RE: field level security - (Was Use of a trigger...? ....)

["Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>]

I did a little research, Martin.  From my understanding, FERPA does two
things.  First, it allows parents to request that "directory" information
(name, address, phone number) not be disclosed.  For example, a parent can
choose that their child not be listed in a student directory.  This is the
issue that you are running up against.  More interesting to me, at least
from a social sense, is that FERPA actually weakens privacy by requiring
that any student information to be made available to "appropriate agencies"
regardless of the consent of the parent.  I think this is a reaction to the
wave of school violence, making student records available to law enforcement
agencies.

In any event, FERPA is primarily a school issue, and probably doesn't
impinge as much on anybody else.  At the same time, the concept of
information privacy is a vast one, and the idea of requiring user security
for data access on a row and column basis makes unfettered ODBC access even
scarier.

But that's just me on another one of my ODBC bashing jaunts <grin>.

Joe


> From: Booth Martin
>
> [ Picked text/plain from multipart/alternative ]
> I am anticipating that the business rules I will be handed will include:
> warn a user that the information for this individual is restricted and can
> not be furnished outside of the organization;  print a warning on
> amy report
> including a FERPA individual, and more besides.
>
> It really is becoming a difficult issue everywhere in the organization.
> More of you folks must be getting this issue raised in your organizations,
> aren't you?