This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 Privacy, Ethics, and Institutional Research Alan Rubel, University of Wisconsin-Madison Introduction There is an evergreen conflict between data collection, analysis, and use and privacy. The contours of the conflict change as technologies develop and as our understanding of the meaning and value of information and privacy evolve. Much of the social concern about data analytics focuses on law enforcement and security (for example, the NSA bulk metadata collection program, watch lists, and risk analysis algorithms) and on large internet and social media corporations (Facebook, Google, Amazon, among others). Higher education analytics and institutional research pales in comparison to the scope of social media, and higher education institutions wield little power over individuals compared to the NSA or the FBI. Nonetheless, institutional research affects people's privacy, and much of the information collected by higher education institutions is highly sensitive. The importance of education privacy (by which I mean privacy regarding information about persons' educational records, information about persons' interactions with educational institutions, and information collected or accessed by educational institutions) is reflected both in federal law (FERPA) and in professional codes of ethics, among them the AIR Statement of Ethical Principles (2019) ("AIR Statement" or "Statement"). Despite widespread agreement that privacy in the context of education is important, it can be difficult to pin down precisely why and to what extent it is important, and it is challenging to determine how privacy is related to other important values. But that task is crucial. Absent a clear sense of what privacy is, it will be difficult to understand the scope of privacy protections 2 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 in codes of ethics. Moreover, privacy will inevitably conflict with other values, and understanding the values that underwrite privacy protections is crucial for addressing conflicts between privacy and institutional efficiency, advising efficacy, vendor benefits, and student autonomy. My task in this paper is to seek a better understanding of the concept of privacy in institutional research, canvas a number of important moral values underlying privacy generally (including several that are explicit in the AIR Statement), and examine how those moral values should bear upon institutional research by considering several recent cases.i Defining Privacy In order to understand the moral importance of privacy in the context of institutional research, it will help to have a sense of what 'privacy' means. The literature on privacy is vast, and there are a number of plausible conceptions of privacy. For our purposes here, however, it is enough to stipulate a working definition with three components. To begin, it is useful to understand privacy as a relational concept. A person can have (or lack) privacy about some type or domain of information (for example, their location) in relation to some other person, persons, or organization. So, El may have privacy regarding finances with respect to her friends, while lacking such privacy with respect to her creditors. In other words, privacy and privacy loss occur within information domains and with respect to some other persons. Understanding privacy as relational leaves open just what the concept of privacy picks out, though. Perhaps the most prominent view is that privacy is a matter of whether, and the extent to which, others have access to information about a person (Allen, 1988; DeCew, 1997). 3 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 Generally, for such access to affect an individual's privacy, the information would have to be identifiable. So, collecting de-identified information about, for example, library use, grades, or socio-economic status would not diminish any person's privacy, though collecting information about a particular person's borrowing records, class performance, and socio-economic background would. Nonetheless, generalizable knowledge that derives from studies that do not by themselves diminish privacy may be used in ways that do decrease privacy. For example, learning about correlations between class performance and library use would allow one to take some data about individual students and make further inferences about them. Those inferences can diminish privacy even if the original research about library use and class performance did not. The third component of a conception of privacy is whether privacy is by itself morally valuable. Some scholars build moral value into the very concept of privacy, such that a person has privacy only in morally significant information, or one has a right to privacy in virtue of privacy's inherent value. A competing view, and the one I'll stipulate here, is that privacy by itself is morally neutral (see Gavison, 1980). In other words, once we have determined that a practice diminishes privacy, it remains an open question whether that decrease matters at all. Answering that question requires considering different kinds of moral values that privacy can support. The Value of Privacy There is ample evidence that people care about privacy (at least in some domains at some times) (see, for example, Auxier et al, 2019)That extends to students in higher education, who express surprise when the learn about learning analytics (Roberts et al., 2016). There are legal 4 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 protections for privacy in the U.S. and elsewhere, and when novel privacy violations become public there is often considerable criticism. It is therefore tempting to understand privacy as having a kind of stand-alone value. The AIR Statement, for example, states that "[w]e protect privacy and maintain confidentiality when collecting, compiling, analyzing, and disseminating information." Notice, however, that on the conception of privacy stipulated in section 2, any kind of research involving students' information will diminish their privacy. Students' privacy regarding their grades, courses, movements, etc., diminishes with respect to institutions precisely because institutions collect, compile, and analyze that information. Hence, the question to address is what independent values underwrite privacy in the first place, and how we should evaluate institutional research in light of those values. There is a range of views of privacy's value, and several different conceptions of privacy's value are reflected in AIR Statement. One view is that privacy is important for instrumental reasons; it prevents bad consequences or facilitates good consequences. For example, privacy in one's personal information can protect against fraud, identity misuse, and mistreatment. That is clearly true of health and financial information. It is also true of information collected by higher education institutions, in part because of the range and scope of data they collect. The AIR Statement explicitly recognizes the importance of consequences of institutional research, stating that analytics used and "policy decisions incorporating information we analyze and disseminate, impact people and situations." To its credit, the Statement does not assume that those consequences will be positive, negative, or fall equally on all stakeholders. 5 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 A different view of privacy's moral value is that it is grounded in persons' autonomy, or the ability to self-govern. Individuals are capable of determining for themselves what is valuable, how to structure their lives in relation to those values, and how to incorporate their values into their lives. And respecting individuals as autonomous persons requires that we afford them the opportunity to develop their sense of value and act accordingly. That in turn creates an obligation to not thwart people's ability to self-govern (for example, by paternalistically delimiting their choices, by manipulating them, or by coercing them), to foster conditions in which they can realize their values, and to nurture their abilities to think for themselves and act for their own reasons. Often, autonomy serves as the basis for moral rights, or valid claims of one's moral due. The AIR Statement reflects this value in that it "acknowledge[s] that the individuals whose information we use have rights, derived from both legal and ethical principles...." Autonomy, respect for autonomy, and autonomy-based rights can support privacy protections in a couple of ways (see, for example, Benn 1985, Bloustein 1964, Reiman 1976). First is that privacy may be something that people come to value. That is, it may be important for people to act without others' knowledge, to control who has information about them, or to ensure that they go about their lives without others examining them closely. Acting free from certain others' attention may be a constituent part of the kind of life that one finds valuable. People value privacy, and that alone creates some reason to respect privacy. It does not entail that privacy is inviolable because other values can outweigh privacy. Rather, it places the onus on others to justify diminishing privacy. A distinct, deeper issue concerns the conditions under which people can act autonomously. One view is that people act autonomously only if their values and actions are authentic. Autonomy requires that individuals be able to endorse their preferences and actions 6 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 upon critical reflection, and preferences that conflict with one's values over time will fail the authenticity test (see Christman, 2009). People might adapt their preferences either to circumstances they cannot change ("sour grapes") or even consciously alter their preferences to unjust pressures (for example, an employee embracing a toxic work environment) (Brighouse, 2000, p. 66). This raises two concerns about privacy. The first is that people may come to adapt their preferences surrounding data collection because they recognize its pervasiveness and accept it as inevitable. The second is that individuals subject to information collection and use may come to make decisions that reflect others' views rather than those that comport with their individual, core sense of themselves. Alternatively, they may be vulnerable to excessive interference by others. A further issue related to autonomy concerns individuals' abilities to understand their own situation in the world. People have autonomy interests in developing their own sense of value and making decisions in accord with that value. And deception is a moral wrong because it short circuits people's ability to reason effectively and make decisions autonomously (Shiffrin, 2000). Notice, though, that this can extend to decisions about how to interpret one's situation in the world (Hill, 1984). Hence, deception about important facets of a person's life can be an affront to autonomy, regardless of whether it affects their behavior. The AIR Statement reflects this value, too, stating that "[w]e seek to be fair and transparent." Transparency is important both as a matter of accountability and as a matter of recognizing data subjects as having an autonomy interest in understanding how their information is collected and used. Likewise, understanding that data subjects deserve some kind of reciprocity for their data-for example robust disclosure of information collection and use-can be understood as a matter of fair dealing. 7 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 Privacy's value can also derive from the type of information collector or the relationship between an informational subject and an entity that collects or uses their information. Government actors in the U.S. must abide by provisions in the U.S. Constitution, wiretapping and electronic surveillance restrictions, general privacy restrictions, and more. One reason why those protections are vital is government's expansive law enforcement power. Investigation, fining, and incarceration are tremendous powers, and limits are important (in part) to provide some kind of check upon that power. Similarly, having privacy rights in certain kinds of professional relationships (medicine, law, finance) is vital to fostering trust and, hence, making those practices function. The justification for privacy in those professional relationships will turn on the justifications for the relationships and the institutions within which they operate. Those justifications, in turn, may be valuable for instrumental reasons, for rights-based reasons, for fairness reasons, or something else altogether. Higher education institutions do indeed have special relationships with students. They hold themselves out as institutions that advance the interests of students (not, for example, as strictly transactional, arms-length institutions) and as privacy-respecting organizations worthy of trust. The AIR Statement reflects this in its assertion that institutional researchers "act as responsible data stewards." Moreover, students reasonably believe that higher education institutions will not disclose or misuse their information. And they collect a large amount and broad range of information about students. Hence, higher education institutions have a kind of fiduciary responsibility to students, and their data collection, analysis, and use should comport with the reasons that higher education is valuable in the first place (Balkin, 2016; Jones et al forthcoming; Rubel and Jones 2016). Linking the value of privacy to the purposes of higher education is not explicit in the AIR Statement. However, the Statement does state that 8 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 researchers "deliver information and analyses appropriate to the questions being asked, to the quality of the data available, and to the context in which the questions are asked." It would be better, though, to consider whether the "questions being asked" are themselves appropriate. Some cases Let's suppose that the views of privacy and its value outlined above are plausible. There are additional steps in determining how those should guide institutional research. One reason is that privacy may conflict with other values, including those that institutional research aims to advance. Indeed, the AIR Statement reflects this kind of trade off. Another is that different kinds of information collection and use will implicate different sets of values. Finally, in many cases whether there is a conflict in values will turn on downstream uses of information and knowledge gained through institutional research. That is, even if research does not undermine privacy by itself, it may provide a foundation for other privacy losses or undermine different values. To think through these questions, let's consider three recent cases. Georgia State University (GSU) is often touted as a model of using data and research successfully and advancing morally important goals. GSU is a public research university with a substantial proportion of students from under-represented groups. About a third of its students are the first in their families to attend college, over half are eligible for federal Pell grants, and about 60 percent are students of color (Hefling, 2019). Like many HEIs, GSU has struggled to ensure that students (and in particular students from underrepresented backgrounds) complete their degrees. This leaves students with substantial student loan debt but without the degrees that would help secure well-paid employment. 9 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 In 2011, GSU sought to address this gap using data analytics. It developed a system tracking both academic and financial information. This includes a system that alerts students' advisors about certain risk factors (for example, a poor grade in a key course, failure to take a required course within an optimal timeframe). Crucially, GSU combined these analytics with an investment in academic advising. It hired dozens of new advisors and substantially increased the amount of advising students received. GSU's six-year graduation rate is up from 48% in 2011 to 55% in 2018 (Hefling, 2019). Moreover, it has increased its success in supporting underrepresented groups. Students of color, Pell-eligible, and first-generation students now graduate at higher rates than the student body overall (Ekowo and Palmer, 2016). A different case comes from the University of Arizona, where a researcher used student ID card swipe information to create highly detailed maps of student movements and social networks. Researchers used the maps to build a student retention model and claim that such models can help institutions understand the size of students' social networks, changes in those networks, and strengths and changes in social connections. The university plans to use data from its Wi-Fi routers to form even more detailed understandings of student movements and behavior and to share this information with student advisors (Blue 2018). It is unclear whether students are aware of the extent to which their data is collected and analyzed. Researchers at Orange University (a pseudonym) analyzed student ID card-swipe data and identifiable wireless network activity.ii Student ID card-swipe data at campus dining locations identified students who frequently ate together. Their research found a strong relationship between the network strength of dining partners (presumably, friends) and their grade point average. The same researchers also analyzed wireless network activity associated with identifiable students when they were in class and in aggregate when they were on campus 10 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 over an unknown period of time. According to their findings, both types of network activity measurements correlated highly with GPA. In addition to these findings, they discovered that early morning student ID card swipes (for example, at 3 AM) correlated strongly with GPA. The materials do not make it clear as to whether or not this is a positive or negative correlation. Privacy, Ethics, and Institutional Research The three cases described above represent a spectrum of data collection, analysis, and use. The Orange University case takes business data and academic data and finds an interesting and potentially useful correlation between student habits and academic success. The University of Arizona case does something similar with student card swipe information and posits a potential use in helping student retention. Georgia State has established interventions based on patterns of student success within courses and programs. But what about privacy? In each case, there is substantial, sensitive data collected about individual students. In the Arizona case (and possibly in the Orange case), that data is deidentified in the course of the research (Blue, 2018). In the Georgia State case, prior research allows advisors to make inferences about the academic trajectory of students and intervene in ways that make it more likely that students will succeed according to a relevant metric (such as staying in school or graduating in a reasonable time). Much more important, though, is how to understand each of the programs in terms of the values that underwrite privacy in the first place. Consider first consequences, or instrumental value. Each of the three programs collects and analyzes sensitive student information. That creates a substantial responsibility on institutions to secure the information from unauthorized and improper use (a responsibility 11 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 recognized explicitly in the AIR Statement). However, it is difficult to see how students are made materially worse off by information collection in any of these cases. There appears to be an advantage gained in the Georgia State case, in a couple of ways. One is better student outcomes. The other is that the creation of rich information sources and interpretive frameworks-that is, a better understanding of potential academic hurdles-is instrumentally valuable in fostering a more effective relationship between students and academic advisors. Notice two things, though. First, this instrumental value is aggregative; overall, student-advisor relationships appear to be more effective. There may well be individual cases where the decreased privacy harms the relationship, and there may be small ways in which many such relationships are harmed. However, those may be "washed out" or overwhelmingly offset by overall increase in advising efficacy. Notice, too, that the value gained in the Georgia State program derives in large part from hiring substantial numbers of advisors. It is not the research alone that is a difference maker, but the investment in resources to make use of research findings. Hence, there is not a neat tradeoff between privacy diminution and benefit. Nonetheless, in light of the emphasis on advising, the data analytics appears "appropriate to the questions being asked...and to the context in which the questions are asked," per the AIR Statement, by being instrumentally useful for that defined purpose. More difficult to reckon are autonomy interests in privacy. Recall that the first way that privacy bears upon autonomy is that privacy may be something people value and a constituent part of actions from which they derive meaning and value. In the Arizona and Orange cases, researchers collected information about students' movements around campus, daily routines, and social lives. The Arizona researchers speculate that they can use the information to better 12 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 understand students' social networks, and the Orange researchers made inferences about students' friend groups. It is at least plausible that social networks, friendships, and personal interactions are the kinds of deep personal interests that are valuable in part because they are not subject to thirdparty examination and evaluation. Students are often unaware of the extent to which their information is collected and used, express surprise when they learn about it (Roberts et al, 2016), and express concern, uneasiness, or irritation when they learn that their universities are creating predictive models based on their data (Slade & Prinsloo, 2015). Students are generally supportive of sharing data about academic performance, but not supportive of non-academic, behavioral information (Ifenthaler & Schumacher, 2016). A program like Georgia State's, which collects a rich array of academic information along with non-academic (financial) information, may therefore be more consistent with students' values than programs such as those at Arizona and Orange, which collect primarily (though not exclusively) behavioral data. Of course, we do not know how students would interpret intricate maps of their relationships. That alone demonstrates an autonomy concern. Students have an autonomy interest in understanding what kinds of data are collected about them, how those data are analyzed, and how those data are used. Respecting that autonomy interest requires that universities be assiduously forthcoming about their data practices and the scope of their institutional research, especially with respect to non-academic data. In practice this means that universities should at the very least provide detailed, clear, and easily accessible descriptions of their data collection, analysis, and use practices. It also suggests that universities should provide realistic opportunities for students to opt out of data collection, or even that they should make some data collection "opt in" such that students who wish to exercise their autonomy over their information can do so. 13 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 Several more vexing concerns have to do with value formation. A number of scholars have argued that there is a "privacy paradox," in that people claim that they value privacy while giving up information in innumerable ways (Waldman, 2020). People participate in social media, agree to licensing agreements for mobile phone apps that collect large amounts of data, sign up for rewards programs that track commercial activities, and provide personal information to others in lots of ways. It is not clear, though, what we should make of this supposed paradox. One possibility is that people do not "really" value privacy. Another possibility is that people are overwhelmed by privacy policies, distracted and inattentive to privacy implications of their actions, under-informed about privacy, or nudged into giving up privacy in ways that they cannot address by themselves. Still another is that they have become resigned to privacy loss, and believe that it is fruitless to expend the effort required to protect it, or that people are resigned to privacy loss because they believe they have to give it up to participate in important parts of life. A more disturbing possibility is that people have come to value privacy less as a matter of adaptive preference. In other words, contemporary data practices in a range of settings may lead individuals to adopt inauthentic preferences, or preferences that they would not endorse upon critical reflection. How does the possibility that privacy diminishments result in people making decisions at odds with their values relate to institutional research? One way is that higher education institutions generally (including, but not limited to, institutional researchers) should seek to understand how important privacy is to subjects. Another, though, is to recognize that higher education institutions, systems, and actors (including, among others institutional researchers) may be participating in a system that makes it harder for people to value privacy. Certainly higher education institutions would not be the primary driver in prompting people to change their 14 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 adaptive preferences. However, they have greater responsibilities to students than (for example) social media companies have to their users based on the nature of the relationship between students and educational institutions. In addition to instrumental and autonomy-based values, relationshipand institutionbased reasons may underwrite privacy protections. In section 3, I noted that higher education institutions have a special relationship to their students based on the fact that they hold themselves out as institutions that will act in student interests, claim that they will be responsible stewards of student information, have control over broad and deep student information, and conduct research on that information. This creates a fiduciary relationship, such that institutions have an obligation to foster trust (Jones et al forthcoming). That requires institutions to act in students' best interest and to disclose information about data collection, analysis, and use (even when students might object). This is in some ways similar to fiduciary relationships in other domains (e.g., law, finance), and one that Jack Balkin has argued extends to for-profit information companies (Balkin, 2016). This special relationship also demands that institutions refrain from conducting research that is outside of their legitimate purview and refrain from sharing data with researchers who will conduct research outside of the institutions' legitimate purview. The Arizona and Orange cases demonstrate that lots of information (such as movement, social groups, dining habits, and so forth) are potentially useful to universities' educational missions. But surely that is not enough for the data and research on it to be within universities legitimate purview. After all, identifiable data about individual students' religious observance, political activity, and sex lives are plausibly useful for institutions' educational purposes (See Rubel and Jones, 2016). A better criterion for determining the scope of legitimate information gathering is whether higher education 15 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 institutions could legitimately aim to alter that activity for individual students. This is a key concern in the Arizona and Orange cases. It does not seem legitimate for higher education institutions to try and alter individual students' movements and social circles, even if doing so would advance their educational missions. Note this is different from fostering conditions conducive to learning, socializing, and retention; that can be done without intervening on behalf of individual students. In other words, even if researchers similar to those at Arizona and Orange "deliver information and analyses appropriate to the questions being asked," the questions themselves may be inappropriate. Lastly, in light of the special relationship between education institutions and students, we should consider whether (and the extent to which) information collection comports or conflicts with the values that underwrite higher education in the first place (see Rubel and Jones 2016, Rubel and Jones 2017, Jones et al forthcoming). Often higher education is seen as having instrumental value, such as training that will help students develop careers. But another view is that higher education is better understood as advancing autonomy interests of citizens in liberal democracies. In other words, higher education should work to help students in understanding, forming, and subjecting to critical reflection their values and conceptions of the good. For reasons noted in section 3, privacy is itself important in fostering autonomy. Conclusion There are a number of important limitations to the discussion here. One is that I have only considered student privacy. But of course faculty, staff, administrators, former students, prospective students, and other stakeholders have important privacy interests as well. Another is 16 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 that I have not addressed the relation between institutional research and third-party and vendor interests. Nonetheless, there is no question that privacy, including privacy in the context of higher education, is important, and that is reflected in the AIR Statement's explicitly endorsement of privacy. However, it is therefore inevitable that privacy and institutional research will conflict. Determining how to address that conflict requires that institutional researchers account for the moral values that underwrite privacy in the first instance, many of which are incorporated into the AIR Statement. Those values are rooted in the instrumental value of privacy, students' autonomy interests, the special relationship between students and educational institutions, and the values of higher education itself. Particular disputes will be difficult to resolve, but accounting for those deeper values will help institutional researchers foster both their institutional missions and their students' interests. References Allen, Anita L. 1988. Uneasy Access: Privacy for Women in a Free Society. Totowa, N.J.: Rowman & Littlefield. Association of Institutional Researchers. 2019. "AIR Statement of Ethical Principles." Auxier, B., Rainie, L., Anderson, M., Perrin, A., Kumar, M., and Turner, E. (2019, Nov. 15). Americans and Privacy: Concerned, Confused and Feeling Lack of Control Over Their Personal Information. Pew Research Center. Retrieved from https://www.pewresearch.org/internet/wpcontent/uploads/sites/9/2019/11/Pew-Research-Center_PI_2019.11.15_Privacy_FINAL.pdf . 17 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 Balkin, J. M. 2016. Information fiduciaries and the First Amendment. UC Davis Law Review, 49(4), 1183–1234. Retrieved from https://lawreview.law.ucdavis.edu/issues/49/4/Lecture/494_Balkin.pdf Benn, S. I. 1971. Privacy, freedom, and respect for persons. In NOMOS XIII: Privacy, edited by J. Roland Pennock and John W. Chapman, 1–26. New York: Atherton Press. Bloustein, E. 1964. Privacy as an aspect of human dignity: An answer to dean Prosser. New York University Law Review 39: 962–1007. Blue, A. (2018, March 7). Researcher looks at 'digital traces' to help students. University of Arizona News. Retrieved from https://uanews.arizona.edu/story/researcher-looks-digital-traceshelp-students Bok, D. C. 2006. Our underachieving colleges: A candid look at how much students learn and why they should be learning More. Princeton, N.J.: Princeton University Press. Brighouse, H. 2000. School Choice and Social Justice, Oxford University Press. Christman, J. 2009. The Politics of Persons: Individual Autonomy and Socio-historical Selves, Cambridge University Press. DeCew, J. W. 1997. In pursuit of privacy: Law, ethics, and the rise of technology. Ithaca, N.Y.: Cornell University Press. Ekowo, E. & Palmer, I. (2016, Oct. 24) The Promise and Peril of Predictive Analytics in Higher Education: A Landscape Analysis, New America). Family Educational Rights and Privacy Act. 1974. Code of federal regulations. Title 34. Department of Education. 18 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 Gutmann, A. 1980. Children, paternalism, and education: A liberal argument. Philosophy & Public Affairs 9 (4): 338–58. Hefling, K. (2019, January 16). The 'Moneyball' solution for higher education. Politico. Herold, B. (2018, April 17). Pearson tested 'social-psychological' messages in learning software, with mixed results. Education Week. Retrieved from http://blogs.edweek.org/edweek/DigitalEducation/2018/04/pearson_growth_mindset_software.ht ml Hill, Thomas Jr. 1984. "Autonomy and Benevolent Lies." Journal of Value Inquiry 18: 251–297. Jones, K. M. L., Rubel, A., & LeClere, E. (forthcoming). A Matter of Trust: Higher education institutions as information fiduciaries in an age of educational data mining and learning analytics. JASIST. Reiman, Jeffrey H. 1976. "Privacy, Intimacy, and Personhood." Philosophy and Public Affairs 6 (1): 26–44. Roberts, L. D., Howell, J. A., Seaman, K., & Gibson, D. C. (2016). Student attitudes toward learning analytics: "The Fitbit version of the learning world." Frontiers in Psychology, 7(1959), 1–11. doi: 10.3389/fpsyg.2016.01959 Rubel, A. & Jones, K. M. L. (2016). Student privacy in learning analytics: An information ethics perspective. The Information Society, 32(2), 143–159. doi: 10.1080/01972243.2016.1130502 Shiffrin, Seana Valentine. 2000. "Paternalism, Unconscionability Doctrine, and Accommodation." Philosophy & Public Affairs 29 (3) (July 1): 205–250. 19 This is a preprint. Please cite to the final, published version: Alan Rubel (2019), Privacy, Ethics, and Institutional Research. New Directions for Institutional Research, 2019: 5-16. doi:10.1002/ir.20308 Slade, S., & Prinsloo, P. (2015). Student perspectives on the use of their data: Between intrusion, surveillance and care. European Journal of Open, Distance and E-Learning. Special Issue Articles. Retrieved from http://www.eurodl.org/index.php?p=special&sp=articles&inum=6&abstract=672&article=679 Waldman, A.E. 2020. Cognitive biases, dark patterns, and the 'privacy paradox'. Current Opinion in Psychology, 31, 105-109. i A note on scope. Institutional research itself encompasses a vast range of activities. The focus of the paper will be on student privacy, even though only a part of institutional research will implicate student privacy. Some institutional research will not affect privacy at all. Other institutional research may implicate privacy, but not be at all problematic. Further, institutions conduct research on faculty and staff performance. They, too, have important interests in privacy, just as employees do in other sectors. Those interests are worth keeping in mind and warrant their own treatment, but they are beyond what I can cover here. ii Documentation with author. A colleague discovered this project (including slides) on a public forum. However, the study has not been published and is not publicly available. Hence, I will not identify the institution and researchers.