Educational Data in the Cloud Legal Implications and Technical Recommendations
Ben Cohen, Ashley Hu, Deisy Patino, Joel Coffman · 2022
Moving operations to the cloud has become a way of life for educational institutions. Much of the information these institutions store in the cloud is protected by the Family Educational Rights and Privacy Act (FERPA), which was last amended in 2002, well before cloud computing became ubiquitous. The application of a 1974 law to 21st-century technology presents a plethora of legal and technical questions. This work presents an interdisciplinary analysis of existing statutes (i.e., FERPA) and case law. We find that FERPA excludes information that students and faculty often believe is protected and that lower-court decisions have created further ambiguity. Given current technology, the statute is no longer sufficient to protect student data, and we offer recommendations based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework to improve educational institutions’ management of protected data.