• A majority of students are comfortable with the institutional use of their personal data to help them achieve their own academic goals, but many remain skeptical of analytics tools that use their personal data to benefit others.
• Students are more comfortable with their institution using educational data to help them achieve their goals than with the use of other, more personal types of data.
• Students' lack of understanding about how their institution uses personal data undermines both their trust in that use and their confidence in how their institution protects personal data.
• Students who lack confidence in their institution's ability to safeguard their personal data see their institution as vulnerable to attack and lacking in transparency.
• Students who do not trust their institution to use their personal data ethically perceive a lack of transparency, generally lack trust in their institution, and believe that their institution is profiting from their data.

• Make protecting personal student data a priority by providing safe storage options, requiring multifactor authentication, and updating standards and practices for passwords. Review vendor contracts to verify compliance with Family Educational Rights and Privacy Act (FERPA) and Health Insurance Portability and Accountability Act (HIPAA) guidelines.
• Increase transparency about how personal student data are handled by (1) informing students what data are being collected about them and how those data are being stored, used, and protected; (2) allowing students to view and update their own data on demand; (3) seeking a priori informed consent from each student regarding the collection, storage, use, and protection of their personal data; and (4) providing students the opportunity to opt out at any time.
• Create campus-based information security awareness campaigns to inform students about efforts to increase data protection, preserve data privacy, and stay abreast of current topics, trends, challenges, and threats. Additionally, provide periodic security and privacy reports at the campus and individual levels so that students can make choices about next steps in protecting their personal data and privacy.

A majority of students are comfortable with the institutional use of their personal data to help them achieve their own academic goals. We asked students how they felt about institutions using their own data (to benefit themselves or to benefit others) and using others' data (to benefit others or to benefit themselves). Although 53% said they are fine with their own data being used for their own benefit, 16% expressed discomfort with their institution using anyone's personal student data to advance educational goals, regardless of who would benefit from that use. Just one in five students said they are comfortable with all four approaches—using their own and others' data to help themselves and others. It appears that most students would benefit from an institutional FAQ about why personal student data are collected, how those data are used at their institution, and the potential benefits from using those data. Indeed, one's own data are less useful without others' data for comparison; an additional widespread campaign for general data literacy would benefit everyone. A better understanding of the benefits of institutional analytics might help more students become more altruistic in their thinking about the use of their personal data for the academic success of others.

Students are comfortable with their institutions using their data to help achieve their educational goals, as long as the types of data used are not too personal. The more private and less relevant the data appear to be to academic success, the less likely students are to be okay with their institution collecting and using it. More students reported feeling comfortable with the use of information such as data on the use of campus services, academic records, data from the LMS, and demographic information, all of which clearly appear to support educational goals. Meanwhile, fewer students are comfortable with the collection and use of "gray data" (such as health data, location data, and social media data), which are not explicitly linked to educational goals. The indiscriminate use of student personal data, gray or otherwise, introduces not only ethical risks but also tangible legal problems (from laws such as FERPA, GDPR, etc.). Collection should not be indiscriminate and has to be minimized to what is necessary for the needs of the institution, and security safeguards and privacy protection mechanisms need to be in place based on these considerations. Most students (83%) said they are comfortable with at least one of the top-four types of data use, and only 9% of students said they are not comfortable with any use of their data; this suggests that targeted awareness campaigns could improve overall student buy-in on the use of personal data.

Students' lack of understanding about how their institution uses personal data undermines both their trust in that use and their confidence in how their institution protects personal data. Many students do not trust their institution to use their personal data ethically and responsibly, nor do they have confidence in their institution's ability to safeguard their personal data. Additionally, three-quarters of students do not see any benefits of personal data collection and use. And, most importantly, only one in five students understand how their institution uses personal data. Looking more closely at these data, we find that students who said they do not understand how their institution uses their personal data are significantly less likely to trust, have confidence in, and perceive benefits from their institutions' use of their personal data, and vice versa. To increase confidence and trust, institutions need to adopt a more transparent approach, educating students about what data they collect, how they safeguard the data once collected, how they use the data, and what happens to the data once the student leaves the institution.

Students' lack confidence in their institution's ability to safeguard their personal data is rooted in their belief that their institution is vulnerable to attack and lacking in transparency. We identified three major themes from open-ended responses we received from three-quarters of the students who told us they lacked confidence in their institution when it comes to protecting student data.1 The top reason is based on a general belief that "anyone can be hacked" and that "everything is hackable." Second, students cited a "lack of transparency" when it comes to what data are being collected, how they are being used, and what protocols are in place to keep them safe. Third, students are skeptical about the technological ability of their institutions' IT units to keep their data safe.

Students do not trust their institutions to use their personal data ethically and responsibly because of a perceived lack of transparency, a general lack of trust in their institutions, and a belief that their institutions are profiting from their data. Three-quarters of students who told us that they do not trust their institutions to use their personal data provided reasons for their lack of trust.2 First, citing a lack of transparency, many students reported that they don't really understand the policies and procedures related to the collection, storage, and use of their personal data. Second, students exhibit a general mistrust when institutions of any stripe (e.g., corporate, higher education) collect and use personal data. Third, many students expressed the belief that their institution has a financial incentive to sell student data to corporations, characterizing higher education as a "business" whose goal is to make profits; the selling of personal data to the highest bidder aligns with these students' perceptions of higher education.