Unauthorized disclosures of student information occur when personally identifiable information from a student’s education records is shared with individuals or entities who do not have a legitimate need to know and without proper consent or a permitted exception. Examples include sharing grades or disciplinary records with unauthorized parties, posting identifiable student information publicly (e.g., on bulletin boards or social media), emailing or messaging student data to inappropriate recipients, or printing class rosters that include identifiers and leaving them unattended. Direct answer

• Examples of unauthorized disclosures:
  • Sharing a student’s grades or disciplinary records with someone not authorized to access those records (e.g., emailing grades to all parents when consent or a legitimate need is not established).
  • Posting a list of student names with identifiable information (such as grades, IDs, or personal data) in a public space.
  • Discussing a student’s academic or personal information with individuals who do not have a legitimate educational need to know (for instance, talking about a student’s attendance with a non-authorized staff member or parent).
  • Printing a class roster that includes sensitive identifiers (like Social Security numbers or student IDs) and leaving the document unsecured.
  • Including PII in letters of recommendation without the student’s explicit written consent where the information is not required or appropriately consented.