Whose Data? Which Rights? Whose Power? A Policy Discourse Analysis of Student Privacy Policy Documents

ABSTRACT

The proliferation of information technology tools in higher education has resulted in an explosion of data about students and their contexts. Yet, current policies governing these data are limited in their usefulness for informing students, instructors, and administrators of their rights and responsibilities related to data use because they are based on antiquated conceptions of data and data systems. To understand how data privacy policies conceptualize and represent data, privacy, student agency, and institutional power, we conducted a policy discourse analysis of 151 university policy statements related to student information privacy and the responsible use of student data from 78 public and private post-secondary institutions in the U.S. Three common discourses emerged: educational records are static artifacts, privacy solutions are predicated upon institutional responsibility and student agency, and legitimate educational interest in data are institutionally defined and broadly applied. We explore the assumptions, biases, silences, and consequences of these discourses and offer counter- discourses to begin a foundation for the development of privacy policies in a new data age.

KEYWORDS:

• Learning analytics
• student data
• student privacy policy
• FERPA
• GDPR

Disclosure statement

No potential conflict of interest was reported by the authors.

Notes

1. Arizona State University belongs to the small group of institutions that employed Chief Information Security officers or Chief Privacy Officers. These institutions tended to have policies that offered more diverse representations of data privacy, student privacy rights, and clearer policies for how students can manage their data concerns. Institutions like Stanford and University of California, Los Angeles, who both employed Privacy Officers, made a distinction between data, educational records, and students’ privacy rights concerning both. Educational records, per FERPA, were part of the larger data governance process but were subject to distinct (and more stringent) forms of scrutiny in the approval request process than other forms of data.