Dear FERPA Professor,
Our school is currently implementing Office 365 and one of our IT colleagues has recently asked the office of the registrar the following questions.
“We are currently trying to assess how FERPA and due diligence relate to the current Office 365 project. One of the pieces that we have as part of this allows users to sync their desktop files to the Office 365 cloud. In turn, users would have the ability to sync these files to their home computers, where the college loses control of access to the computer on which these files reside. We have the ability to prevent users from synchronizing to home computers, while maintaining web access and tablet/phone access. Enabling this option would also effectively cut users off from their files after leaving college employment. Does FERPA and due diligence require us to prevent users from syncing the data to home computers and cut off access to existing files post-employment if we have the means to do so?”
Before we answer them, we wanted to see what FERPA had to say about storing information in a cloud based system that allowed user to sync to personal computers.
Sincerely,
Isabelle Ringing
_________________________________
Isabelle,
Institutions are responsible for the protection of student education records. This responsibility does not end when an employee leaves the institution, and from a best practice standpoint, the institution should include language on the ownership of student records in any contract employees sign.
Keeping this responsibility in mind, it is clearly a much greater FERPA liability for an institution to give up control of student records for which it is responsible, by allowing them to be loaded or stored on an employee's home computer where the institution has no control over the use or disclosure of those records. Remember too that the institution is responsible for ensuring that any use or disclosure of student records is done in compliance with the "legitimate educational interest" requirement in §99.31(a)(1).
The bottom line is that an institution does not want to have a practice in which it systemically gives up control of the education records it is responsible to protect.
I hope this is helpful as you evaluate your processes,
The FERPA Professor
Please visit our Ask the FERPA Professor archives for more insight from the professor.
In addition, check out the FERPA offerings at this year's AACRAO Annual Meeting, March 20-23 in Phoenix, Arizona. AACRAO Senior Fellow LeRoy Rooker will be presenting
Registrar 101 & FERPA (Part I)
FERPA: the Overview
FERPA: the Update
Applying FERPA in Real-life Situations
FERPA and Admissions Records Requests: The View from the Registrar's Desk
To register and for more information, visit the AACRAO Annual Meeting page.
Please send your questions for the FERPA Professor to connect@aacrao.org.