My instructor placed grade sheets for our first two projects into a "Dropbox" file system which has absolutely no access control. So not only every student could see every other student's grades and written assessments, but anyone walking into the college library could sit down at a computer and look at our grades without having to present any kind of credentials whatsoever.

  • 1
    Two things: 1) If a student's name - is attached to a grade, then yes. If it was by student ID, perhaps not. 2) I suggest you do not talk smack about other students, saying that they are "considered too dumb to work with credentials and access controls." Commented Nov 3, 2016 at 17:52
  • Is this a college-wide approach to grading? Or just your instructor's approach?
    – tonysdg
    Commented Nov 3, 2016 at 18:05
  • I don't understand -- your instructor put the grade sheets in a public dropbox folder, that anyone with the link could access? I can see that this is not secure, but I don't understand how any Tom, Dick or Harry would find out where to look for that file, when sitting down at a computer in the college library. Did the instructor include a link to the files from his or her home page, or course webpage? Also, please clarify how the students are identified in the grade sheets. Commented Nov 4, 2016 at 3:39

1 Answer 1


FERPA prohibits public posting of grades together with students' names or social security numbers (including last 4 digits of SSN). (This prohibition includes, but is not limited to, posting grades where other students in the class can see one another's grades.)

(FERPA's treatment of student IDs depends on whether they are treated as personally identifiable information - in which case student IDs can not be disclosed in a way that allows student IDs to be matched to individual students - or whether they are treated as electronic identifiers, in which case they can be disclosed as "directory information" but may not be used to post grades. See this document for further details.)

In general, FERPA allows schools to put educational records in the "cloud", but places certain restrictions on how these records must be protected. Some "enterprise" or "education" versions of cloud services are FERPA-compliant (or can be made FERPA-compliant through special arrangement with the provider), and can be used to store educational records. A few "consumer"-grade cloud services are also FERPA compliant. Personal Dropbox accounts (not including Dropbox Business) are not, and should not be used to store FERPA-protected records, even as private Dropbox files that require authentication to view. See e.g. guidelines at UC Davis, University of Michigan, University of Oregon, University of Utah.

  • Since the OP's case is not final grades, just grades for 2 projects (out of many, presumably), is this necessarily a FERPA violation? The students' final grades can't necessarily be inferred from the posted grades of the first 2 projects. (Regardless, I agree that this was a bad move on the professor's part.)
    – rturnbull
    Commented Nov 3, 2016 at 20:29
  • 1
    @rturnbull FERPA prohibits the disclosure of "personally identifiable information from education records". All grades, test scores, project scores, etc. that are recorded by the instructor are considered education records, not only final grades.
    – ff524
    Commented Nov 3, 2016 at 21:39
  • Ah, thanks for the clarification. I'm a little rusty on the law (I live in Europe).
    – rturnbull
    Commented Nov 3, 2016 at 22:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .