NOTE: This guide about protecting student privacy in information technology (IT) systems is for informational purposes only and is not intended as legal advice. If you have questions, please contact the University of Maryland (UMD) Office of General Counsel.

General important statements

Student information and FERPA

• Certain student information and records are covered by the Family Educational Rights and Privacy Act (FERPA) and UMD protects those information and records in accordance with FERPA and other applicable laws. The UMD Office of Procurement and Strategic Sourcing, in partnership with the Division of Information Technology (DIT) security team and the Registrar's office, makes sure that appropriate FERPA language, and language required by other applicable laws, is included as needed in any contract with a third-party IT service provider signed on behalf of the University of Maryland (regardless of division or college). UMD's agreements with third-party providers meet all of UMD's obligations under FERPA.
• Certain student information transmitted within ELMS-Canvas and exchanged with all third-party tools integrated with Canvas is treated as a student educational record, which is protected by FERPA.
• UMD's third-party service providers are prohibited from using student data in any way except to carry out the contracted services. The information transmitted through these systems belongs to UMD and is governed under the UMD Policy on the Acceptable Use of Information Technology Resources which sets forth standards for responsible and acceptable use of UMD IT resources. These resources include computer systems, computer labs, applications, networks, software and files.
• Student records cannot be disclosed except as permitted by FERPA or as covered in written consent from the student. Written consent should be for a specific purpose and not a blanket consent for any and all future use. A FERPA Informed Consent and Authorization for Disclosure template is available for download: FERPA Informed Consent and Authorization to Disclose Educational Records.

Top

Recording meetings, classes and conversations

• Maryland is one of 11 U.S. states that require two-party, or all-party, consent before it is permissible to record or otherwise intercept and/or capture communications (such as phone calls, in-person conversations, video conferences). This means that everyone participating in a conversation must give their consent before any communication is recorded. Maryland courts have found implied consent in cases where it is abundantly clear that an individual knew they were being recorded.
• Pursuant to Maryland law, you must provide verbal and/or visual notification of recording at the beginning of any meeting or class to alert the participants that "this activity is being recorded." If a participant continues to participate after being notified that the activity is being recorded, their consent to recording is implied.
• You may also distribute the attached Informed Consent for Class Recordings, which provides students with the opportunity to expressly consent to recordings. This does not alter the implied consent guidance contained herein.
• UMD strongly suggests that you do the following:
  
  • Provide both a verbal and visual notification at the beginning of the activity.
  • Use a visual notification of recording during the entirety of the activity.
  • Password protect your classes so that only enrolled students and authorized UMD personnel can access the online class..

Top

Frequently asked questions

Which IT systems at UMD have the capability to capture an individual's audio and image records?

ELMS-Canvas, Panopto, Zoom, Google Hangouts/Chat. Access a comprehensive list of teaching and learning systems and services offered by DIT.

Top

Should I record my live (synchronous) classes and/or meetings when held online?

Generally, no. You should treat your online synchronous classes (and other activities) similarly to your face-to-face classes (and other activities). If you were not routinely recording your face-to-face classes, there is probably no reason to routinely record your online synchronous classes or meetings. You may always record your own lecture (without student participation) and post it in a UMD-approved instructional technology system (ex., Panopto, ELMS-Canvas, Google Drive, Box) so that students can access the recording asynchronously.

If a student has an accommodation that can be met via recording online synchronous classes (and other activities), then you may need to record the class (or other activity).

If you record an instructional activity, you must obtain the consent of anyone whose voice, likeness, or other personally identifiable information could be recorded. If you intend to use the recording outside of the class for which it was originally recorded, you will also need to obtain FERPA consent from all student participants. Consents to be recorded are separate and distinct from FERPA consents.

Remember that names and/or IDs are typically listed as part of a participant's image and are visible in the recording, creating a risk of disclosing personally identifiable information if the recording is shared by a participant.

Top

Is a recorded class/lecture/meeting (audio or video) a protected student record?

If a recording includes only the instructor's voice, image, and/or other personally identifiable information, the recording is not a student record and FERPA does not limit its use. If the recording includes students asking questions, making presentations or leading a class (other than teaching assistants), and/or it is possible to identify students, then the portions containing recordings of the students do constitute protected educational records. Educational records can only be used as permitted by FERPA or set forth in a written consent signed by the student.

Top

May a recording that includes student participation be posted for other class members to view or listen to?

Yes, but only if access is limited to other students in the same course. In that case, FERPA does not require student written consent. This allows instructors to create access for students in the course to watch or rewatch past sessions.

Top

Can an instructor allow individuals outside of a class to access a video of that class that includes student participation?

No, instructors may not share or otherwise allow access to recorded instructional materials that include students' images, voices or other personally identifiable information without obtaining a FERPA consent from every student.

In order to share materials that include students' images, voices, personally identifiable information or other educational records, the instructor must obtain a written FERPA consent from each student who can be seen or heard in the recording or whose other educational records will be released. A form template is available to download: FERPA Informed Consent and Authorization to Disclose Educational Records.

Recordings can be edited to omit any student who has not consented to the use of their voice or image or to de-identify the student in the recording (which can include avoiding or removing any mention of the student's name, blurring the student's image, altering voice recordings, etc.).

Instructors can also plan recordings so that students (such as those asking questions during a class) are not shown in the video or referred to by name (another way to de-identify the student).

Top

What is the easiest way to comply with FERPA if I am video recording my class session and students will be asking questions, doing presentations or appearing on camera?

If access is limited to students enrolled in the same class, FERPA does not limit or prevent its use and does not require obtaining a written consent. This allows instructors to create access for students in the class to watch or rewatch past sessions.

If access will not be limited to students in the class, plan the recordings accordingly. Make sure not to show students who are asking questions and don't refer to the students by name. Avoid repeating the student's name in the recording (de-identifying the students removes the need for a specific consent from each student depicted). If a student happens to appear on camera, their identity can be edited out if you cannot obtain the student's written consent.

Because student presentations make it more difficult to de-identify the student, the instructor should obtain a FERPA consent from the student making a presentation that will be recorded. The instructor should also obtain a FERPA consent for any video projects, such as student-made films.

Top

Can the instructor show recordings from previous semesters or years to current students?

Under FERPA, this situation must be treated as if the recordings were being shown to a third-party audience. In order to show recordings made in prior semesters, you must obtain a FERPA consent from any students depicted or de-identify any students depicted.

Top

Can recordings be incorporated into MOOCs or other similar uses?

Any use of recordings must comply with FERPA, either through written consents or de-identification of students depicted.

Top

What if a student declines to keep their camera on, to be recorded and/or to sign a FERPA consent?

Students cannot be compelled or required to give consent to keep their camera/microphone on, to be recorded or to authorize the disclosure of FERPA-protected student information.

For FERPA purposes, if a student refuses to consent to FERPA disclosures, the instructor may continue to use the recording outside of class as long as the instructor edits the student out of the recording or de-identifies the student records.

For purposes of Maryland's all-party consent law, if a student refuses to consent to be recorded, the instructor must ensure that the student turns off their camera and microphone and participates in the course by using the private text chat tool.

Top

What is the difference between the institutional and "public" versions of these systems?

UMD has negotiated appropriate contract language in the institutional versions of these systems, including FERPA compliance and firm restrictions on how companies are able to use UMD data (including student data). To protect student information, UMD requires CAS login and multi-factor authentication (via Duo) for instructional technology systems. Logging in using institutional emails through a general public website, Facebook or any other social media application is not recommended nor necessary.

Top

Isn't there a simple way the university can get blanket consent for all ongoing classes from students as part of the conditions for online education?

No. Students must be able to withdraw consent at any time, so express written consent should be obtained at the class level by the instructor. Additionally, there may be legal and contractual constraints on UMD's ability to require blanket consent from students at this point in the semester. Faculty may use the consent form attached to this article to obtain consent from students or they may rely on implied consent.

Top

What should I consider if I am using a system where a recording is being made?

When recording is necessary, students and all other participants must be made aware at the beginning of the session that video and/or audio are being recorded; this notice is required by Maryland law. Here is an example that can be used at the start of the session: "This class session is being recorded. By joining today's class session, you consent to being recorded." You may also include this statement on your first lecture slide.

Several of these systems have an automated warning sign, such as a flashing red indicator. For these systems, if an indicator is not visible, it is unlikely that the activity is being monitored or recorded during that time. Please be aware that, regardless of UMD's guidance, a student or other participant could be using local/personal technology to capture what is being presented without warning the instructor, meeting host, or other participants. This is similar when a student is surreptitiously recording a classroom activity.

As a measure of extra caution, in addition to the legally required statement that the activity is being recorded, the instructor should send an email to students/participants in advance and also state, at the beginning of the session, that the video and/or audio recording is, or will be, used for educational purposes and may be made available to all students presently enrolled in the class. Here is an example that can be used:

"Our class sessions will all be recorded for use by enrolled students, including those who are unable to attend live. Students who participate with their camera engaged or utilize a profile image are consenting to have their video or image recorded. If you are unwilling to consent to have your profile or video image recorded, be sure to keep your camera off and do not use a profile image. Likewise, students who unmute during class and participate orally are consenting to have their voices recorded. If you are not willing to consent to have your voice recorded during class, you will need to keep your mute button activated and communicate exclusively using the chat feature, which allows students to type questions and comments live."

If you intend to use the recording in future class sessions and lectures, you should disclose this fact to students and participants and inform them that any type of personally-identifying information will be adequately removed from the videos (and then you must actually remove this information).

Use Zoom settings to disable downloads of recordings and manage other recording settings.

If recordings are necessary for a specific purpose such as turning in an assignment, remember that recordings of students become student education records under FERPA. Save them using a UMD-approved method and only share them with UMD personnel with legitimate educational interest to the records. Instructors must ensure that they are using their UMD email/login account and not a personal or another organizational account.

Because the settings options on Google Hangouts/Meet are limited, UMD recommends that you avoid using these two systems if you plan to transmit information that is protected by FERPA.

Do not require your students to be identified on social media in order to participate in a class or submit assignments (e.g., sharing a Tweet or a public Facebook post).

Do not hold meetings with your students on other technologies such as FaceTime or Skype; rely on our UMD-approved communication and collaboration options in order to ensure access for students and data privacy.

Top

Is there such a thing as video-chat etiquette?

Yes, and it helps to protect your privacy in many ways. Students and instructors are strongly encouraged to research and consider basic recommendations related to video-chat etiquette. Here is an example of video-chat etiquette provided by Zoom.

Remind your students that Student Conduct Expectations are the same online as in person. Faculty, staff, and students should be aware that they are subject to the following UMD policies even in an online environment:

• Sexual misconduct.
• Non-discrimination.
• Threatening and Intimidating Conduct.
• Workplace Violence Reporting and Risk Assessment.
• Acceptable Use of Information Technology Resources.

Whether in person or in virtual and digital settings, students, faculty and staff are prohibited from harassing, defaming or targeting others based on their protected status. Misconduct that violates UMD policies may result in disciplinary action regardless of whether it occurs online or in person. Members of the UMD community are encouraged to report violations by using the links below:

• Inappropriate student conduct online.
• Act of discrimination online.
• Sexual misconduct online.
• Threatening and intimidating conduct online.

Top

What about information shared by email and calendar?

Whenever possible, please contact students within the ELMS-Canvas communication tool. Instructors MUST use their umd.edu email addresses. Students may choose to forward their terpmail.umd.edu email to a different email address of their preference.

When emailing groups of students, use the Bcc line for all student email addresses. This will work for a single class of students or other groups of students. Not all students' email addresses are public. If instructors wish to email students outside ELMS-Canvas please consult our instructions on Create and Manage Coursemail Lists With ELMS Management Tools.

Calendar invites to your class (e.g., to share a Zoom link) should be marked "private" so that your class list is not disclosed via people's calendars.

Top

What if I want to use a new technology not listed in the DIT service catalog?

Departments are rapidly adopting new technology to make our unique circumstances work. Be sure not to skip important processes before implementing something new, as now more than ever we need to protect our student's data and comply with data privacy laws. If you are purchasing or downloading new software and apps:

1. Check in with your local IT contact to learn about existing options UMD already offers or the appropriate steps to implement new technology.
2. Work with Procurement to obtain proper contract terms and conditions, including FERPA compliance.

You should not accept "click-through" agreements to download software and apps; instead work with Procurement to obtain appropriate contract terms, even for free software/apps.

Top

Do students need to pay extra to be proctored? Should I ever need to enter credit or debit card information to use any of these systems?

You should not need to provide direct payment to access or use any of the systems used by UMD instructors for teaching and learning purposes. No third-party tool that is integrated within ELMS-Canvas is authorized to process any kind of payment card (PCI) transaction on behalf of UMD. Please be aware, UMD has not reviewed and does not endorse the individual purchase or usage of apps nor are purchased apps required to make full use of any application through UMD's ELMS-Canvas contract. UMD has approved and integrated enterprise apps such as Google Calendar and Zoom into ELMS-Canvas to securely extend the functionality of some of these systems. UMD's information security team reviews all such integrations before implementation. If a user chooses to purchase an app, they do so of their own volition and outside of the terms and conditions of UMD's contract.

Top

Where can I find additional information about the use of photos and videos protected under FERPA?

The U.S. Department of Education has comprehensive FAQs on photos and videos under FERPA.

Top

Where can I learn more about FERPA at UMD?

More detailed information about FERPA at UMD is available from the Office of the Registrar.

The UMD FERPA Tutorial is designed to give you basic knowledge of the rules governing the release of student information. The tutorial takes approximately ten minutes to complete.

Top