Here’s a thread about protecting student privacy while reporting new Covid-19 cases

FERPA governs how to share student info. Like all laws, it requires interpretation. Generally, don’t release data (without consent) that by itself or in combination reveals sensitive info about individuals

It’s called PII – Personally Identifiable Information. You might say “the average score is 82%” but you can’t say “Jill got 97%.” Nor could you say the average woman got 97% if Jill is the only woman. And it gets more complicated from there

Combining data – in this case, test score plus gender – is the thing. You have to think about data in context of other available/public info. Don’t let PII get reverse engineered

Now, there are FERPA “directory” exceptions. Think stuff you’d find in official publications. Club members in yearbooks, major and degree in commencement book, height and weight of athletes, phone number in phonebooks

And exceptions to share PII with specific people for specific purposes. Subpoenas, crime, research studies, #finaid, administrative, etc. Including… “health or safety emergency”

We’re in such an emergency and the Dept of Ed released Covid FERPA guidance in March. BUT it implied there’s a difference between revealing PII to students/parents/health officials vs. the public

Of course, the public has a super duper good reason for wanting details. And every school in America will grapple with this balance. UNC’s already getting pushback https://twitter.com/dailytarheel/status/1294360423190401025

Now, UNC has had its fair share of... bold FERPA interpretations. And it might seem like they’re being deliberately obtuse here, but are they?

Well, it’s not so clear to me. Because we don’t know all the possible data combinations. Remember, don’t let PII get reverse engineered. Student privacy requires plausible deniability

That plausible deniability can come from the safety of large numbers. We don’t reveal info about small groups since folks could easily guess the individuals. Like if there are only 5 Asian students in a town, avoid reporting stats about Asian students

But large numbers don’t always provide anonymity. If I said 2,000 people in a dorm had Covid, and you know that dorm only holds 2,000 people, then I’ve revealed everyone’s medical history

More insidious: the temporal aspect of Covid. If there’s 30 cases, that could be a large enough number to safely report. But suppose next week it’s 35 cases and I report that too? You’ll know 5 people recently got Covid and might be able to guess who based on absences

So where do we go from here? There’s an inevitable tradeoff between public health and protecting student privacy. It’ll get messy.

But I recommend following one of the best in the biz, @todmassa

tl;dr FERPA wants sudoku puzzles that can’t be solved