DEF CON 33 - Third Party Access Granted : Postmortem on Student Privacy - Sharlene Toney
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 36:07
Student data flows from universities to the National Student Clearing House (a nonprofit data broker) and then to commercial data brokers like Equifax with limited student consent 0:23-0:36.
Key Takeaways:
• FERPA amendments in 2008 and 2011 expanded entities that can access student data without explicit consent 1:54-2:24
• The National Student Clearing House holds data on 97% of US college students and makes $65 million annually selling student data 7:16-7:47
• Through an exclusive partnership, student data is shared with Equifax for "Talent Report Education" products sold to employers and background screeners 16:04-17:40
• Students face barriers accessing and correcting their data, which can impact financial aid eligibility and loan costs 19:34-21:06
Students have limited recourse as nonprofit data brokers fall through regulatory loopholes and lack meaningful consent mechanisms 24:44-25:03.
Sources:
- 0:23-0:36 Overview of student data flow from universities to data brokers
- 1:54-2:24 FERPA amendments that expanded student data access
- 7:16-7:47 National Student Clearing House data coverage and revenue
- 16:04-17:40 Partnership with Equifax for talent reports
- 19:34-21:06 Challenges with data access and correction
- 24:44-25:03 Regulatory loopholes and lack of student recourse
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Compliance & GRC. Commonly maps to: Security and Risk Management, Asset Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello. I'm thrilled to see all of you here. Um, I'm gonna pick this up. Um, before we get started, my name is Charlene Tony and I'm curious how many students we have here right now. Current university students. We've got one there. Any parents with current university students? Okay, awesome. So, what we're going to talk about today is we're going to take a look at how student data is moving from colleges and universities to one particular nonprofit data broker, then on to a commercial data broker and one of the largest commercial data brokers in the United States. So, that is the plan. Um, I feel very sad that you cannot see my slides, but I do have a few notes on here. So, just to tell you a little bit about myself, I've been working in higher education. My 20-y year anniversary was just …