In her blog “Law, Policy and IT” Tracy Mitrano expressed a concern: protecting student privacy as colleges and universities outsource information processing with external servicers. To ensure education records are protected, she writes, outsourcing contracts must explicitly detail the protection to be provided student data. She suggested contract provisions should require an entity comply with federal law including the Federal Education Rights Privacy Act. FERPA is one of the United States’ earliest public privacy laws enacted more than thirty years ago. She said “the Department of Education has already made clear that outsourcing these records does not alleviate the institution of its obligations under this law.” Her recommendation would build a “chain of responsibility” for the privacy and security of student education records. She observes these records have become “an important and permanent marker of an individual in a competitive society currently plagued by high unemployment rates even among college and professional school graduates in an era where corporations and firms routinely amass information from a variety of sources in the course of hiring.”
Student data have been disclosed and sold without permission by external vendors. One example is described in the court records of CollegeNet Inc. v XAP Corporation, U.S. District Court for the District of Oregon.