c9daa7e8_s_in_Cloud_Computing_Contracts__Comments
[Issue] FERPA (and privacy and confidentiality generally) [Comments] 
Much of our data – including student information databases and much faculty and staff e-mail – constitutes "education records" for purposes of FERPA and therefore may be outsourced only to vendors that we have designated, and that are willing to accept designation, as "school officials" with "legitimate educational interests" in the data. In order to do that, we must ensure both that our definitions of those two terms in our FERPA annual notices are broad enough to cover outsourcing and that the vendor will not use the data for any purpose other than providing the outsourced service (such as data mining for the vendor's own benefit) or redisclose it to others without appropriate authorization. There may be similar requirements under other statutes governing the privacy and confidentiality of specific types of information, and we are likely to want to protect the privacy and confidentiality of most of our data in any event. Any such requirements or desires should be set forth expressly in the contract, or they will not be enforceable. If the vendor is able to provide encryption of our data in both transmission and storage, privacy concerns, and the need for other contractual protections, may be lessened or even eliminated.
IT: Legal and Quasi-Legal Issues in Cloud Computing Contracts
Comments