Re: FERPA Notice of Proposed Rulemaking Addresses Changes in IT

["Basgen, Brian" <bbasgen () PIMA EDU>]

Chuck,

> For example, I'd suggest that the proposed regulation say 
> that if the student identifier is used in any manner to 
> authenticate access without some additional companion 
> authentication mechanism known only to the student like a PIN 
> or password, it cannot be included as directory information.

 Keep in mind that they do address "student identifiers" in exactly this
manner. Kevin has found that the issue is their particular exclusion of
"student IDs". It is one of those semantic things that, as you've
pointed out, has quite a bit of meaning. 

 My guess is that this regulation is picking up on a practice within
institutions, like us, which have made student IDs non-directory as a
method for dissuading faculty from posting student IDs with grades. I
also think they are using this "5%" grade posting practice with student
IDs as a "proof" that student IDs are, as a matter of practice, PII.

 What troubles me the most about this part of the regulation is where
they talk about "no data" on more than one occasion, and yet make
assumptions anyway. While I like their overall direction and don't want
that to get lost in a critique, I also think these regs would serve us
far better if they were based on concrete data. If it is true that there
is a widespread *practice* of using Student IDs as a form of PII, then I
think a reg makes sense. If it is the exception and not the rule, then I
think they are using the wrong method to address the problem of
identifiers and authenticators. 

~~~~~~~~~~~~~~~~~~
Brian Basgen
Information Security
Pima Community College