NOTE: This guide about protecting student privacy in information technology (IT) systems is for informational purposes only and is not intended as legal advice. If you have questions, please contact the University of Maryland (UMD) Office of General Counsel.
ELMS-Canvas, Panopto, Zoom, Google Hangouts/Chat. Access a comprehensive list of teaching and learning systems and services offered by DIT.
Generally, no. You should treat your online synchronous classes (and other activities) similarly to your face-to-face classes (and other activities). If you were not routinely recording your face-to-face classes, there is probably no reason to routinely record your online synchronous classes or meetings. You may always record your own lecture (without student participation) and post it in a UMD-approved instructional technology system (ex., Panopto, ELMS-Canvas, Google Drive, Box) so that students can access the recording asynchronously.
If a student has an accommodation that can be met via recording online synchronous classes (and other activities), then you may need to record the class (or other activity).
If you record an instructional activity, you must obtain the consent of anyone whose voice, likeness, or other personally identifiable information could be recorded. If you intend to use the recording outside of the class for which it was originally recorded, you will also need to obtain FERPA consent from all student participants. Consents to be recorded are separate and distinct from FERPA consents.
Remember that names and/or IDs are typically listed as part of a participant's image and are visible in the recording, creating a risk of disclosing personally identifiable information if the recording is shared by a participant.
If a recording includes only the instructor's voice, image, and/or other personally identifiable information, the recording is not a student record and FERPA does not limit its use. If the recording includes students asking questions, making presentations or leading a class (other than teaching assistants), and/or it is possible to identify students, then the portions containing recordings of the students do constitute protected educational records. Educational records can only be used as permitted by FERPA or set forth in a written consent signed by the student.
Yes, but only if access is limited to other students in the same course. In that case, FERPA does not require student written consent. This allows instructors to create access for students in the course to watch or rewatch past sessions.
No, instructors may not share or otherwise allow access to recorded instructional materials that include students' images, voices or other personally identifiable information without obtaining a FERPA consent from every student.
In order to share materials that include students' images, voices, personally identifiable information or other educational records, the instructor must obtain a written FERPA consent from each student who can be seen or heard in the recording or whose other educational records will be released. A form template is available to download: FERPA Informed Consent and Authorization to Disclose Educational Records.
Recordings can be edited to omit any student who has not consented to the use of their voice or image or to de-identify the student in the recording (which can include avoiding or removing any mention of the student's name, blurring the student's image, altering voice recordings, etc.).
Instructors can also plan recordings so that students (such as those asking questions during a class) are not shown in the video or referred to by name (another way to de-identify the student).
If access is limited to students enrolled in the same class, FERPA does not limit or prevent its use and does not require obtaining a written consent. This allows instructors to create access for students in the class to watch or rewatch past sessions.
If access will not be limited to students in the class, plan the recordings accordingly. Make sure not to show students who are asking questions and don't refer to the students by name. Avoid repeating the student's name in the recording (de-identifying the students removes the need for a specific consent from each student depicted). If a student happens to appear on camera, their identity can be edited out if you cannot obtain the student's written consent.
Because student presentations make it more difficult to de-identify the student, the instructor should obtain a FERPA consent from the student making a presentation that will be recorded. The instructor should also obtain a FERPA consent for any video projects, such as student-made films.
Under FERPA, this situation must be treated as if the recordings were being shown to a third-party audience. In order to show recordings made in prior semesters, you must obtain a FERPA consent from any students depicted or de-identify any students depicted.
Any use of recordings must comply with FERPA, either through written consents or de-identification of students depicted.
Students cannot be compelled or required to give consent to keep their camera/microphone on, to be recorded or to authorize the disclosure of FERPA-protected student information.
For FERPA purposes, if a student refuses to consent to FERPA disclosures, the instructor may continue to use the recording outside of class as long as the instructor edits the student out of the recording or de-identifies the student records.
For purposes of Maryland's all-party consent law, if a student refuses to consent to be recorded, the instructor must ensure that the student turns off their camera and microphone and participates in the course by using the private text chat tool.
UMD has negotiated appropriate contract language in the institutional versions of these systems, including FERPA compliance and firm restrictions on how companies are able to use UMD data (including student data). To protect student information, UMD requires CAS login and multi-factor authentication (via Duo) for instructional technology systems. Logging in using institutional emails through a general public website, Facebook or any other social media application is not recommended nor necessary.
No. Students must be able to withdraw consent at any time, so express written consent should be obtained at the class level by the instructor. Additionally, there may be legal and contractual constraints on UMD's ability to require blanket consent from students at this point in the semester. Faculty may use the consent form attached to this article to obtain consent from students or they may rely on implied consent.
When recording is necessary, students and all other participants must be made aware at the beginning of the session that video and/or audio are being recorded; this notice is required by Maryland law. Here is an example that can be used at the start of the session: "This class session is being recorded. By joining today's class session, you consent to being recorded." You may also include this statement on your first lecture slide.
Several of these systems have an automated warning sign, such as a flashing red indicator. For these systems, if an indicator is not visible, it is unlikely that the activity is being monitored or recorded during that time. Please be aware that, regardless of UMD's guidance, a student or other participant could be using local/personal technology to capture what is being presented without warning the instructor, meeting host, or other participants. This is similar when a student is surreptitiously recording a classroom activity.
As a measure of extra caution, in addition to the legally required statement that the activity is being recorded, the instructor should send an email to students/participants in advance and also state, at the beginning of the session, that the video and/or audio recording is, or will be, used for educational purposes and may be made available to all students presently enrolled in the class. Here is an example that can be used:
"Our class sessions will all be recorded for use by enrolled students, including those who are unable to attend live. Students who participate with their camera engaged or utilize a profile image are consenting to have their video or image recorded. If you are unwilling to consent to have your profile or video image recorded, be sure to keep your camera off and do not use a profile image. Likewise, students who unmute during class and participate orally are consenting to have their voices recorded. If you are not willing to consent to have your voice recorded during class, you will need to keep your mute button activated and communicate exclusively using the chat feature, which allows students to type questions and comments live."
If you intend to use the recording in future class sessions and lectures, you should disclose this fact to students and participants and inform them that any type of personally-identifying information will be adequately removed from the videos (and then you must actually remove this information).
Use Zoom settings to disable downloads of recordings and manage other recording settings.
If recordings are necessary for a specific purpose such as turning in an assignment, remember that recordings of students become student education records under FERPA. Save them using a UMD-approved method and only share them with UMD personnel with legitimate educational interest to the records. Instructors must ensure that they are using their UMD email/login account and not a personal or another organizational account.
Because the settings options on Google Hangouts/Meet are limited, UMD recommends that you avoid using these two systems if you plan to transmit information that is protected by FERPA.
Do not require your students to be identified on social media in order to participate in a class or submit assignments (e.g., sharing a Tweet or a public Facebook post).
Do not hold meetings with your students on other technologies such as FaceTime or Skype; rely on our UMD-approved communication and collaboration options in order to ensure access for students and data privacy.
Yes, and it helps to protect your privacy in many ways. Students and instructors are strongly encouraged to research and consider basic recommendations related to video-chat etiquette. Here is an example of Video Meeting Etiquette by Zoom.
Remind your students that Student Conduct Expectations are the same online as in person. Faculty, staff, and students should be aware that they are subject to the following UMD policies even in an online environment:
Whether in person or in virtual and digital settings, students, faculty and staff are prohibited from harassing, defaming or targeting others based on their protected status. Misconduct that violates UMD policies may result in disciplinary action regardless of whether it occurs online or in person. Members of the UMD community are encouraged to report violations by using the links below:
Whenever possible, please contact students within the ELMS-Canvas communication tool. Instructors MUST use their umd.edu email addresses. Students may choose to forward their terpmail.umd.edu email to a different email address of their preference.
When emailing groups of students, use the Bcc line for all student email addresses. This will work for a single class of students or other groups of students. Not all students' email addresses are public. If instructors wish to email students outside ELMS-Canvas please consult our instructions on Create and Manage Coursemail Lists With ELMS Management Tools.
Calendar invites to your class (e.g., to share a Zoom link) should be marked "private" so that your class list is not disclosed via people's calendars.
Departments are rapidly adopting new technology to make our unique circumstances work. Be sure not to skip important processes before implementing something new, as now more than ever we need to protect our student's data and comply with data privacy laws. If you are purchasing or downloading new software and apps:
You should not accept "click-through" agreements to download software and apps; instead work with Procurement to obtain appropriate contract terms, even for free software/apps.
You should not need to provide direct payment to access or use any of the systems used by UMD instructors for teaching and learning purposes. No third-party tool that is integrated within ELMS-Canvas is authorized to process any kind of payment card (PCI) transaction on behalf of UMD. Please be aware, UMD has not reviewed and does not endorse the individual purchase or usage of apps nor are purchased apps required to make full use of any application through UMD's ELMS-Canvas contract. UMD has approved and integrated enterprise apps such as Google Calendar and Zoom into ELMS-Canvas to securely extend the functionality of some of these systems. UMD's information security team reviews all such integrations before implementation. If a user chooses to purchase an app, they do so of their own volition and outside of the terms and conditions of UMD's contract.
The U.S. Department of Education has comprehensive FAQs on photos and videos under FERPA.
More detailed information about FERPA at UMD is available from the Office of the Registrar.
The UMD FERPA Tutorial is designed to give you basic knowledge of the rules governing the release of student information. The tutorial takes approximately ten minutes to complete.