• U.S. Department of Education (FERPA enforcement) 

• Federal Trade Commission (COPPA compliance)

State (i.e. California) 

• California Department of Education (CalOPPA enforcement) 

• California Attorney General (Data breach investigations) 

These agencies ensure student privacy compliance through regulatory frameworks and the enforcement of accountability.

• Schools must balance data collection with constitutional protections. 

• Privacy laws govern the retention, sharing, and monitoring of student data.

Federal Constitutional Law:

Fourth Amendment: Protects against unreasonable searches/seizures, relevant to data access. 

Link:

https://constitution.congress.gov/browse/essay/amdt4-3-7/ALDE_00000781/

State Constitutional Law (California): 
Article I, Section 1: Grants inalienable right to privacy.

Link:

https://www.aclunc.org/campaign/california-constitutional-right-privacy 

Statutory Law: 
FERPA (20 U.S.C. § 1232g) - FERPA: Requires schools to protect student records and notify parents or guardians of their rights. 

Link:

https://studentprivacy.ed.gov/ferpa
 

Administrative Law: 

COPPA (15 U.S.C. §§ 6501–6506) - COPPA: Requires parental consent for collecting information from children under 13.

Link:

https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa

• Ruled that peer grading does not violate FERPA. 

• Reinforced the definition of “educational records.” 

Highlights how courts interpret privacy rights in educational settings.

Example:

Owasso Independent School Dist. No. I-011 v. Falvo, 534 U.S. 426 (2002)
Link:

https://supreme.justia.com/cases/federal/us/534/426/

Link:

https://www.ecfr.gov/current/title-34/subtitle-A/part-99?toc=1

Key Points: 

• Outlines access, amendment, and disclosure rights for student records. 

• Institutions must establish a policy for compliance and protection. 

•  Missteps can lead to an investigation or funding loss.

California Education Code § 49073.1 

Link:

https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=EDC&sectionNum=49073.1

Key Points: 

• Governs contracts with tech providers for student data.   

• Requires transparency, breach notification, and limits use of data. 

• Reinforces FERPA and state privacy rules at the district level.

• Restrict access with tiered permissions for staff. 

• Conduct regular audits and staff training on privacy laws. 

“Competence is my watchword. My two basic responsibilities will always be uppermost in my mind—accomplishment of my mission and the welfare of my Soldiers.” - NCO Creed.

This NCO Creed principle emphasizes the ethical responsibility to perform duties competently while prioritizing the welfare of others. In education, this translates to protecting student data as part of the mission and safeguarding student welfare as a core duty.

As an Army Intelligence professional and a graduate student, I learned the importance of handling sensitive information not only on mission but also from an administrative perspective, including personal details, with utmost care and integrity. When I work within the capacity of the educational spaces, I notice that laws like FERPA and COPPA are similar to military protocols for data security. This realization made me even more dedicated to using these laws in schools to keep our students and families safe, as I am a parent myself.

As a Graduate Student and U.S. Army Recruiter with over 15 years of service, many of those years focused on Intelligence and Information Security, I bring a deep understanding of safeguarding sensitive information and upholding ethical standards. My Army background has instilled in me the importance of confidentiality, regulatory compliance, and responsible data stewardship. These principles directly translate to the educational context, especially when it comes to protecting students’ personally identifiable information (PII).

Field of Education:

Administrative Leadership with a focus on legal, ethical, and operational compliance in educational institutions.

What I’ve Learned: FERPA is not just a compliance checklist; it is a living safeguard designed to empower families with rights over their children’s educational data. Schools must provide access to records upon request, obtain consent before disclosing data, and protect students from unauthorized disclosure of their data. Violations can lead to funding loss or formal complaints filed by families, showing how regulatory oversight promotes long-term accountability.

Federal Trade Commission – COPPA Oversight
The FTC oversees the Children’s Online Privacy Protection Act (COPPA), which governs how websites and online services collect information from children under 13.

What I’ve Learned: The FTC’s role goes beyond enforcement; it educates and holds digital platforms accountable for protecting young users. This is especially crucial in school settings where students use apps and edtech tools. I’ve learned that schools must work with vendors that align with COPPA standards, or they risk legal liability. Parental consent and clear privacy policies are essential components of ethical practice in digital learning environments.

What I’ve Learned: CalOPPA has become a model for data transparency laws nationwide. It requires school-affiliated apps and platforms to disclose their privacy practices and update them when changes occur. In my practice, I’ve recognized that many local districts are still catching up with CalOPPA standards, making professional development in this area crucial for administrators and IT staff.

California Attorney General – Data Breach Investigation & Enforcement
The California Attorney General enforces the California Consumer Privacy Act (CCPA) and investigates data breaches involving educational institutions.

What I’ve Learned: The Attorney General holds absolute power in enforcing accountability. Institutions must report breaches promptly and notify affected parties; failure to do so invites legal scrutiny and public distrust. As an educational leader, understanding this role reminds me that data governance is not just an internal policy; it’s a public responsibility.

• K–12 School Administrators

• Higher Education Leaders

• Technology Directors and IT Staff

• School Counselors

• Military-connected Educators and Decision Makers

  
  

Why I Chose This Topic:

Having visited numerous schools across California during my recruiting duty, I’ve observed varying levels of data privacy awareness and implementation. As a parent of a high school student and someone with professional experience in information protection, I recognize the growing urgency to ensure that educators and administrators understand the legal and ethical responsibilities associated with student data. This topic blends my personal, academic, and professional lives, making it not just relevant but vital to future educational leadership.

• Protects individuals from unreasonable searches and seizures.

• Requires schools to ensure that data collected or accessed (e.g., through digital surveillance or device access) complies with privacy standards.

• Applies to how student devices, emails, and online behavior are monitored, especially in public schools where government action is involved.

• While the school has a right to maintain discipline, students also maintain reasonable expectations of privacy.

• Declares privacy as an inalienable right for all Californians, including students.

• Provides a broader interpretation of privacy than the federal constitution, often cited in education-related privacy cases.

• Reinforces that school districts and third-party vendors must handle student PII (personally identifiable information) with care and consent.

• Serves as the foundation for state privacy laws like CalOPPA and CCPA, further strengthening digital and physical protections.

• Grants parents and eligible students the right to access and request corrections to their student education records.

• Requires written consent before schools can release student PII, except in limited, FERPA-approved situations.

• Applies to all educational institutions receiving federal funding.

• Violations may result in complaints and investigations by the U.S. Department of Education, as well as potential loss of funding.

• Requires websites, apps, and online services to obtain verifiable parental consent before collecting personal data from children under 13 years old.

• Applies to school-used technology platforms, mainly when vendors collect data from students.

• Mandates clear privacy policies, secure data handling practices, and parental access to collected information.

• The FTC enforces compliance and can issue fines for violations; therefore, educators must verify that digital tools are COPPA-compliant before using them in the classroom.

• Issue: Whether peer grading in classrooms violates FERPA.

• Holding: The Supreme Court ruled that peer-graded assignments do not constitute “education records” under FERPA until a teacher records them.

• Reinforced the definition and scope of educational records under FERPA.

• Clarified that day-to-day instructional practices like peer grading do not fall under federal privacy protection, offering clarity to educators.

• Implication: Educators must understand how and when student information becomes an “education record” and falls under FERPA protections.

This case is instrumental in distinguishing between protected records and instructional tools, and reinforces that not all student-related data automatically qualifies for FERPA protection unless the institution maintains it.

This regulation operationalizes the intent of FERPA and serves as the primary compliance framework for educational leaders, administrators, and IT directors when handling student records.

• Applies to contracts between California school districts and third-party digital service providers that collect or manage student data.

• Requires school districts to post contracts publicly on their websites for transparency and accountability.

• Contracts must include provisions that:

1. Prohibit targeted advertising based on student data.

2. Ensure data is used only for the school’s purpose.

3. Require encryption and security measures.

4. Specify limits on further disclosure of student data.
   

• Mandates providers to delete student records upon request by the school or upon expiration of the contract.

• Schools must track vendor compliance and protect student privacy at the district level to ensure accountability and transparency.

  
  

This law defines how California school districts operationalize FERPA, COPPA, and CalOPPA principles at the local administrative level by holding vendors accountable and enforcing data governance policies.

“I know my Soldiers and I will always place their needs above my own.” - NCO Creed.

Connection to Topic:

This principle emphasizes the execution of the mission with integrity while ensuring the well-being of those in your care. In the context of education leadership and student data privacy, “welfare of my Soldiers” translates to the welfare of students/applicants. As an NCO and now an educational leader-in-training, I recognize that protecting student PII is not just a legal obligation but a moral one, reflecting a commitment to safeguarding the most vulnerable in our care.

Ethical Dilemma:

A school staff member wants to share student information with a nonprofit partner for scholarship opportunities, but bypasses parental consent. This may appear beneficial, but it violates ethical and legal standards. Just as in the Army, integrity requires doing what is right, even when it’s inconvenient.

2024 California Code :: Education Code - EDC :: TITLE 2 - ELEMENTARY AND SECONDARY EDUCATION :: DIVISION 4 - INSTRUCTION AND SERVICES :: PART 27 - PUPILS :: CHAPTER 6.5 - Pupil Records :: ARTICLE 5 - Privacy of Pupil Records :: Section 49073.1. (n.d.). Justia Law. https://law.justia.com/codes/california/code-edc/title-2/division-4/part-27/chapter-6-5/article-5/section-49073-1/

AMDT4.3.7 Unreasonable seizures of persons. (1789, September 5). Constitution Annotated. https://constitution.congress.gov/browse/essay/amdt4-3-7/ALDE_00000781/

California Code, EDC 49073.1. (n.d.). https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=EDC§ionNum=49073.1

California Constitutional right to privacy. (n.d.). ACLU of

NCO Creed - Army values. (n.d.). https://www.army.mil/values/nco.html

Northern CA. https://www.aclunc.org/campaign/california-constitutional-right-privacy

Code of Ethics | AASA. (n.d.). Default. https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa

FERPA 101: For Local Education Agencies | Protecting Student Privacy. (n.d.). https://studentprivacy.ed.gov/training/ferpa-101-local-education-agencies

FERPA | Protecting Student Privacy. (n.d.). https://studentprivacy.ed.gov/ferpa

Owasso Independent School Dist. No. I-011 v. Falvo, 534 U.S. 426 (2002). (n.d.). Justia Law. https://supreme.justia.com/cases/federal/us/534/426

Privacy Technical Assistance Center. (2015). Responsibilities of Third-Party Service Providers under FERPA. In PTAC-FAQ-5(p. Page 1) [Report]. https://studentprivacy.ed.gov/sites/default/files/resource_document/file/Vendor%20FAQ.pdf