Can a student ask other students about their grades and then publish an average under FERPA? Can a student ask other students (&gt;14) to fill out an online form disclosing their grade on an assignment and then publish an average of the grades? Or is the implicit permission given by filling out a survey insufficient? More context from studentprivacy.ed.gov: Schools may use their judgment in determining whether an unaccompanied minor is responsible enough to exercise certain privileges, such as inspecting and reviewing education records and providing consent for disclosure. 34 CFR § 99.5(b)
FERPA merely binds education institutions that receive federal funding to adopt policies against improper disclosure of student information. It does not affect all disclosure of that information itself. In particular, FERPA would not prevent students or their parents from disclosing their own records or grades.
Yes (probably), under COPPA The FTC has stated that YouTube content creators could be held liable under the Children's Online Privacy Protection Act (COPPA), a United States law that &quot;imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.&quot; (source) The FTC's FAQ on complying with COPPA notes that &quot;operators will be held to have acquired actual knowledge of having collected personal information from a child where, for example, they later learn of a child’s age or grade from a concerned parent who has learned that his child is participating on the site or service.&quot; It also has the following question/answer (emphasis added): I operate a general audience video game service and do not ask visitors to reveal their ages. I do permit users to submit feedback, comments, or questions by email. What are my responsibilities if I receive a request for an email response from a player who indicates that he is under age 13? Under the Rule’s one-time response exception (16 C.F.R. § 312.5(c)(3)) you are permitted to send a response to the child, via the child’s online contact information, without sending notice to the parent or obtaining parental consent. However, you must delete the child’s online contact information from your records promptly after you send your response. Assuming the FTC is correct that content creators (not just the service itself) are responsible for COPPA compliance, a Discord server administrator would likely be required to ban/delete the account of a user upon discovering (acquiring actual knowledge) that the user is under 13. It may be a defense that they believed the user's retraction and claim that it was a lie, but I wouldn't want to be stuck arguing that in court (an underage user who doesn't want to be banned certainly would have a good reason to lie about their age upon finding out that they would be banned for having admitted their actual age).
You give no jurisdiction but in general: First, police have no obligation to be honest. So, yes they can collect this without consent by e.g. taking hair from your hairbrush (with a warrant) or giving you a glass of water while interviewing you and getting it from your fingerprint oils (which may not actually be technically possible but never mind that). No, they can't take it by "force" by sticking a swab in your mouth. Yes, it will almost certainly go into a database. Of course, there are some jurisdictions where police are entitled to decide you are guilty based on the fact that you didn't pay them a bribe.
What stops a university form doing anything it wants is the contract you entered with the university when you enrolled. (I'm writing from the perspective of a student, not faculty). You and they are bound by the contract, and part of that contract will be a clear outline of academic processes such as ethics, grading, class requirements and test taking, as well as penalties for cheating and plagiarism. That contract will be outlined in your student handbook. That handbook and contract will also clearly outline (or should) the grievance process and remediation for both students and faculty. Since you feel that the university is not being fair, you need to start with investigating that formal grievance process and look into gathering your materials and filing a complaint. The college will have an office that handles such grievances; you need to find it and talk to them. If they are a private college, yes, they do have their "own rules," but some aspects of federal, provincial and local civil and criminal law will still apply. Be aware that the school contract may bind you to arbitration - which means you have to deal with the college on all matters - and you may not be able to go to a public court on a civil matter. A lawyer will be able to tell if you are bound by arbitration and if so, that's the end of the road. If not, a lawyer will tell you if you have a criminal or civil case. In any event, the grievance process at the U will more than likely be your first step. If by chance criminal misconduct is found during the grievance process, then a federal, provincial or local prosecutor would be involved; we would assume the university would be forthcoming if that need appeared.
In general, permission is not granted to enter the premises of another by climbing a fence unless it is explicitly granted. That the fence is on your property, but adjacent to the school's property, is a complication. The school, observing that there is a boundary fence, might reasonably rely on that to exclude people from entering other than at desired entry points. So it might be that your entry over the fence would be unauthorized and thus technically trespassing. If you were to put a gate in your own fence, the school's reliance is probably less reasonable. Or if you were to formally notify the school that you intend to enter the school grounds over your own fence. However, in practice, you are not trespassing until you are notified by the owner or owner's agent or someone with proper authority. If there is no sign, there can be no claim that you were notified by one. So until a school official or employee notices you using the fence and orders you to stop, there is no issue.
The basic authority of university staff is summarized here. What seems to be at issue here is whether you have a property right to "access" to the university, as an alumnus. Legal protection of alumnus rights is pretty minimal, contrasted with student or employee rights. There could be a line in the sand pertaining to whether you've paid for something, or are the privileges that you've enjoyed simple part of a PR stunt? If you pay the university for access to university facilities (borrower privileges, for example) then it would be harder to revoke that privilege. Most universities grant a certain level of added privilege, such as an alumnus email account, without any requirement to pay. (They hope to create some good will which translates into donations). So it would really depend on what the basis is for claiming access to university resources, as an alumnus. There is no general obligation of a university to grant alumni various privileges, but they may have created a reasonable expectation and legal right to such privileges, as part of their advertising: that can only be judged by looking at all of the facts. There might be rules within the university which address alumni, so obviously reading the university rules is important. That is really how you would determine whether the coordinator is overstepping her authority. If the university admits that it no longer has jurisdiction over you, then that might be the end of the case, unless that was an error based on less than the totality of the facts. If an accused completely and irrevocably severs relations with a university, the university would have no power over the accused. If there is still a relationship, or if the severance is revocable (i.e. you can become a student again), the university retains some power over an accused. If a student violates the federal regulations pertaining to sex discrimination, the university could be in trouble if they do not address the situation. If the accused leaves the university for a quarter, that does not erase past acts, so the university could be in trouble if they don't address the situation in case of an intervening term off. Thus a legally-viable option would be for a university to permanently remove (unprotected) relations with an accused – not access to transcripts, because of FERPA, but certainly the right to re-enroll or the right to use the library as an alumnus. Again, though, it would depend on what the university rules say. It is highly unlikely that the coordinator has the authority to find facts and mete out punishment (determine that an accused did the act), and this is usually determined by a committee, subject to approval by higher administration. However, an administrator does have the right to limit an individual's relationship to the university in a manner that protects the university's interest. For example, in the event that a person is accused of sexual harassment, the university can temporarily relieve a person of teaching and advising duties, until the case is resolved and there has been a final finding of fact. In general, universities are very protective of their interests and will absolutely squash anything that they think will get them into legal trouble. All that is necessary is that there be a credible basis for the claim – often, that means simply "an accusation". If a complainant vigorously pursues a case, the university could be in trouble because the law allows punishment (loss of funds) in case of a single past violation of the regulations. Their interest therefore is being sure that they have remediated the situation (the stronger course of action), or the complainant has given up (risky since the complainant can change their mind).
Art. 15(4) GDPR says: (4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this. In addition, Art. 85 GDPR requires member states to: [...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...] So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database). The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail. In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.
We're missing a lot of information that we'd need to offer a full answer. Here are some of the things that will probably drive the analysis: the type of counselor we're talking about; the types of information the counselor disclosed; the reason she disclosed it; the job functions of the people to whom she disclosed it; the reason the client is bothered by the disclosure. Generally speaking, a mental-health counselor has a fiduciary duty to maintain the confidentiality of patient information, but my understanding is that in most cases, the counselor would be allowed to discuss a case with colleagues for the purposes of advancing the patient's treatment. So discussing the facts of a tough case with a supervisor is not going to be as problematic as idly gossiping about clients with custodial staff. Beyond the permitted disclosures, there are also situations in which counselors are required to disclose confidential information, including cases where the counselor suspects child or elder abuse or where the counselor believes the client poses a danger to herself or others. If the disclosure was truly not permitted, then it may be that the client has a claim for breach of fiduciary duty. In Georgia, proving that case requires evidence that: That the counselor had information relating to the client that she knew or should have known was confidential; That the counselor communicated the client’s confidential information to third parties; That the client did not give informed consent to the counselor’s conduct; That the confidential information was not a matter of general knowledge; and That the disclosure harmed the client. As you noted, the client could also file a complaint with the state licensing board. I don't know of any federal laws or regulations that would come into play in the situation you've described.