Can privacy regulations prevent my alma mater from sharing the fact that I graduated there? I graduated from some private high school a long time ago. During my years there, I have experienced and witnessed a variety of dubious practices that violate students' rights. I always wanted to leave but never had the necessary resources nor support to execute my plan. Due to this I never associate myself with my school, not even in my resumés. Recently I received an honorable mention in an invention competition. I was so proud of myself until I searched the name of the competition on Google. On page 1 a familiar name popped up. It was my school's name. When I clicked on it, I saw my name in a school blog post. John Doe's remarkable feat in Blah Blah Invention Competition John Doe, Class of 2000 has won an honorable mention in ... I was so surprised that they heard the news in the first place, considering the fact that I cut off all contact with the school admin and peers after I became an adult. I didn't want my name on that page, especially given the fact that some alumni have started to come out about what they suffered in school in recent years. Can I prevent them from using the fact that I graduated their school on their website by citing the Family Educational Rights and Privacy Act(FERPA) or others? Or is this fair game per first amendment grounds and am I out of luck?
The privacy rule is spelled out here. Subpart D addresses disclosure of personally identifiable information from education records, saying when consent is required vs. not required (there being 16 conditions under which consent is not required). Mostly this refers to &quot;required by law&quot; exceptions, or &quot;for school-internal use&quot;, but also includes &quot;directory information&quot;. Information may be disclosed if the student (as an adult) or a parent (of a minor) has consented to disclosure. Under the legal definition of &quot;record&quot;, that simply means &quot;tangible information&quot; (not &quot;conversations&quot;). An education record is one that is &quot;directly related to a student; and maintained by an educational agency or institution or by a party acting for the agency or institution&quot;, possibly including the information that you cite – providing that the information is maintained and disclosed by the school. In addition, though, certain information can be freely disclosed, namely &quot;directory information&quot; which is: Directory information includes, but is not limited to, the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors, and awards received; and the most recent educational agency or institution attended. The regulation explains that this is information that &quot;would not generally be considered harmful or an invasion of privacy if disclosed&quot;. Privacy standards have changed since the law was passed – but it is allowed by the existing law.
FERPA protects the privacy of students' records, irrespective of their age or grade level. Age is generally only relevant in determining who can assert those privacy rights. When you enter school at age 5 or whatever, your parents make your privacy decisions for you. When you turn 18, you become an &quot;eligible student,&quot; i.e., eligible to assert or waive your privacy rights without parental oversight.
Personal data is any information relating to an identifiable person, whether that information is public or not. The student website is definitely processing personal data of faculty. Any website is also necessarily processing personal data of visitors due to technical reasons, even though hosting has been outsourced to a third party. There's always a server, you just might not be managing it yourself. Thus, GDPR applies. Just because it processes personal data doesn't mean that the student website would be illegal. It just means the students are responsible for GDPR compliance of that website. Since the website is controlled by students and not by the university, the university DPO has no say here and the university can't demand the website to be hosted in a particular manner. Nevertheless, the DPO's suggestions might be quite sensible. Typical GDPR compliance steps include: having a clear purpose for which the personal data is being processed having a legal basis for that processing (here, probably a “legitimate interest” which will require a balancing test), see Art 6 providing transparent information to the data subjects providing a privacy notice to website visitors, see Art 13 notifying faculty per the requirements in Art 14 GDPR preparing to fulfill data subject rights such as access, rectification, and erasure when using a legitimate interest, there's also a right to “object” (opt-out) implementing appropriate technical and organizational measures to ensure security and compliance of your processing activities, see Art 24+32 making sure that third parties to which you outsource processing activities are contractually bound as “data processors” to only use the data as instructed by you, see Art 28 if you transfer data to non-European countries, having appropriate safeguards in place Does this sound complicated? It can be complicated. The point is that the internet is no longer the lawless Wild West. Just because you can easily publish a site with personal data, doesn't mean that you should. The GDPR is about requiring data controllers to find an appropriate balance with the rights and interests of the affected persons. Of course there are countries with less regulation, but there are also countries with fewer taxes and that isn't necessarily good for society. The easiest way to avoid these responsibilities will be to stop publishing the site as students – and instead taking up the university DPO's offer to have the university run the site. Which is less fun, of course, but the adult thing to do. If this motivates you further: note that the data controller (the people responsible for the site) must publish their contact information in the privacy notice, typically name + email + street address. The GDPR contains no exceptions that would help here. There is an exception for purely personal or household activities. But if the website would be available to the general public, it would be difficult to argue that this is purely personal. There's also case law such as the Lindqvist case requiring a narrow interpretation of that exception. In Art 9, the GDPR does mention that some restrictions are lifted if the data subject made the information public themselves. But that isn't relevant here, because Art 9 is only about extra-protected sensitive data, e.g. health information, union membership, or sexual orientation.
You are framing it wrong. It is not that "they have put a barrier" to public domain information, it is that they have added an additional source of that information. The new source has a barrier, yes, but that does not prevent you from accessing the same information elsewhere. If you own a copy of some public domain data, you are not allowed to prevent other users from accessing other copies (by claiming copyright infringement or the like); you cannot even prevent people from doing copies from the copies you did provide them. But you are not forced to allow other users to access your copy. Consider the logical conclusion if that were the law. The moment that you downloaded some public domain file into your computer, you would be forced to give access to your hard disk from the internet, isn't it? Would you need to leave your home door open if you happened to have a printed copy of the text there? Of course, there is a need to discriminate between "public domain" (without licence) and "not public domain but open licence" (BSD, CC, GPL, etc.). In the later case the licence could be tailored so that the work could appear in archive.org but that it would be illegal to provide it with the business model of Academia.edu1. But that would be possible only for works not in the public domain. 1 To be decided by a judge on the basis of the wording of the licence and jurisdiction.
As for plagiarism, that is not a legal concept, so he can define plagiarism however he wants. It certainly isn't, under any definition I have ever seen on Earth and I have seen many (it has to do with "claiming someone else's work as your own"). As for copyright, a set of questions is (potentially) protected by copyright. If they are copied from somebody else's book of questions, then the book author (or publisher) holds copyright. Let's say that QM invented the questions, such as "What is the Turkish word for Janissary?", "What is the most prominent feature of Jannissary garb?" and so on. Then that set of questions, when put down in fixed form, are protected by copyright, and cannot be copied without permission.
The Fifth and Sixth Amendments are about civil and criminal court proceedings. They do not apply to a university's internal disciplinary procedures, which are the subject of the Dear Colleague letter. Note for example the text of the Fifth Amendment: ... or be deprived of life, liberty, or property, without due process of law. A university's disciplinary procedures do not deprive anyone of their life, liberty, or property. Typically, they only decide whether to suspend or expel the person as a student at the university, or apply other academic punishments (failing grades, marks on transcript, etc). I don't think there needs to be any law "affirming" this. Rather, there is simply no law that requires universities to use Fifth / Sixth amendment standards in their internal disciplinary procedures.
We don't have a lot of details, but if you're in the United States, the answer is probably yes. There are rarely any meaningful rules of evidence in student misconduct cases, so pretty much anything can come in. There may be some small difference in the answer depending n whether you're dealing with a public university or private, but in either case, I can't think of any reason why they would not be able to introduce the evidence if they had it. If there's a question about its authenticity, I imagine that would just be up to the misconduct board to decide. If Person X says "Person Y sent this to me," and Person X seems credible, that's probably going to be enough.
A mnemonic like CRAAP is not protected by copyright. The Copyright office says &quot;Copyright does not protect names, titles, slogans, or short phrases&quot;, so you do not run afoul of copyright law using that or any other abbreviation. There is a registry of copyright-registered works, maintained by the copyright office, where authors may register their works, but legal protection exists regardless of registering. Some abbreviations are protected under trademark law, which you can search here. There are 50 registrations that include &quot;AAA&quot; and three that are just &quot;AAA&quot;, also you'll find WTF and LOL. Trademark protection doesn't forbid all uses of an registered abbreviation. It turns out that &quot;CRAAP&quot; is not a registered trademark, but it could be the registered trademark of a manufacturer of crab traps, so you would not likewise call your crab trap company CRAAP, but it would be okay for plumbing supplies (trademark is relative to business uses, which are described in the registration). The only other imaginable scenario that would impede your plan is a non-disclosure agreement. For that to be relevant, there would have to be a valid contract between you and the teacher which specifically prohibits disclosure of the acronyms. The chances that there is a contract between you and the teacher is so low that it is hardly worth considering, but let's explore that for a moment. A contract is an agreement between parties where each party promises to do something that they are not already obligated to do, in exchange for getting something that they do not already have a right to. You had a contract with the college, not with the teacher. The college clearly would not prohibit &quot;using any information gained in the course of study here&quot;, and the courts would not enforce any such &quot;don't use&quot; wording in a contract as unconscionable (why else do you go to college?). Your contract with the college allows you to take classes and use the knowledge that you gain. The teacher's contract with the college requires her to teach some content, and probably allows her to set certain rules of class conduct. She might have been able to toss you out of class for disseminating her methods, but at this point she has no legal recourse. NDA enforcement is generally limited to protecting &quot;trade secrets&quot;, which are defined in terms of information with independent economic value deriving from the fact that the information is non-obvious&quot;. Also, an NDA will have a time limit associated with it except in the case of highly-sensitive personal information (social security numbers), so the courts will not enforce language saying &quot;you can never make use of this information, or these names&quot;.