You will be provided with a reference and some statements. Please determine whether each statement is 'supported', 'unsupported', or 'unknown' with respect to the reference. Please note:
First, assess whether the reference contains any valid content. If the reference contains no valid information, such as a 'page not found' message, then all statements should be considered 'unknown'.
If the reference is valid, for a given statement: if the facts or data it contains can be found entirely or partially within the reference, it is considered 'supported' (data accepts rounding); if all facts and data in the statement cannot be found in the reference, it is considered 'unsupported'.

You should return the result in a JSON list format, where each item in the list contains the statement's index and the judgment result, for example:
[
    {
        "idx": 1,
        "result": "supported"
    },
    {
        "idx": 2,
        "result": "unsupported"
    }
]

Below are the reference and statements:
<reference>
Student Data Privacy Governance: The Ultimate Guide to FERPA & GDPR Compliance | Secure Privacy Blog

This guide addresses how educational institutions can operationalize student data privacy across FERPA and GDPR requirements through governance frameworks that scale, adapt to regulatory change, and build stakeholder trust.

Skip to main content
Consent Solution
Cookie Banners
Preference Center
Cookie Scanner
Consent Logging
Consent Hub
Privacy Templates
Privacy Governance
DSAR Management
Risk Management
Vendor Management
DPIA & Impact Assessment
Process Register
Systems Management
Task Management
Portfolio Management
AI Governance
Policy Management
Reporting
Regulations
Europe
GDPR (EU)
UK DPA (United Kingdom)
FADP (Switzerland)
DPA (Norway)
ZZPL (Serbia)
ZZLP (North Macedonia)
LPDP (Belarus)
FLDP (Russia)
ePrivacy Directive (EU)
North America
PIPEDA (Canada)
CCPA/CPRA (California)
CPA (Colorado)
VCDPA (Virginia)
CTDPA (Connecticut)
PIPA (Quebec)
UCPA (Utah)
TDPSA (Texas)
DPDPA (Delaware)
MTCDPA (Montana)
TIPA (Tennessee)
ICDPA (Iowa)
INCDPA (Indiana)
KCDPA (Kentucky)
NDPA (Nebraska)
NJDPA (New Jersey)
NHPA (New Hampshire)
OCPA (Oregon)
MNCDPA (Minnesota)
MODPA (Maryland)
Middle East
PDPL (UAE)
DIFC DPA (Dubai)
PDPL (Saudi Arabia)
KVKK (Turkey)
PPL (Israel)
PDPL (Oman)
Asia
PIPA (South Korea)
PIPL (China)
Data Privacy Act 2012 (Philippines)
PDPA (Singapore)
PDPA (Vietnam)
PDPA (Thailand)
DPDPA (India)
PDPA (Malaysia)
PDPO (Hong Kong)
APPI (Japan)
PDP Law (Indonesia)
Central and South America
LGPD (Brazil)
DPL (Colombia)
Personal Data Protection Law (Argentina)
LSPDP (Panama)
Personal Data Protection Law (Mexico)
Africa
POPIA (South Africa)
Law no.09-08 (Morocco)
LPDP (Egypt)
DPA (Kenya)
Oceania
APP (Australia)
Privacy Act (New Zealand)
View All Regulations
Integrations
Adobe Launch
Adobe Tag Manager
BigCommerce
Drupal
Google Consent Mode
Google Tag Manager
HubSpot
IAB TCF 2.3
Joomla
Magento
Shopify
Sitecore
Squarespace
Tealium iQ
Umbraco
Vue.js
WebView
Weebly
Wix
WordPress
Pricing
Partners
Consultants
Technology Partners
Agencies
Blog
Cookie Scanner
Contact Us
ROI Calculator
Privacy Assessment
GDPR Checklist
CCPA Checklist
Sign Up
Login
Secure
Privacy
Solutions
Regulations
Integrations
Pricing
Partners
Resources
Sign Up
Login
Home
Blog
Student Data Privacy Governance: The Ultimate Guide to FERPA & GDPR Compliance
Back to Blog
Legal & News
Data Protection
GDPR
CCPA
Student Data Privacy Governance:
The Ultimate Guide to FERPA & GDPR Compliance
This guide addresses how educational institutions can operationalize student data privacy across FERPA and GDPR requirements through governance frameworks that scale, adapt to regulatory change, and build stakeholder trust.
Secure Privacy Team
Privacy Experts
January 12, 2026
·
15 min read
Share:
Secure Privacy
Enterprise-grade privacy compliance for 55+ global laws.
support@secureprivacy.ai
Frydenlundsvej 30, 2950 Vedbæk, Denmark
Schedule Demo
Consent Solutions
Consent Solution
Cookie Banners
Preference Center
Cookie Scanner
Consent Logging
Consent Hub
Privacy Template
Privacy Governance
Privacy Governance
DSAR Management
Risk Management
Vendor Management
DPIA & Impact Assessment
Portfolio Management
Task Management
Systems Management
Process Register
Reporting
Policy Management
AI Governance
Compliance
GDPR (EU)
UK DPA
CCPA
PIPEDA
LGPD
PDPA
View All 55+ Laws
Legal
Privacy Policy
Cookie Declaration
Terms of Service
Website Terms Of Use
Subprocessors
Acceptable Use Policy
SOC2
Integrations
Adobe Launch
Adobe Tag Manager
BigCommerce
Drupal
Google Consent Mode
View All 18+
Company
Pricing
Blog
Docs
Contact
Support
Sign in
Request Demo
Partners
Status
Changelog
© 2026 Secure Privacy. All rights reserved.
Secure Privacy ApS
Share this article
Educational institutions manage unprecedented volumes of student data across interconnected systems: learning management platforms, student information systems, behavioral analytics, biometric access controls, and networks of third-party EdTech vendors. This operational complexity has transformed student data privacy from a compliance checkbox into a governance imperative requiring systematic oversight, not episodic attention.
Why Student Data Privacy Requires a Governance Approach
Compliance checklists fail in education because they address privacy as a one-time project rather than an ongoing operational function. An institution might complete a FERPA assessment, remediate identified gaps, and consider itself compliant — until a vendor changes data handling practices, a teacher adopts an unapproved EdTech tool, or a state enacts new privacy requirements. Without governance structures to monitor these changes, compliance erodes.
Student data carries unique sensitivity. Education records document academic performance, disciplinary incidents, special education needs, health conditions, and family circumstances; information that shapes opportunities and follows students throughout their lives. Regulatory fragmentation compounds the challenge: US institutions operate under FERPA, state data breach laws, and increasingly, state-specific student privacy statutes, while institutions serving international students must simultaneously comply with GDPR.
Governance differs from compliance projects in three ways: it's permanent institutional infrastructure rather than temporary projects; it addresses the full data lifecycle across all organizational units rather than focusing narrowly on specific systems; and it creates accountability: when vendor incidents occur, governance structures clarify who investigates, notifies affected individuals, and implements corrective measures.
What Counts as Student Data Under FERPA and GDPR
FERPA's Definition of Education Records and Personally Identifiable Information
Under FERPA, education records are documents that directly relate to a student and are maintained by an educational institution or party acting on its behalf. This encompasses transcripts, grades, disciplinary records, health information, financial data, special education evaluations, and behavioral intervention plans.
FERPA's concept of personally identifiable information is deliberately expansive, including both direct identifiers (student name, Social Security number, student ID) and indirect identifiers that could identify a student when combined with other information (date of birth, place of birth, mother's maiden name). Modern identification mechanisms create new considerations: biometric records such as fingerprints for meal payments, facial recognition for attendance, and retina scans for building access constitute personally identifiable information under FERPA.
GDPR's Approach to Student Personal Data and Special Categories
GDPR defines personal data broadly to include names, contact information, student identification numbers, grades, attendance records, and behavioral observations. GDPR introduces a critical distinction absent from FERPA: special category data requiring heightened protection. This includes health information, racial or ethnic origin, religious beliefs, genetic data, biometric data, and in educational contexts, safeguarding concerns, special educational needs documentation, and information about children in care.
This distinction matters operationally: standard personal data requires a lawful basis for processing, while special category data requires both a lawful basis and an additional condition (typically explicit consent, legal obligation, or public interest). Many schools collect special category data unnecessarily at pre-enrollment when basic information would suffice. The principle: collect only what is necessary for the specific stated purpose.
Contemporary Student Data Sources
Educational institutions collect student data across platforms creating fragmented landscapes:
Learning Management Systems
: Coursework, discussion posts, time-spent-on-task, performance data
Student Information Systems
: Enrollment, grades, attendance, disciplinary records, contact information
EdTech vendor tools
: Assessment platforms, proctoring systems, tutoring applications
Analytics platforms
: Learning analytics, predictive intervention systems, behavioral tracking
Biometric systems
: Fingerprint scanning, facial recognition, iris scanning for access control
Data warehouses
: Aggregated student data consolidated from multiple sources
Institutions often discover through governance work that they have more data sources than recognized, with shadow IT creating ungoverned data relationships that surface only when incidents occur.
FERPA: Governance-Relevant Requirements
Consent Requirements and Key Exceptions
The foundational FERPA principle: institutions must obtain signed, dated written consent from parents or eligible students before disclosing personally identifiable information from education records. However, FERPA includes significant exceptions:
The
school official exception
permits internal staff and contractors performing institutional services to access education records without separate consent if designated as "school officials" with legitimate educational interest in the institution's annual FERPA notification. This exception covers third-party vendors, but only when specific conditions are met.
The
directory information exception
allows schools to designate certain categories (name, address, phone, email, grade level, sports participation, honors) as directory information and disclose without consent, provided schools notify parents and permit opt-outs. Mismanagement of opt-outs constitutes a common FERPA violation.
Other exceptions include transfers to schools where students enroll, disclosures to financial aid officials, health or safety emergencies, organizations conducting studies on behalf of the school, and responses to judicial orders.
Vendor Management and the School Official Exception
FERPA's vendor provisions create a critical governance principle: schools remain liable for vendor compliance. When third-party vendors access education records, they function as "school officials" subject to the same restrictions as internal staff.
For vendors to lawfully receive personally identifiable information under the school official exception, four conditions must be satisfied: the vendor must perform an institutional service or function; the vendor must meet criteria designated in annual FERPA notification as a "school official with legitimate educational interest"; the vendor must be under the school's direct control regarding data use and maintenance; and the vendor must use education records only for authorized purposes without redisclosure.
Essential vendor contract provisions include data security measures (encryption, access controls), breach notification requirements, data retention and secure disposal procedures, subcontractor compliance provisions, prohibition on data mining and commercial use, and audit rights allowing schools to verify vendor practices.
Learn more:
Secure Privacy's guide to vendor privacy agreement tracking
provides detailed templates and monitoring frameworks specifically designed for managing FERPA-compliant contracts across educational technology ecosystems.
Enforcement and Recent Guidance
FERPA enforcement occurs through the Family Policy Compliance Office, which investigates complaints filed within 180 days. Penalties vary by violation severity: unauthorized disclosure typically results in $15,000–$75,000 fines; directory information misuse $8,000–$35,000; denial of access rights $12,000–$45,000. Beyond fines, consequences include federal funding reviews, mandatory training, third-party audits, and potential withholding of federal funding for persistent noncompliance.
In March 2025, the Department of Education issued significant guidance clarifying that gender support plans constitute education records regardless of where maintained; schools cannot withhold student safety information from parents under FERPA; records relating to multiple students cannot be withheld based on another student's information unless redaction would destroy meaning; and annual FERPA notification must reach parents through reasonably accessible means.
GDPR: Education-Specific Obligations
Lawful Bases for Processing Student Data
Unlike FERPA's default consent requirement, GDPR requires institutions to establish a lawful basis for each processing activity before collecting data. Educational institutions typically rely on different bases for different activities:
Public task
serves as the primary basis for public schools. Teaching, student assessment, examination administration, and safeguarding constitute tasks carried out in the public interest with statutory foundations. This basis does not require consent and appropriately covers core educational functions including digital tools directly supporting teaching.
Legal obligation
applies when processing is required by law — reporting attendance to authorities, providing mandated special needs support, making safeguarding referrals.
Consent
functions differently under GDPR than FERPA. GDPR requires consent be freely given, specific, informed, and unambiguous. Schools should use consent sparingly, never for core educational functions. The Data Use and Access Act 2025 cautions against "coerced consent" in service delivery. Consent appropriately applies to genuinely optional features: behavioral analytics for personalized recommendations, optional communications, photography for yearbooks, research participation.
For minors, GDPR generally requires parental consent when relying on consent as the lawful basis, with member states setting age thresholds (typically sixteen, ranging from thirteen to eighteen).
Student Rights and Institutional Response Procedures
GDPR grants eight distinct rights creating operational requirements:
Right to be informed
requires clear privacy notices at data collection explaining what data is collected, why, who accesses it, retention periods, and how to exercise rights.
Right of access
entitles students to request personal data. Institutions must respond within one month (possible two-month extension), providing data copies in commonly used formats.
Right to rectification
allows correcting inaccurate data. Institutions must establish clear channels for requesting corrections.
Right to erasure
permits deletion requests, though institutions can refuse when retention is necessary for legal obligations, archiving in public interest, or defending claims.
Right to restrict processing
enables limiting data use while disputes are resolved, requiring system-level controls flagging records under dispute.
Right to data portability
requires providing personal data in machine-readable formats for transfer to other controllers.
Right to object
permits opting out of processing based on legitimate interests or direct marketing.
Rights related to automated decision-making
require human review of decisions based solely on automated processing with significant effects—applicable to predictive intervention systems, algorithmic flagging, or automated course placement.
Breach Notification Requirements
GDPR requires institutions to notify the relevant Data Protection Authority within seventy-two hours of becoming aware of a breach. Notification to affected data subjects is required without undue delay when breaches pose high risk to rights and freedoms—typically breaches involving special category data, financial information, or widespread compromise.
FERPA does not mandate breach notification to families, requiring only that unauthorized disclosures be recorded for discovery when records are inspected. However, nearly all US states have adopted breach notification laws requiring schools to notify affected families within specific timeframes, typically thirty to sixty days.
Learn more:
Secure Privacy's automated DPIA tool guide
explains how to systematically assess privacy risks before implementing high-risk technologies including AI systems, biometric systems, and student monitoring platforms.
FERPA vs. GDPR: Operational Differences That Matter
The frameworks differ fundamentally: FERPA operates through a consent-based model while GDPR uses a lawful basis model where consent is one of six options. Access rights differ in timelines: FERPA allows forty-five days; GDPR mandates one month with possible two-month extension.
Vendor responsibility differs structurally. Under FERPA, schools remain fully liable with vendors functioning as school officials. Under GDPR, responsibility is shared between controllers (schools) and processors (vendors).
Documentation requirements diverge significantly. FERPA requires annual notification, access request logs, and breach records. GDPR requires comprehensive Records of Processing Activities, Data Protection Impact Assessments for high-risk processing, Data Processing Agreements with all vendors, and detailed audit trails.
International data transfer represents a major difference. FERPA imposes no restrictions on international transfers. GDPR severely restricts transfers to countries lacking adequacy decisions, currently limited to EU/EEA countries, those with formal adequacy decisions, and transfers under approved mechanisms like Standard Contractual Clauses.
Enforcement structures differ substantially. FERPA operates through complaint-based investigation with corrective action orders. GDPR enforcement operates through national Data Protection Authorities with power to impose fines up to twenty million euros or four percent of annual global turnover.
Institutions serving both US and EU students should default to stricter standards, establish separate documentation for FERPA consent and GDPR lawful basis determinations, implement the more stringent one-month access timeline universally, and build vendor agreements addressing both FERPA school official requirements and GDPR processor obligations.
Building a Student Data Privacy Governance Framework
Governance as Permanent Infrastructure
Governance represents permanent institutional infrastructure operating continuously, unlike episodic compliance projects.
Read Secure Privacy's comprehensive guide to building a privacy governance framework
to understand how organizations move from compliance checklists to strategic governance programs.
Governance structures typically organize around three levels:
Executive leadership
establishes institutional vision, approves major policy decisions, allocates resources, and ensures governance has enforcement authority. This typically involves a Chief Privacy Officer or designated senior administrator.
Committee structures
bring together cross-functional representatives from legal, IT, academic affairs, student services, and compliance. Governance committees meet regularly—typically quarterly—to review compliance issues, approve new initiatives, assess vendor risks, and update policies.
Data steward roles
assign operational responsibility to individuals managing specific systems. Stewards implement governance decisions, respond to routine requests, and escalate issues to committees when necessary.
Core Governance Components
Educational governance should encompass systematic components:
Mission and vision
articulate institutional commitments to data stewardship and responsible data use.
Goals and metrics
define what governance aims to achieve and how performance is tracked.
Data definitions and standards
establish common terminology and technical requirements.
Decision-making authority
clarifies who decides what regarding student data.
Responsibilities and enforcement
specify obligations and consequences for noncompliance.
Data inventories
document all systems, data elements, processing activities, and vendor relationships.
Access controls
restrict data access based on roles.
Security controls
encompass technical, physical, and administrative safeguards.
Monitoring and auditing
provide ongoing compliance visibility.
Incident response procedures
establish clear processes for detecting, investigating, containing, and remediating incidents.
Data Inventorying and Records of Processing Activities
The foundational governance artifact is a comprehensive inventory of processing activities. Under GDPR, this is formalized as a Record of Processing Activities documenting: processing activity names, legal bases, data categories, purposes, retention periods, recipients (internal and external), security measures, data subject rights procedures, and Data Protection Impact Assessments for high-risk processing.
The Record of Processing Activities serves multiple functions: demonstrating regulatory compliance, identifying privacy risks, enabling data subject rights fulfillment, supporting incident response by clarifying data flows, and facilitating vendor oversight.
Learn more:
Secure Privacy's automated RoPA solution for schools
shows how to replace manual spreadsheet-based inventories with continuously updated, audit-ready documentation that provides real-time visibility into student data processing activities.
Vendor Risk Management as Governance Priority
Vendor oversight represents governance's most consequential activity because vendors hold student data beyond direct institutional control, yet schools remain liable under both FERPA and GDPR.
Comprehensive vendor inventories
should document all data relationships including formal contracts and informal tool usage. Track contract status, security certifications (SOC 2, ISO 27001), and incident history.
Vendor evaluation and onboarding
should systematically assess practices before contracts are executed through standardized questionnaires covering data handling, security controls, training programs, and incident response. Negotiate Data Processing Agreements clearly defining roles, obligations, security requirements, breach notification, and audit rights. For FERPA, vendors should sign acknowledgments confirming understanding of requirements and agreeing to operate as school officials.
Ongoing vendor monitoring
should include annual compliance reassessments, periodic review of data access logs, security incident tracking, and contract renewal assessments.
Common Governance Failures
Inadequate vendor vetting
occurs when schools deploy tools without privacy and security assessment. Prevention requires clear policies prohibiting unapproved deployments and systematic evaluation processes.
Unmanaged vendor ecosystems
develop when institutions lack comprehensive inventories. Prevention requires centralized vendor registries, regular technology audits, and data discovery tools.
Improper data sharing restrictions
occur when vendors receive data without adequate contractual restrictions on use. Prevention requires standardized contract provisions explicitly limiting data use to educational purposes.
Access request failures
represent visible violations frequently triggering complaints. Prevention requires designated trained staff, tracking systems monitoring timelines, documented search protocols, and quality assurance reviews.
Insufficient training
leaves staff without understanding of requirements. Prevention requires annual privacy training, role-specific training for elevated access, and new hire orientation.
Retention policy failures
occur when institutions retain data indefinitely. Prevention requires documented retention schedules, automated enforcement where feasible, and periodic disposal audits.
Technology Enabling Governance at Scale
Specialized privacy management platforms help institutions manage compliance systematically through automated Data Protection Impact Assessments, Records of Processing Activities automation discovering processing activities by integrating with institutional systems, vendor management centralizing compliance tracking, consent management supporting multi-jurisdictional requirements, data subject request automation streamlining FERPA and GDPR request handling, and audit-ready reporting generating compliance dashboards.
Learn more:
Secure Privacy's comprehensive guide to school data governance software
covers vendor management, multi-entity oversight, data retention workflows, and compliance automation specific to K–12 district requirements.
Emerging Challenges
AI and algorithmic decision-making
present governance challenges requiring Data Protection Impact Assessments before implementing high-risk processing, transparency about algorithmic mechanisms, bias testing requirements, and human oversight of recommendations.
Cross-border data transfers
under GDPR require institutions to audit transfer mechanisms, review where vendors actually store and process data, conduct transfer impact assessments, and consider EU-only vendors if transfer mechanisms are inadequate.
State privacy laws
including Virginia VOPA, California CCPA, and Colorado CPA introduce consumer privacy requirements intersecting with FERPA. Institutions must monitor state law developments and align governance across FERPA, GDPR, and state requirements.
Conclusion: From Compliance to Trust
Student data privacy governance has evolved from legal compliance into strategic institutional infrastructure. Effective governance requires moving beyond episodic compliance to systematic management spanning the full data lifecycle.
The foundation is clarity about what constitutes protected data and establishing documented legal bases for processing. Institutions must systematically map data flows, implement vendor oversight mechanisms, document policies governing all aspects of data handling, and monitor ongoing compliance.
For institutions serving both US and international students, governance must address FERPA and GDPR intersections while recognizing frameworks differ substantially. Defaulting to stricter standards — implementing GDPR's more demanding requirements universally — provides practical compliance while reducing operational complexity.
Technology enables governance at scale through automated discovery, systematic vendor management, streamlined request handling, and comprehensive documentation. However, technology enables but doesn't replace governance: institutions still require governance committees, clearly assigned stewards, documented policies, and regular monitoring.
Institutions building robust governance foundations adapt more readily to regulatory changes, respond more effectively to incidents, and build stakeholder trust that student data receives appropriate protection. The ultimate measure of governance success is demonstration of systematic commitment: policies reflect best practices, staff understand responsibilities, vendors are accountable, incidents are handled transparently, and governance adapts as technology and regulation evolve.
Tagged in:
Legal & News
Data Protection
GDPR
CCPA
Published on

January 12, 2026
RELATED CONTENT

Continue Reading
Explore more privacy compliance insights and best practices
Data Protection
Consent Mode Conversion Loss: Why Tracking Breaks and How to Recover Attribution
A Google Ads account loses 90% of its measured conversions overnight. Campaigns are active. Clicks are arriving. The budget is spending. Nothing in the account structure changed. The root cause, discovered two days and significant diagnostic effort later: the consent banner was collecting user preferences correctly but never transmitting those preferences as Consent Mode signals to Google's tag infrastructure. Every EU user who accepted tracking was being processed as non-consenting by Google's systems. Forty percent of the attribution data was eventually recovered through behavioral modeling. The remaining 60% was gone permanently.
May 11, 2026
17 min read
Read
Legal & News
What Happens When Your Cookie Consent Tool Hits Its Limit?
Your campaign went live on a Tuesday. By Thursday, traffic was up 340% from the paid push. By Friday, your analytics team noticed something strange: consent log entries had stopped updating mid-Wednesday. The cookie banner was still appearing. Users were still clicking. But the CMP had quietly hit its monthly consent limit — and when it did, it stopped recording anything. Every interaction from Wednesday onward existed in a legal void: banners shown, choices made, nothing logged.
Apr 23, 2026
12 min read
Read
Legal & News
Consent Propagation Delay: Why Consent Isn't Syncing Across CMP, GA4 & Google Ads
Your Google Ads conversion tracking dropped 90% overnight. Nothing changed in the campaign. No budget edits, no paused ads, no structural changes. You spent two days in the account diagnosing before finding the real cause: your consent banner was collecting user choices correctly, displaying them to users, and recording them in your CMP audit log — but never transmitting those choices as Consent Mode signals to Google's tag infrastructure. Every EU user who accepted tracking was being treated as a non-consenting user by Google's systems. The data was gone permanently.
Feb 13, 2026
18 min read
Read
View All Articles
Newsletter
Stay Ahead of

Privacy Compliance
Get exclusive insights on privacy laws, compliance strategies, and product updates delivered to your inbox
Email address
Subscribe
By subscribing you agree to our

Privacy Policy
. Unsubscribe anytime.
Table of Contents
1
.
Why Student Data Privacy Requires a Governance Approach
2
.
What Counts as Student Data Under FERPA and GDPR
3
.
FERPA: Governance-Relevant Requirements
4
.
GDPR: Education-Specific Obligations
5
.
FERPA vs. GDPR: Operational Differences That Matter
6
.
Building a Student Data Privacy Governance Framework
7
.
Common Governance Failures
8
.
Technology Enabling Governance at Scale
9
.
Emerging Challenges
10
.
Conclusion: From Compliance to Trust
Share:
Stay Ahead of Privacy Compliance
Email
Subscribe
By subscribing you agree to our

Privacy Policy
. Unsubscribe anytime.
Stay Ahead of Privacy Compliance
Email
Subscribe
By subscribing you agree to our

Privacy Policy
. Unsubscribe anytime.
Share:
</reference>

<statements>
1. Continuous biometric/video capture of (often minor) learners triggers GDPR special-category protections, FERPA PII rules, and likely EU AI Act "high-risk" classification; teacher–AI collaboration frameworks remain underdeveloped.
2. Biometric records (facial, gait, physiological) are "special category data" under GDPR and PII under FERPA; the EU AI Act may classify educational AI as "high-risk."
</statements>

Begin the assessment now. Output only the JSON list, without any conversational text or explanations.