Privacy Considerations for Virtual Learning
Privacy laws and regulations such as FERPA, still apply in virtual learning environments. This document has been put together to help set up online courses to adhere to these requirements.
FERPA is the federal law that protects the privacy of personally identifiable information (PII) in students’ education records. “Education records” are those records that are: (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. FERPA provides parents and eligible students the right to access a student’s education records, the right to seek to have the records amended, and the right to protect the PII in students’ education records. (An “eligible student” is a student who has turned 18 or is attending college at any age.) Under FERPA, Mines may not disclose PII from students’ education records, without consent, unless the disclosure meets an exception under our FERPA policy.
Common examples of disclosures of student’s personally identifiable information that would violate FERPA:
- Releasing grades for other students to see;
- Allowing access to Canvas courses to those not deemed a ‘school official’ (volunteers or non-Mines affiliates);
- Spouses overhearing a student’s information while working remotely; or
- Using unapproved/unsupported software that hasn’t been vetted for privacy and security.
Disclosure requirements also apply to any personally identifiable student information that has been taken home while working remotely. Student information should be kept securely and not disclosed to non-Mines individuals.
Reminder: Email is not a secure method for communicating sensitive information.
A. With the exception of lectures, avoid video or audio recording unless absolutely necessary. Recordings should never be saved on personal devices (e., non-university-issued). Zoom has the capability to disallow recordings by anyone who is not the host (Settings → Recordings → Local Recording).
B. If you will be recording, individuals will automatically be given notice through Zoom before recording begins. Be aware not all participants may be running the latest version of Zoom that implements this feature. Students should be informed that when cheating is suspected, the recording may become part of an administrative disciplinary record. Recordings should be retained no longer than necessary. Below is sample notification language that can be used by instructors in their course and/or added to their syllabus:
“This class is being conducted over Zoom. As the host, I will be recording this session. The recording feature for others is disabled so that no one else will be able to record this session through Zoom. No recording by other means is permitted. If you have privacy concerns and do not wish to appear in the recording, do not turn on your video. If you also prefer to use a pseudonym instead of your name, please let me know what name you will be using so that I know who you are during the session. If you would like to ask a question, you may do so privately through the Zoom chat by addressing your chat question to me only (and not to “everyone”), or you may contact me by another private method. If you have questions or concerns about this, please contact me. Pursuant to the terms of the agreement between the vendor and Mines, the data is used solely for this purpose and the vendor is prohibited from redisclosing this information. Mines also does not use the data for any other purpose. Recordings will be deleted when no longer necessary. However, the recording may become part of an administrative disciplinary record if misconduct occurs during a videoconference.”
C. Recordings should only be stored on university-approved services (g., Zoom cloud, Canvas, OneDrive, shared drive, MS Streams for pre-recorded lectures, not in one’s personal accounts).
D. Individuals can use Zoom’s virtual background feature if they do not want to have their surroundings visible. Be mindful of others who may not wish to be visible or recorded in the background. (See note below as to how this applies to proctoring.) Contact the ITS Helpdesk for assistance, if needed.
E. “Zoombombing” is the practice of uninvited individuals entering a video call, often to voice hateful and racist views. Professors utilizing Zoom should monitor participants on teleconference calls to reduce the chance of unauthorized persons on the calls. Consider using a unique meeting ID for each gathering or class or requiring authentication and a passcode for participants (Settings → Profile → Personal Meeting ID; Meetings → Authenticate, Password). You may also uncheck the “join before host” option. See the “Best Practices for Securing your Virtual Classroom” webpage for more information.
ONLINE CLASS AND CONTENT DELIVERY
Online class and content delivery, in addition to videoconferencing guidance above:
A. Instructors (and staff should) use the platform(s) selected and approved by the University. Platforms that have not been vetted by the university should not be used.
B. Instructors are encouraged to provide other means of participation for students who do not want to be recorded (e.g., submitting questions and comments online through the learning management system or via email to the instructor).
C. Instructors should not require students who have placed a FERPA block on their directory information to use their name or their camera during online classes. Posting a lecture to public platforms, like YouTube, that identifies a student who has a block on their directory information would be a violation of the student’s FERPA rights.
D. Instructors or Teaching Assistants should never ask for Confidential and Secure Information (e.g., date of birth, social security number) through the platforms above.
ONLINE EXAMS AND PROCTORING
Online exams and proctoring, in addition to videoconferencing guidance above:
A. When not using proctoring software (preferred for exams and quizzes):
1. Requiring students to turn on their camera to be watched or recorded at home during an exam poses significant privacy concerns and should not be undertaken lightly. Instructors are encouraged to work with the Trefny Center to discuss privacy-protective alternatives (e.g., how to use question banks in Canvas) that will uphold integrity and good assessment design.
2. During classes, students should be encouraged to use the virtual background feature of Zoom if they do not want their surroundings to be visible. However, it’s important to ensure that students are completing their exams independently and without assistance so students are encouraged to take their exam in a room that has no one else present.
B. When using proctoring software (for high-stake exams, as determined by the instructor):
1. Proctoring services use machine learning, AI, eye-tracking, key-logging, and other technologies to detect potential cheating. If instructors are using one of these services, they must provide explicit notice to the students before the exam. Below is sample notification language:
“Proctorio, an online proctoring tool, will be used during this course. Proctorio offers you flexibility to take your exams at the time and in the location of your choosing. Students are required to have a webcam (USB or internal) with a microphone and a stable internet connection. During the course of an exam, Proctorio will record the testing environment, therefore students should select private spaces for the exam session where disruptions are unlikely and where recording devices can be enabled. Instructions for Proctorio use will be provided. To use Proctorio you must be over 18 years of age. If you have concerns about using an online proctoring tool for the reasons listed above or in general, please work with your instructor to find an equivalent alternative.”
2. Instructors are encouraged to consider other options that are privacy-protective and still preserve academic integrity, where possible (as discussed in section A.1. above).
ONLINE ADVISING & TUTORING
Online advising & tutoring
A. Online advising and tutoring can occur via chat, audio, or videoconferencing but should be done using services approved by the university (e.g., email, Zoom, TutorOcean) or by phone. Sessions should not be recorded; rather, the advisor should log notes as they do now. The advisor should always be logged in on campus or through a VPN when advising.
B. Advisors should not hold advising sessions in public spaces or where sessions can be overheard by others (e.g., spouses or roommates also working from home).
C. Take extra time to verify the identities of students. Verify and double-check identities, email addresses, or phone numbers prior to the discussion.