Followed by deleting data once you've used it for its stated purpose.
Personal data needs to be much more of a liability than it currently is for anything to change. Business will respond when the bottom line is affected.
Funny you say that without even knowing the school’s use case for the data. And most certainly in the abstract, companies have even less reason to collect PII than they are currently doing.
that's the odd thing: we simply don't ask whether there's an alternative.
for instance, how many companies (including universities) store their own cash on prem? what if we treated PII like cash? limit amount and time kept outside the data "bank" (which would be a third party specialized for security and authenticating access).
