The need for a comprehensive education data governance -- the regulation of who collects what data, how it is used and why -- continues to grow. Technologically, data can be collected by third parties, rendering schools unable to control their use. Legal frameworks partially achieve data governance as businesses continue to exploit existing loopholes. Education data use practices undergo no prior ethical reviews. And at a personal level, students have no agency over these practices. In other words, there is no coherent and meaningful oversight and data governance framework that ensures accountable data use in an increasingly digitalised education sector. In this article, I contextualise the issues arising from education data transactions in one school district in the United States. The case study helps to contextualise what needs governance, who may access education data and how the district governs data use and transactions, emphasising the need for a coherent education data governance but also the limitations of such isolated efforts.