AI
How FERPA Opened the Student Data Pipeline
FERPA passed in 1974 to give parents control over student records. When students enrolled in college, that control transferred to them. The 2008 amendments allowed personally identifiable information to flow to “authorized parties,” outside entities performing functions that university staff would otherwise handle. The 2011 amendments broadened the “study exception,” expanding who could access student data for research. The definition of a “student program” widened to cover any program an institution offers. EPIC filed a lawsuit against the Department of Education to block these changes. A judge dismissed it.
National Student Clearinghouse: 97% Market Share, No Privacy Obligation
The National Student Clearinghouse is a nonprofit holding records on 97% of Title IV-eligible degree-granting institution students and 90% of secondary students nationwide. It earns roughly $65 million per year in gross revenue from selling student data. Buyers include employers doing enrollment verifications, loan providers assessing eligibility, and researchers purchasing aggregated analytics packages. Because it is a nonprofit, most state consumer privacy laws do not apply. Only Virginia requires NSC to register as a data broker, but that registration adds no restrictions on what it can sell.
The Equifax Partnership
In August 2021, NSC entered an exclusive partnership with Equifax Workforce Solutions. The product, “Talent Report Education,” packages all available post-secondary degree information from participating Clearinghouse institutions and sells it to HR professionals, employers, talent recruiters, and background screeners. Students already sending data to NSC had no notice this was happening and no opt-out. Toney pointed out the timing: the Equifax data breach settlement, $7.74 virtual debit cards, was still fresh when NSC handed Equifax an exclusive window into every enrolled student’s academic record.
Inaccurate Data and Real Financial Consequences
A study found 40% of financial information held by credit reporting agencies is inaccurate. NSC data flows into financial aid and loan decisions. During the pandemic, millions of students at a separate data broker were classified as in default rather than in deferment under the CARES Act, meaning interest accrued during a period Congress had explicitly paused it. Toney noted that incorrect enrollment or loan data can cost students hundreds to thousands of dollars and can block access to graduate financial aid. That lawsuit is still pending.
No Recourse, No Enforcement, No Fix Under Current Law
Students have no right to private action under FERPA. If NSC misuses student data, the student can write a letter to the Department of Education. The Department can investigate and theoretically remove federal funding from a university for violations. That penalty has never been applied since 1974. The Student Borrower Protection Center asked the Consumer Financial Protection Bureau to classify NSC as a larger participant and list it as a consumer reporting agency. NSC is not on that list. Toney’s argument: everything happening is legal, so the fix requires changing the law, not the behavior.
Q&A
Should universities be required to disclose exactly which third parties receive student data? Toney said yes, proposing an annual one-page disclosure listing all recipient entities plus a separate opt-in page for non-essential services like career placement tools. ▶ 29:37
Do GDPR-style rights apply here, including a right to be forgotten? Under GDPR, users can access, correct, and demand deletion of their data; FERPA provides none of those protections, and NSC falls outside California’s privacy law because it is a nonprofit. ▶ 30:59
Is aggregated research data truly anonymous, or can individuals be re-identified? Toney said research packages are aggregated and theoretically non-identifiable, but transcript, enrollment verification, and financial aid records are granular and tied to specific individuals. ▶ 33:01
Notable Quotes
And this is where things get fun. Sharlene Toney · ▶ 16:02
So, that’s how much your data is worth. Sharlene Toney · ▶ 21:04
Fing funding’s never been taken away Sharlene Toney · ▶ 27:57
Key Takeaways
- NSC holds records on 97% of U.S. college students and earns $65 million per year selling them.
- The 2021 NSC-Equifax partnership sends student academic records to HR professionals and background screeners without consent.
- FERPA provides no private right of action, and no university has lost funding over a FERPA violation since 1974.
About the Speaker(s)
Sharlene Toney has worked as a business analyst in Enterprise Student Systems at Indiana University since 2013, celebrating her 20-year anniversary in higher education the week of this talk. She holds a B.S. in Education and an M.S.W., and is completing an M.S. in Cybersecurity Risk Management in May 2026 with a focus on privacy policy analysis. After 18 years in higher education, she has concentrated her research on student data pipelines, consent, and the gap between privacy policy and practice. She also volunteers with Operation Safe Escape, working with safety and security professionals to assist survivors of domestic violence, stalking, and harassment.