The proliferation of information technology tools in higher education has resulted in an explosion of data about students and their contexts. Yet, current policies governing these data are limited in their usefulness for informing students, instructors, and administrators of their rights and responsibilities related to data use because they are based on antiquated conceptions of data and data systems. To understand how data privacy policies conceptualize and represent data, privacy, student agency, and institutional power, we conducted a policy discourse analysis of 151 university policy statements related to student information privacy and the responsible use of student data from 78 public and private post-secondary institutions in the U.S. Three common discourses emerged: educational records are static artifacts, privacy solutions are predicated upon institutional responsibility and student agency, and legitimate educational interest in data are institutionally defined and broadly applied. We explore the assumptions, biases, silences, and consequences of these discourses and offer counter- discourses to begin a foundation for the development of privacy policies in a new data age.