Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I have a college professor who publishes a gradebook where I can find my grade simply by looking up my student ID #, which I do not believe I can change. Until recently, I was able to look at the attendance sheet and correlate student IDs with legal names. However - upon my polite asking - the professor removed the student IDs from the attendance roll. While I appreciate her reaction to my note, I do not believe this is enough.
Am I right?
Yes and no, mostly yes. The university stands between the federal government and the professor: the federal government requires things of institutions, which in turn establishes policies that implement those government rules. The statutory link is a restriction on federal funding to violator institutions, via 20 USC 1232g. This is fleshed out in 34 CFR 99, and starting with §99.30, there is extensive regulation of disclosing information. A university will (or should) then articulate privacy policies that say what employees may and may not do. Typically, universities impose ludicrous restrictions in order to cover their back pockets. (Following the letter of the rules, my university requires professors who communicate on academic matters with students, using email, that they do so on campus, using campus computers, sending to and from official university email addresses, and the email is to be encrypted – AFAIK this requirement is never obeyed).
It is not inconceivable that some university has a privacy policy that fails to expressly forbid posting information about the student. (It is even possible that there has been a legal development whereby such behavior is now allowed). It can be difficult to determine what those internal policies are, i.e. they may be buried in a big pile with other information, it may be called something else like "institutional data policy"; the online version of the policy is often not findable due to dead links. Typically, the Registrar can provide the desired information.
