It is a well-established proposition that colleges and universities have an immense amount of data about their students. Moreover, recent news involving the massive college admission bribery scam has placed colleges and universities across the nation under intense scrutiny. With the California Consumer Protection Act slated to take effect Jan. 1, 2020, how should institutions of higher learning prepare for what may be the most sweeping data protection regulation since the Family Educational Rights and Privacy Act of 1974? What issues should they prepare to address with respect to the personal data they collect, store and share on behalf of their students?

Don't assume exemption 

Institutions of higher learning must not assume they are exempt from the requirements of the CCPA solely based on their presumed not-for-profit status because many of the third-party vendors who process students’ personal information will be subject to the CCPA.

Institutions would be best serving their students by beginning preparation for compliance well in advance of enforcement in 2020. As more collegiate stakeholders call for increased transparency with respect to university admission processes, schools must begin to create systems and partner with vendors that seek to honor the requirements set forth by the CCPA.

What is the CCPA, and does it apply to my school?

 The CCPA is a comprehensive law protecting the personal information of “residents” of California — which basically translates to individuals considered taxpayers under California law — collected by any company that does business in California for profit. Furthermore, the business must either have annual gross revenue of more than 25 million; buy, receive, sell or share the personal information of 50,000 or more “residents”; or make at least half their annual revenue from the sales of personal information.

Generally, the CCPA is interpreted to not cover colleges and universities because they are often considered not-for-profit entities. However, the CCPA offers no guidance on how to determine whether a business is indeed for “profit” or not.

If interpreted broadly, many schools will avoid being directly subject to the CCPA’s requirements as not-for-profit entities, but for-profit institutions will likely hold personal data of 50,000 or more “residents” and, thus, will be directly subject to the CCPA. Consequently, administrators at for-profit institutions who fit into the business definition of the CCPA should begin preparations for compliance immediately. College administrators at seemingly not-for-profit schools should exercise caution in assuming they are not covered by the CCPA solely based on an IRS determination of not-for-profit status because the statute is unclear on how to make this determination.

Does a business have to be a ‘controller’ of data to be covered by the CCPA?

The short answer is no. The CCPA outlines that a “business” is covered by the CCPA by either acting as a controller by determining “the purposes and means of the processing” of personal information, along with satisfying at least one of the three aforementioned thresholds or by acting as a parent or a subsidiary of an entity that determines the purposes and means of the processing of personal data and operating under the same brand.

Accordingly, a third-party vendor for a school may be subject to the requirements of the CCPA even if the vendor is simply processing students’ personal information on behalf of the school. Furthermore, this issue is not exclusive to institutions of higher learning, as education technology vendors for K-12 education face the same dilemma. With this in mind, schools that utilize learning management systems and other data management software must avoid the mistake of assuming service providers processing students’ personal data are not subject to the requirements of the CCPA.

What issues do schools face toward complying with the CCPA?

Regardless of whether the CCPA applies to a school or not, all schools must take an interest in the CCPA because, with near certainty, their technology providers, such as their learning management system, will be subject to the CCPA. More specifically, the right to erasure provided by the CCPA to “residents” presents particular difficulties for schools because many programs offered by institutions rest upon the collection, use and disclosure of personal information.

For example, programming offered by colleges during the first week of classes — often referred to as “welcome week” — are all based on careful analysis of data provided by incoming students, current students, alumni, staff, faculty and donors alike. The CCPA provides students with the right to have this data deleted but only if the data was provided to the school by the student themselves. Likely, such data would be kept securely by a third-party information-storage system, and school officials would be wise in assessing the CCPA readiness of each of their vendors carefully.

Another issue schools must prepare to face is whether compliance with the requirements of CCPA is preempted by the requirements of federal laws, such as FERPA and the Clery Act. While the CCPA provides “residents” with the right to erasure, federal law requires for colleges and universities who receive federal financial assistance to collect, store and disclose certain data.

Hence the tension: How can for-profit schools and third-party vendors of colleges and universities who store the personal information of students comply with both statutory frameworks? The CCPA provides a general exception that the obligations imposed upon a business shall not restrict a business’s ability to “comply with federal, state, or local laws,” yet there are still questions as to what types of data may be necessary to comply with federal law and what types of data may be erased in compliance with CCPA requirements.

Schools receiving federal funding should err on the side of caution and conduct a thorough assessment of what types of data they absolutely must store, use and disclose in order to comply with federal law, while earmarking the types of personal information they or their third-party vendors may have on file that is subject to erasure and other rights provided to “residents” by the CCPA.

Photo by Vasily Koloda on Unsplash