This post first appeared on aud.life

A response to a Jim Groom blog post here.

I think you nailed it when you say that what counts as an "education record" and therefore protected by FERPA is really unclear. Here's the Department of Education's completely unhelpful definition:  "The term 'education records' is defined as those records that contain information directly related to a student and which are maintained by an educational agency or institution or by a party acting for the agency or institution." I think we recognize that this includes transcripts, grades, and so on. But does an education record include metadata about how frequently a student uses a piece of software? Does it include their IP address?

Schools and their vendors are allowed to collect and share data if it has an "educational purpose" but WTF is that? With our current obsession with educational data, I can see people arguing that every click a student makes on a computer has an "educational purpose."

FERPA purportedly prevents the disclosure of personally identifiable information without consent. Clicking "I agree" to the Terms of Service does count as consent, and I highly doubt students (or their professors) read what they've agreed to. Companies can also claim that the data they're collecting is not personally identifiable. Again, these definitions -- and how they're full of weasel words -- matter.