Protecting Students’ Personally Identifiable Information in Your School Google Calendar

By Brad Larrabee, Elementary Principal & Tanya Krieg, Middle School Principal, School District of Maple

Living in a digital age brings a balance of technological advantages and confidentiality risks to our public schools. Wisconsin Statute § 118.125 protects the confidentiality of student pupil records, which include progress reports, behavioral records, and directory information. This law prohibits the unauthorized disclosure of any personally identifiable information (PII) without parental consent. Schools' heightened awareness of PII confidentiality has been supported by the Wisconsin Department of Public Instruction’s new online training platform LearnProfessional. When school districts utilize digital tools like Google Calendar for daily scheduling, staff must carefully manage their calendar settings to protect how student data is handled while remaining compliant with Wis. Stat. § 118.125 and the federal Family Educational Rights and Privacy Act (FERPA).

Using Google Calendar to schedule student events such as IEP meetings, disciplinary reviews, counseling appointments, or specialized services (e.g., OT, PT, etc.) risks violating federal and Wisconsin law if full student names, confidential details, or other personally identifiable information are placed in the event’s titles when shared as an invitation. Even within a district-managed domain, Google Calendar’s default visibility can inadvertently expose protected PII to unauthorized staff, students, or external parties such as parents or outside providers. The recent launch of Google Calendar’s Find a Time scheduling feature intensifies this risk. To check your security, try scheduling a meeting with a peer and then select the Find a Time feature to see your own events. You will likely be surprised at the confidential information you may be sharing with others. 

To maintain security of PII under FERPA, school district employees must first complete the PII training provided in the LearnProfessional platform. Going beyond that training, districts using the Google Calendar platform are encouraged to follow these key protocols:

  1. Check Calendar Settings: Before scheduling a meeting, check your Google Calendar privacy settings. Changing the default setting of See Event Details to See Only Free/Busy (Hide Event Details) will help to keep your students’ PII protected. 
  2. Use De-identified Titles: When scheduling meetings, do not use students' full names in the event title. Instead, use initials, student IDs, or generic placeholders like "Student Support Meeting." These titles cannot be linked to an individual student by others. 
  3. Exclude Sensitive Details: Avoid putting specific medical, behavioral, or academic notes in descriptions or attaching these files in the invitation.
  4. Schedule Within: Ensure scheduling occurs strictly within district-approved Google accounts protected by formal data privacy agreements. Be hesitant to share these invitations out to personal Google accounts outside of your district. If an IEP or confidential meeting needs to be scheduled with parents or other providers, it is vital that all members review their Google Calendar settings prior to scheduling and accepting the meeting. 

By taking these small steps, districts can ensure that the Wis. Stat. § 118.125 and FERPA requirements are met and all student PII is protected. Please take a moment to review your settings and share this information with your teams. 

This information is intended to provide authoritative general information, with commentary, as a service to AWSA members. The materials and information provided in this article are subject to change without notice and should not be construed as legal advice.  If needed, legal advice regarding any topic, issue, situation or incident should be obtained from the school district's legal counsel. You may also direct your Level I legal questions to AWSA’s retained legal counsel, Malina Piontek, at 608-497-3037 or [email protected].