Student Educational Records Data Privacy and Reporting Policy - NMU Policies and Requirements

Student Educational Records Data Privacy and Reporting Policy

Purpose:

To maintain the appropriate confidentiality of student educational records while enabling the University to perform essential data analysis for institutional research, quality assurance, and mandatory compliance functions. 

Policy: 

The University collects, maintains, and uses student educational data, including personally identifiable information (PII), as necessary to conduct Official University Business and fulfill its educational mission and legal obligations. Official University Business includes activities conducted in support of the University’s educational, administrative, operational, accreditation, compliance, assessment, student support, and institutional research functions. 

Access to student personal data must always be supported by a legitimate business purpose connected to an employee’s or authorized user’s official duties. Authorized access does not permit the viewing, use, or disclosure of students' private or confidential information for personal interest, curiosity, convenience, or any other non-business or unauthorized purpose.  

To further protect student privacy, the University maintains a clear separation between access to raw data systems and the sharing, publication, or reporting of data. For all student education records classified as private or confidential under NMU’s Data Classification Policy, the following access and reporting standards apply:

• Internal Data Handling: Access to individual-level student data is limited to authorized departments and personnel whose assigned job responsibilities require such access to perform official University functions. 
• Aggregated Disclosure to External Parties: Information that the University shares with external parties must be presented only in aggregated or de-identified form to reduce the risk that individual students could be directly or indirectly identified through the information presented, except where disclosure is governed by a University contract with an external vendor that includes legally required and University-approved protections for student data privacy and confidentiality. 
• Aggregated Disclosure for Official University Business: Data shared in report form for Official University Business must be presented in aggregated or summary form to reduce the risk that individual students could be directly or indirectly identified through the information presented. In cases where data may nevertheless allow for the identification of individuals, whether directly or through inference, access to and use of such information is limited to authorized personnel with a legitimate University business purpose and within the scope of their assigned job responsibilities.
• Non-Identification Requirement:  Shared data sets for any purpose other than Official University Business or within contractual protections must be structured to prevent any individual student from being directly or indirectly identified. 

Any research or survey activity that falls outside Official University Business must be reviewed and approved by the appropriate institutional review bodies, including, when applicable, the NMU Institutional Review Board, to ensure compliance with ethical and legal standards for data use and protection. 

References

Acceptable Use Policy
Account Data Retention Policy
Artificial Intelligence and University Data Policy
Family Educational Rights and Privacy Act Policy
Data Classification Policy
NMU Confidentiality Policy
Social Security Number Privacy Policy
Student Financial Data Security Policy
Vendor Privacy Policy
University ID Policy