The norm on a higher-education student's confidentiality in Georgia is written in a single article — the student-rights article of the Law on Higher Education — but within it sit three distinct rules: what is confidential, when it may be used, and how the information is stored. This page explains those three rules — and shows that the American FERPA frame does not operate here: the Georgian page is carried by the Georgian norm.
What is confidential
The law's formulation is precise: confidential are the personal information expressed by the student in the presence of academic personnel; information about the student's own views, faith and political convictions which became known to the latter during the learning process; and information about disciplinary measures taken against the student. These three categories go beyond the classroom: personal information is what the student said before a lecturer, not what he or she announced publicly.
The exceptions to use
Confidentiality is not absolute — the law writes two exceptions: first, where the student's consent exists; second, where the administration has a lawful interest in protecting another's safety and legally protected rights. This balance is practical: the student's views are protected, but they cannot become a shield where another person's safety is in real danger.
The storage rule
The third rule concerns storage: information about the student's academic progress and about disciplinary measures must be stored separately, and in storing it the administration must follow the procedure established by the General Administrative Code of Georgia. The general Georgian data-protection regime thus operates in the higher-education context as well — and this is precisely the text on which a demand must be built. For the student its practical meaning is that every spreading of the information must rest on a specific norm — and in its absence the spreading is assessed as a violation.
The American FERPA — the Family Educational Rights and Privacy Act — is a non-Georgian statute: its procedures and boundaries do not operate in Georgia. In Georgian practice, confidentiality is bounded by this article and by the data-protection rules of the Administrative Code. Sibling pages: access to records and electronic systems rest on other norms — they are unfolded on separate pages.