This Is Going on Your Permanent Record: A Legal Analysis of Educational Data in the Cloud

Moving operations to the cloud has become a way of life for many educational institutions. Much of the information these institutions store in the cloud is protected by the Family Educational Rights and Privacy Act (FERPA), which was last amended in 2002, well before cloud computing became ubiquitous. The application of a 1974 law to 21st-century technology presents a plethora of legal and technical questions. In this article, we present an interdisciplinary analysis of these issues. We examine both existing statutes and case law and contemporary research into cloud security, focusing on the impact of the latter on the former. We find that FERPA excludes information that students and faculty often believe is protected and that lower-court decisions have created further ambiguity. We additionally find that given current technology, the statute is no longer sufficient to protect student data, and we present recommendations for revisions.