easy for pieces, or even troves, of data to remain out of sight and vulnerable to a breach. Sensitive data discovery tools can help organizations locate all types of sensitive data across their entire digital landscape. While robust data privacy management tools will be able to find both structured and unstructured data, whether it’s stored on-premise or in a cloud-based platform.

Sensitive data discovery gives your organization a full view of your sensitive data footprint and enables you to assess what actions need to be taken. Do you have large amounts or varieties of sensitive data that need to be secured immediately? Are you collecting data that would benefit from automated workflows and processes to make compliance easier for your teams? Moving forward with efficient, effective data security begins with understanding the data your team is dealing with.

2. Know who has access to sensitive student data.

Authorized disclosure of sensitive data is critical for adhering to data privacy laws. When you have many members and departments within your organization, it’s important to create accurate and updated access rights. By classifying your data, your organization’s security team can work more efficiently by seeing the following information at a glance:

• Each piece of data’s associated values and risks
• Which pieces of data are subject to compliance regulations
• Who is allowed to access and use the data at question

Manually, this is a time-consuming task and with lots of hands touching this data, the chance for human error increases. Automated data classification can make this task easier. By taking the risks of human intervention out of the equation, your organization can save tremendous amounts of time on your data classification efforts while ensuring accurate results.

Additionally, to stay compliant with laws like GDPR and CCPA, educational institutions and organizations should be able to provide authorized individuals with visibility into how their data is being used and stored in a timely manner. Automated workflows for these requests can cut down on the hours spent trying to manually locate data, and eliminates the possibility of human error.

3. Stay current with the latest data privacy laws

Data privacy laws are ever-changing, especially with more consumers becoming savvy about how much of their personal data is collected by organizations. It’s advised that all organizations be privacy-forward to prepare for changes in federal and state laws that protect users’ privacy rights. In the past few years alone, the CCPA and NYSHIELD Act have been passed to empower people with greater privacy rights.

Education institutions that process large volumes of personal data need to stay up-to-date on the latest privacy laws and the technologies that can help aid their teams in remaining compliant. Data privacy tools with the ability to locate complex, unstructured data, monitor data in real-time, and provide insights to help you understand your data, can turn this heavy-lift into an efficient process.

Spirion empowers higher education institutions with full data visibility. This allows you to create a strong data security strategy, monitor progress and react quickly without burdening your security team. The Sensitive Data Platform accurately discovers structured and unstructured sensitive data across campuses, helps you comply with subject rights requests, and helps you monitor, connect and understand your data.