Data Privacy

wk9-d02-data-privacy

Dr. D

Chico State
DATA 385 - Fall 2026

October 22, 2026

Today

Today we look at the rules that cover personal data: what counts as personal data, who makes the rules, and what the rules say. You will teach each other the rules in a jigsaw lecture style.

Think first, then pair up. Would you paste a classmate’s graded exam into an AI tool to get feedback on it? Yes, no, or it depends?

What counts as personal data?

Anything that can be linked back to a person:

  • name, student ID number, email
  • grades and transcripts
  • health information
  • location, photos, what you click and search

Take the name off and the data can still point to you.

“Anonymous” is not always anonymous

Removing names does not always remove identity. Sweeney (2000) found that ZIP code, birth date and sex was likely identify 87% of the US population.

By itself a variable may not be able to identify you, but a combination can.

Sweeney, L. (2000). Simple demographics often identify people uniquely (Data Privacy Working Paper 3). Carnegie Mellon University. https://dataprivacylab.org/projects/identifiability/paper1.pdf

A prompt is a disclosure

When you paste data into an AI tool, it leaves your computer. Chico State’s guidance on AI coding assistants says to treat a prompt like a disclosure. If you are not sure whether data is sensitive, assume it is and do not paste it.

Important

only paste public information, fake data, de-identified data, and generic code.

Coding agents

Chatbots vs. coding agents

Chatbot

  • You type, it replies with text
  • You decide what to copy

Coding agent

  • Claude Code, Codex, the AI assistant in RStudio
  • Reads your files
  • Runs commands
  • Edits and deletes files on your computer

What can go wrong

  • It can read files you never meant to share: data, keys, passwords.
  • Anything it reads can be sent to the AI company, not just what you paste.
  • It can change or delete your work without you noticing.
  • It can run code you did not read.

Ground rules for coding agents

  • Work in a folder you can afford to lose.
  • Commit to git before you let it run.
  • Read every change before you keep it.
  • Keep sensitive data and passwords out of the folder.

Important

Chico State’s guidance says students must not use AI tools or scripts to access or automate campus systems such as Canvas or Microsoft 365.

Different rules

We are going to look at seven topics/sources and figure out what and who they protect, who has to follow them, and what are the requirements/allowances for each.

  1. HIPAA
  2. FERPA
  3. CCPA
  4. GDPR
  1. Chico State AI guide
  2. Chico State Data Protection
  3. Chico State coding assistants guide

Four questions for any privacy rule

  1. Whose data does it protect?
  2. What counts as protected?
  3. Who has to follow it?
  4. What does it require or allow?
  5. What is the strength of enforcement? Is it law, policy, or guidelines?

Jigsaw lecture

Break into groups and learn about your topic (10 minutes). FERPA group will have to search more than the listed source.

  1. HIPAA
  2. FERPA
  3. CCPA
  4. GDPR
  1. Chico State AI guide - pp 2-6
  2. Chico State AI guide - pp 6 (guiding principles) to 10
  3. Chico State Data Protection - to Encryption
  4. Chico State Data Protection - Encryption down
  5. Chico State coding assistants guide - sec 1-5
  6. Chico State coding assistants guide - sec 6-12

Each group has 1 slide and at most 5 minutes to present to the class. Add your content here. Stay big picture, do not get into the weeds or try to cover every item discussed in the material.