| Category | Examples |
| Enrollment Data | Course registrations, enrollment status, program of study, academic level |
| Academic Performance | Grades, assignment submissions, quiz/exam scores, participation records, discussion board posts |
| Learning Analytics | Login frequency, time spent on course materials, page views, video watch time, quiz attempts |
| Communication Records | Email correspondence, messages within LMS, video conference recordings, chat logs |
| Authentication Data | User credentials, login times, IP addresses, device information |
| Financial Information | Tuition payments, financial aid status, account balances |
## Table 1: Categories of student data collected in online learning environments
Student information is collected only for legitimate educational purposes, including:
• Facilitating instruction and course delivery
• Assessing student learning and academic progress
Providing academic advising and student support services
• Verifying student identity and preventing academic dishonesty
===== PAGE 14 =====
• Improving instructional design and course effectiveness
• Fulfilling institutional reporting and accreditation requirements
• Conducting educational research (with appropriate approvals)
• Ensuring compliance with federal and state regulations
The University adheres to data minimization principles by collecting only the information necessary and relevant for specific educational purposes. Unnecessary data is not collected, and information is retained only as long as required by institutional policy or legal mandate.
## Disclosure of Student Information:
FERPA permits disclosure of education records without student consent in the following circumstances:
1. School Officials with Legitimate Educational Interest: Faculty and staff who need access to perform their institutional responsibilities
2. Other Schools: To institutions where the student seeks to enroll or is enrolled
3. Authorized Representatives: For audit or evaluation purposes related to federal or state educational programs
4. Financial Aid Determinations: In connection with student applications for financial assistance
5. Accrediting Organizations: To carry out accreditation functions
6. Compliance with Judicial Orders: In response to lawfully issued subpoenas or court orders
7. Health and Safety Emergencies: To protect the health or safety of students or others
8. State and Local Authorities: Within the juvenile justice system, pursuant to specific state laws
All other disclosures of personally identifiable information require written consent from the student,
specifying:
• The records to be disclosed
The purpose of the disclosure
The party or class of parties to whom disclosure may be made
• The student's signature and date
The University's Registrar Office maintains records of all disclosures of personally identifiable information (except disclosures to school officials and directory information), including the date, parties to whom disclosed, and legitimate interest for disclosure.
## Data Breach Response:
A data breach is any unauthorized access, acquisition, use, or disclosure of student education records or personally identifiable information that compromises the security, confidentiality, or integrity of those records or information.
In the event of a suspected or confirmed data breach:
1. Immediate Containment: Affected systems are isolated to prevent further compromise
2. Investigation: IT Security conducts forensic analysis to determine scope and cause
3. Notification to Leadership: Privacy Officer and senior administration are immediately informed
===== PAGE 15 =====
4. Legal Review: General Counsel assesses legal obligations and liability
5. Student Notification: Affected students are notified within 48 hours when possible, including:
• Description of the breach and information compromised
Steps the University is taking to address the incident
• Protective measures students can take
• Contact information for questions and support
6. Regulatory Reporting: Breach reported to appropriate agencies as required by law
7. Remediation: Security vulnerabilities are addressed and systems are hardened
8. Documentation: Comprehensive incident report prepared for review
9. Post-Incident Review: Lessons learned and policy updates implemented
Third-party service providers must notify the University within 24 hours of discovering any breach involving student data. The vendor's incident response obligations are specified in service agreements.
## Complaints
Students, faculty, or staff who believe a privacy violation has occurred should report concerns to the Office of the Registrar.
All complaints are investigated promptly and confidentially:
1. Complaint is received and documented
2. Preliminary review determines if a policy violation occurred
3. Investigation conducted with interviews and evidence gathering
4. Findings documented and reported to the complainant and the relevant parties
5. Corrective action taken if the violation confirmed
6. Follow-up ensures resolution and prevents recurrence
Violations of this policy may result in disciplinary action:
Students: Academic integrity violations, suspension, or expulsion under the Student Code of Conduct
• Faculty and Staff: Counseling, training, suspension, or termination under employment policies
• Vendors: Contract termination and legal remedies
## REFERENCES AND RELATED MATERIALS:
CONTACTS:
Office of Online Education
HISTORY: