Student Privacy Protections for Virtual Learning

Rising COVID-19 case numbers have caused many Michigan schools to return to remote learning and vir­tual instruction. Although virtual instruction differs from face-to-face instruction, FERPA and Michigan’s student privacy laws still require schools to protect a student’s personally identifiable information.

Using a videoconferencing platform (e.g., Zoom, Google Hangouts, Microsoft Teams) for virtual instruc­tion does not, by itself, violate FERPA. School officials should, however, be cognizant of what user information is saved by the videoconferencing platform and whether that information is provided to third parties.

FERPA does not prohibit a teacher from recording a lesson and posting it for students to view or from live streaming in-person instruction to a hybrid class of in-person and virtual students. In March 2020, the U.S. De­partment of Education’s Student Privacy Policy Office (SPPO) stated that if a video recording omits student personally identifiable information or the school re­ceives the applicable parent consents, “FERPA [will] not prohibit the teacher from making a recording of the les­son available to students enrolled in the class.” Thus, a recording of only a teacher providing instruction would not constitute an education record under FERPA and could be disclosed to students in the class.

Additionally, if a school’s board policy definition of “directory information” includes a student’s name and photographs or videos of students participating in school activities, an image of a student sitting in a classroom would likely be directory information that can be released without parent consent assuming the school has not received an annual directory information opt-out form for those students.

If there is an incident (e.g., medical issue, outburst or fight that could subject student to discipline) involv­ing a student during virtual instruction, whether live streamed or recorded, a recording of the incident may become an education record that cannot be disclosed without parent consent. For example, if a student’s ver­bal threat to a classmate is captured on video and rec­orded by the school, that recording is an education record for the students directly involved. Students viewing the threat in real-time on a live-stream would not be a FERPA violation, but school officials could not post any recording of the threat after the fact without appropriate parent consent.

School officials should take precautions to reduce the likelihood of inadvertent disclosure of student per­sonally identifiable information. When possible, a video feed should focus on the teacher providing instruction, rather than the students. School officials should also limit access to a live stream or recording by requiring login information or limiting the time a recording is available online.

Further, if a student incident occurs or student personally identifiable information is otherwise dis­closed (i.e., a private teacher-student conversation about grades or misconduct is picked up on a video or audio feed), school officials should remove the FERPA-protected information from the recording before post­ing it for instructional use. If a teacher has concerns about student personally identifiable information that was disclosed during a live-stream or recording, they should communicate with school officials about next steps, such as how to edit a recording before posting.

Posting or reading disclaimer and notice language at the beginning of each virtual lesson may also help cir­cumvent complaints. This language should inform viewers how to set up a virtual background, mute the audio, or turn off the camera function. The language should also specify that the live stream or recording will only be used for educational purposes by students in that class.

Revised School Code Section 1137 authorizes parents to observe instructional activity in a class or course in which their student is enrolled and present, subject to reasonable restrictions. Schools can place reasonable restrictions on this right. Under FERPA, the SPPO recognizes this right, stating that “the determination of who can observe a virtual classroom, similar to an in-person classroom, is a local school de­cision as teachers generally do not disclose personally identifiable information from a student’s education rec­ord during classroom instruction.” We recommend that teachers carefully monitor e-mail and other classroom group lists for uninvited or inappropriate participants in a virtual classroom session.

While student privacy must be protected, with careful planning and foresight, those protections should not prevent schools from providing virtual in­struction. As school officials navigate virtual learning, they may contact their Thrun attorney to obtain tem­plate disclaimer and notice language to be used before a live streamed or recorded classroom session.