Different scenarios were given where the audience was asked to respond if FERPA had been violated. The first scenario covered vendor contracts. On this subject Rooker was again quoted: “At a minimum, vendor contracts should include terms relating to the ownership of the data being stored, the status of deleted information, how data will be protected, and limitations of the use of data.”

The second scenario covered lecture capture videos; the third covered free online resources; and the fourth and final scenario was a professor wanting to combine two sections of the same class in the LMS. In all four scenarios the answer to whether FERPA would be violated was “it depends”. The last scenario on combining classes led to a very robust discussion between the audience and the presenters.

The session ended with a list of best practices, including:

• Maintaining awareness of other relevant federal, state, tribal, or local laws

• Being aware of all online educational services being used at your institution

• Having policies and procedures to evaluate and approve proposed educational services

• Using a written contract or legal agreement whenever possible

• Taking extra precautions when consumer applications require the acceptance of terms of service

• Being transparent

• Determining whether consent is necessary

The session concluded with a quote from Senator Ron Wyden (D-Oregon), “Your data is yours, no matter on whose server it lives.” It is up to us to be diligent in protecting the data in all digital formats while complying with FERPA as well as international laws when students reside outside of the United States.