Which FERPA practice protects student privacy when using data for assessment and progress monitoring?

• A. Access should be unrestricted to support rapid decision making.
• B. Access should be on a need-to-know basis; use secure systems; obtain consent when required.
• C. Data should be shared publicly to ensure transparency.
• D. Data can be stored on personal devices without encryption.

Answer: (B)

The main concept is protecting student privacy by limiting who can access education data, ensuring it's stored securely, and obtaining consent when disclosures are required. When data are used for assessment and progress monitoring, only people who have a legitimate need to know should access the information, and the systems that hold the data should have strong security measures in place. Consent should be obtained when required by FERPA before sharing information outside those who need it.

This approach mirrors FERPA protections because it minimizes who can view sensitive records and reinforces safeguarding practices like secure storage, access controls, and appropriate disclosures. Unrestricted access would expose students’ information to unnecessary risk, sharing data publicly would violate privacy, and storing data on personal devices without encryption creates serious security vulnerabilities.