Acquiring Student Data: University Strategies And Privacy Concerns

Universities acquire student data in a variety of ways, including through applications, registrations, and interactions with IT systems and services. This data can include personal information such as name, address, and date of birth, as well as academic activities such as course information, grades, and submissions. Universities have a responsibility to manage and protect this data appropriately, including complying with laws and regulations, and considering privacy and consent. The data is used for various purposes, including teaching and learning, reporting, analytics, and personalisation of content and outreach. Additionally, universities may purchase student data from organisations such as the College Board and ACT, or use software to track prospective students' digital footprints and interactions with their websites.

Student data privacy

Universities collect and process large amounts of student data, including social security numbers, credit card information, health and financial records, and personal details such as names, addresses, and dates of birth. With the shift to digital processes and online learning, universities are challenged to deliver top-notch experiences and safeguard student data effectively.

Data Privacy Concerns

Data breaches and cyberattacks are increasing, and student data is a prime target. Universities must therefore adopt robust security measures and strict privacy policies to protect their students' data and maintain trust.

Strategies for Protecting Student Data

• Data Minimization: Collect and retain only the necessary information, and dispose of unnecessary data to mitigate privacy risks.
• Informed Consent: Offer transparent information about data use, access, and collection purposes, empowering students to make informed decisions about data sharing.
• Strict Controls: Implement limits on who can access sensitive information, especially health and financial records, with clear procedures for handling data requests.
• Secure Data Storage: Modernize core systems and implement robust security measures to protect student data from cyberattacks and unauthorized access.
• Compliance with Privacy Laws: Adhere to regulations such as FERPA, HIPAA, and CCPA to protect student privacy and avoid legal and financial penalties.
• Staff Training: Provide continuous staff training on data privacy and security to ensure responsible data management.
• Vendor Vetting: Thoroughly vet vendors and third-party service providers to ensure they actively protect student data and comply with relevant laws.
• Data Discovery: Understand the types of data collected, its location, and who has access to it. Use sensitive data discovery tools to locate all sensitive data across the university's digital landscape.
• Access Rights Management: Create accurate and updated access rights to ensure only authorized individuals can access sensitive data.
• Stay Informed: Stay up-to-date with the latest data privacy laws and technologies to protect student data effectively.

By implementing these strategies, universities can enhance data security, maintain student trust, and comply with legal requirements, creating a culture of transparency around data collection practices.

Data acquisition guidelines

Universities collect a wide range of student data, including:

• Personal information: name, home address, date of birth, email address, profile picture, preferred name, pronouns, etc.
• Course information: course roster, course name, meeting times, course calendar, level, field of study, etc.
• Student submissions and class activities: discussion posts, assignment submissions, chat messages, conversations with classmates and instructors, etc.
• Interaction with teaching tools: date and time of access to reading materials, videos, and other learning resources.
• Logging information: browser and operating system used, date and time of login, length of session, time of submissions, etc.
• Application information: details provided on application forms, supporting documents, interview records, etc.
• Academic achievements: examination results, assessments, prizes, etc.
• Financial information: fee payments, funder/sponsor details, etc.
• Use of facilities and services: sport, libraries, accommodation, careers services, etc.
• Participation in events: functions, graduation, etc.
• CCTV footage and other security information.

The purpose for which data is being acquired

Universities may use student data for a variety of purposes, including:

• Teaching and learning: facilitating effective and engaging learning experiences by providing useful information to instructors and students on participation and performance.
• Reporting and tools: supporting institutional reporting, curricular design, learning sciences research, and learning tool development.
• Learning analytics: supporting student growth and development, creating personalized learning opportunities, enabling earlier and more effective interventions, providing tailored mentoring and advising, and improving student outcomes.
• Service support: ensuring system stability and a positive user experience by monitoring service performance and providing end-user support.
• Administration: delivering and administering education, recording study details, determining and confirming academic achievements, supporting research activity, administering financial aspects, etc.
• Communication: communicating effectively with students by post, email, and phone, including the distribution of newsletters and circulars.
• Security and governance: operating security systems, governance processes, disciplinary procedures, complaint handling, audit, and quality assurance.
• Equality and diversity: fulfilling responsibilities under equalities legislation and improving diversity.
• Research: conducting surveys and research for internal, statutory reporting, or public or legitimate interest purposes.

How data is acquired

Universities acquire student data through various methods, including:

• Direct collection: data provided by students when completing surveys, quizzes, application forms, or other administrative processes.
• Automated collection: academic web-based applications that generate and store data based on visits and interactions.
• Third-party sources: data purchased from organisations such as the College Board and ACT, or data provided by external examiners, assessors, and government departments.
• Tracking: monitoring prospective students' digital footprints and website usage patterns.

The source of data being acquired

The sources of student data vary and may include:

• Students themselves: data provided directly by students during the application process, registration, surveys, or through their interactions with university systems and services.
• University staff: data collected by instructors, administrators, or other staff members during the course of their duties.
• External organisations: data obtained from government departments, funding bodies, research centres, professional associations, or other external sources.

Privacy considerations

When acquiring student data, universities must comply with legal and regulatory requirements, such as data protection laws and privacy regulations. This includes obtaining consent for data collection, providing notice of data collection, and implementing appropriate security measures to protect personal information. Universities should also minimise the collection of sensitive or personally identifiable information unless absolutely necessary.

Student data sources

Universities collect student data from a variety of sources and for a variety of purposes. The process of data acquisition involves considering the type of data, the purpose for which it is being acquired, how it is acquired, and the source of the data.

One of the primary sources of student data is the information provided by students themselves during the application and admission process. This includes details such as name, home address, date of birth, course of study, fee payments, examination results, and other supporting documents. Universities also collect data related to a student's academic activities, such as course information, student submissions, class activities, interaction with teaching tools, and logging information. This data is used to facilitate effective teaching and learning, support institutional reporting and curricular design, and enable learning analytics to improve student outcomes.

In addition to the data collected directly from students, universities may also acquire data from external sources. For example, universities may purchase data from organizations like the College Board and ACT to identify prospective students and make informed admissions decisions. This data can include demographic information, academic achievements, and student preferences. Universities may also collect data from third-party service providers, such as IT systems and software applications, that support teaching and learning services.

Another source of student data is generated through the use of digital technologies. For instance, universities may track prospective students' digital footprints or analyze their interactions with university websites. This allows universities to understand student behaviour and make calculated decisions about their admissions outreach and marketing strategies.

It is important to note that universities have a responsibility to manage and protect the student data they acquire. This includes complying with legal and ethical obligations, such as obtaining consent, providing notice of data collection, and ensuring the security and privacy of sensitive information.

Data sharing

Types of Data Shared:

Universities collect and share a range of student data, including personal information, academic records, and demographic details. Personal information may include a student's name, email address, profile picture, preferred name, and pronouns. Academic records cover course information, grades, submissions, class activities, interactions with teaching tools, and logging information. Demographic details can encompass age, ethnicity, language spoken, residence, and educational background.

Parties Involved in Data Sharing:

Student data is shared between different departments and colleges within a university. For instance, at the University of Cambridge, data is shared between the university and its 31 colleges for academic, administrative, and statistical purposes. Additionally, student data is shared with external organisations, such as government departments, higher education bodies, funding bodies, research institutions, and professional associations. This sharing of data is done in accordance with legal requirements and data protection protocols.

Purposes of Data Sharing:

Guidelines for Responsible Data Sharing:

Universities have a responsibility to manage and share student data appropriately. This includes collecting only the necessary data required for specific purposes, ensuring data security, and obtaining consent when needed. Universities should also be transparent about how they intend to use student data and provide opportunities for students to opt out of certain data-sharing practices, such as including contact details in online directories.

The protection of student privacy is a critical aspect of data sharing. Universities must comply with legal and regulatory frameworks, such as the General Data Protection Regulation (GDPR), to safeguard student data. This includes obtaining consent for data collection, ensuring data security, and providing individuals with the right to access, correct, or restrict the processing of their personal information. Universities should also be mindful of sharing sensitive or 'special category' data, such as information related to health, ethnicity, or religious beliefs, and implement additional protections for such data.

Data protection

Understanding Data Acquisition

Data acquisition is the process of collecting data, including what data is collected, why, and how. Universities must be mindful of the purpose and necessity of the data they collect. They should only acquire data essential to support their missions and operations, as more data means more risk. For example, personally identifiable information (PII) such as Social Security numbers or driver's license numbers should be avoided unless absolutely necessary.

Legal and Ethical Considerations

Universities must comply with legal and regulatory frameworks that protect student data privacy. In the United States, key laws include the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and the Children's Internet Protection Act (CIPA). FERPA ensures that parents and eligible students have control over educational records, while COPPA safeguards personal information collected online from children under 13. CIPA, on the other hand, focuses on protecting children from inappropriate online content in schools and libraries receiving federal funding.

Implementing Data Protection Measures

To safeguard student data, universities should implement robust data security strategies. This includes understanding the data they collect, knowing who has access to it, and staying current with data privacy laws. Sensitive data discovery tools can help locate all types of sensitive data across their digital systems, while automated data classification can ensure accurate and efficient access rights management.

Transparency and Consent

Universities should be transparent about the data they collect and how it is used. Obtaining consent from students or their parents, depending on the student's age, is crucial. For example, under FERPA, schools usually need written consent from parents or eligible students to share educational records, with certain exceptions. Similarly, COPPA requires websites and apps to notify parents and obtain their consent before gathering personal information from young users.

Student Rights and Access

Students have the right to access, amend, and control the disclosure of their educational records. They can request corrections, deletions, or restrictions on processing. Additionally, students can file complaints with relevant authorities, such as the U.S. Department of Education, if they believe their data privacy rights have been violated.

In summary, universities must prioritize data protection by understanding the data they collect, complying with legal frameworks, implementing robust security measures, obtaining necessary consents, and respecting student rights to access and control their personal information.

Frequently asked questions