School & District Management

Legislative-Advocacy Group’s Model Bill Tackles Privacy of Student Data

By Benjamin Herold — December 03, 2013 6 min read

An influential legislative-advocacy group’s promotion of a model bill meant to protect the privacy of student data sends a strong signal that the hot-button issue will be debated in statehouses around the country in lawmakers’ 2014 sessions.

The template being provided to state lawmakers by the controversial American Legislative Exchange Council, known as ALEC, would require state school boards to appoint a “chief privacy officer,” create a data-security plan, publish an inventory of all student-level data being collected by the state, make sure that contracts with some vendors include privacy and security provisions, and ensure compliance with federal privacy laws.

The group’s model legislation mirrors a recently enacted bill in Oklahoma that is widely regarded as the first attempt in the country to comprehensively address growing concern over the collection, electronic storage, and sharing of oceans of student-specific information. Such data cover matters from academic performance to family background to disciplinary and health records.

“This is an issue of importance to our members,” said Lindsay M. Russell, the director of ALEC’s education task force. “Pretty much all [48] states that are represented on our task force have shown interest in the bill.”

Other advocacy groups and industry representatives reacted warily to the approach embodied in the Oklahoma and ALEC bills. They praised the efforts as good first steps, but expressed concern over a lack of substantive details, particularly when it comes to placing limits on the noneducational uses of student data by third-party vendors.

“Focusing on transparency and accountability is always a good start, but I’m not sure that [the ALEC model bill] is comprehensive in covering the education-technology landscape,” said Joni Lupovitz, the vice president of policy at Common Sense Media, a San Francisco-based nonprofit that in October launched a campaign to press for increased safeguards on student data.

Lawmakers from both major parties have recently introduced or passed a variety of other student-data-privacy bills in such states as Arizona, Massachusetts, Nebraska, and New York.

A bipartisan group of U.S. senators also has introduced a bill that would ramp up existing federal protections of students’ online privacy.

Safeguarding Student Data

Issues surrounding the privacy of student information are taking on new significance as policy and technology combine to produce a mass of detailed data, both academic and nonacademic, on individual students. Some states have recently enacted laws to beef up data privacy; similar measures are developing in other states. Here is a sampling of that legislative activity.

Gov. Janice K. Brewer, a Republican, signed into law in June a bill designed to strengthen parental-consent procedures around the release of student “directory information”—including name, address, and phone number—to third-party vendors. The measure provides a pathway for reporting suspected violations of the federal Family Educational Rights and Privacy Act, or FERPA. “The bill maintains the privacy of students on campuses from outside vendors who want to obtain [directory] lists to increase their client bases,” said state Sen. Kimberly Yee, the Phoenix Republican who sponsored the legislation.

Gov. Dave Heineman, a Republican, signed into law in April a measure guaranteeing students, and their parents or guardians, access to school files and records concerning themselves. Students’ parents or guardians and teachers, counselors, and school administrators are granted the same access. Some broad limits are placed on the transfer of such data to other parties without parental consent, although the legislation is explicit that “the sharing of student data, records, and information among school districts, educational service units, learning communities, and the state department of education, to the fullest extent practicable and permitted by law, is vital to enhancing education in this state.”

No fewer than six bills related to student-data privacy are currently pending in the New York state legislature, including proposals that would give parents greater say in how their children’s education data may be used and limit third-party providers of cloud-computing services to noncommercial uses of student data. Most of the bills have received bipartisan backing in the Assembly, the lower house. None has yet been enacted.

David K. Albert, the director of communications and research for the New York State School Boards Association, said the state’s data-sharing partnership with Atlanta-based nonprofit inBloom Inc. has taken concerns about student privacy in the state “to a different level.”

“We want to protect student privacy, and at the same time make it so that schools can continue their regular day-to-day operations without putting too many roadblocks in place,” he said. He cited routine functions ranging from student transportation to yearbook creation that require some degree of student-level data-sharing with outside vendors.

A bill proposed by state Rep. Carlo P. Basile, a Boston Democrat, would prohibit “service providers who offer cloud-computing services to K-12 educational institutions from processing student data for commercial purposes,” including targeted advertising to children. “I felt something had to be done to protect the integrity of our children’s business,” Mr. Basile said. “Now that [lawmakers] have become educated on [cloud computing], there’s definitely an appetite to do something.” The bill is currently in committee.

The Student Data Accessibility, Transparency, and Accountability Act, passed in June and signed into law by Gov. Mary Fallin, a Republican, is poised to become a national model for how state lawmakers propose to comprehensively address student data-privacy issues. The law mandates creation of a data-security plan, publication of an inventory of all student-level data being collected by the state, data-privacy and security provisions in contracts with outside vendors, and compliance with federal privacy laws. It also served as the template for model legislation adopted by the American Legislative Exchange Council, an influential legislative-advocacy group based in Arlington, Va.

Looking to Oklahoma

The Arlington, Va.-based ALEC brings together state legislators and private-sector business leaders to craft sample legislation based on free-market and limited-government principles. In the education arena, the group has been involved in promoting such measures as “parent trigger” and voucher legislation. On another front, its role in some states’ adoption of “Stand Your Ground” laws—which allow individuals to use deadly force to protect themselves without a requirement to retreat in the face of danger—drew intense national scrutiny in the wake of the killing of Florida teenager Trayvon Martin.

Ms. Russell said the model data-privacy legislation, approved by ALEC’s members in late September and formally known as the Student Data Accessibility, Transparency, and Accountability Act, shares “core concepts” with the Oklahoma legislation of the same name, which was approved in June. The language in the two documents is virtually identical.

State Rep. David Brumbaugh, a Republican whose district includes Tulsa, sponsored the Oklahoma bill.

Mr. Brumbaugh said his focus was on building a “system of safeguards” to protect students’ privacy while also recognizing the value of tracking their “educational pathways.”

He argued that the collection of some of the roughly 300 pieces of student-level data compiled for use in state longitudinal-data systems such as Oklahoma’s—especially information that is nonacademic—constitutes “data-gathering without a legitimate purpose.” Mr. Brumbaugh also expressed concern that such data is often not properly secured.

“If we ignore small, gradual erosions to privacy in the name of policy or convenience, we risk a larger overall loss that we aren’t aware of until it’s too late,” he said.

The Oklahoma Student DATA Act requires the state education department to publish an inventory that lists and defines each piece of individual student data it collects, as well as the reason it is being collected. It outlines broad guidelines for restricting access to student data and limiting the conditions under which student data can be shared with other entities.

The law also calls for contracts with outside vendors that will handle student data to include “express provisions that safeguard privacy and security and include penalties for noncompliance.”

Stricter Limits Proposed

Given the recent “sea change” in the volume of data that education institutions collect and their capacity to process it, the focus in the Oklahoma law and the ALEC model legislation on increasing transparency and establishing new accountability structures is “absolutely critical,” said Stephen Mutkoski, the worldwide policy director for the Microsoft Corp., based in Redmond, Wash.

But Mr. Mutkoski is among those who expressed reservations that the Oklahoma and ALEC bills do not go far enough, especially when it comes to establishing an “initial bar” that would clearly limit the use of student data to educational purposes—a major concern, given the proliferation of educational app makers, “cloud”-based information-storage providers, and other vendors seeking to monetize student data through targeted advertising and other means.

“It’s a time of great growth in the ed-tech industry, and I’m not sure everybody’s motivation in terms of how they want to use data is clear,” Mr. Mutkoski said.

Leonie Haimson, a New York City-based parent and public schools advocate, also questioned the wisdom of not providing families more say in whether and how their children’s information is being shared.

“To me, it sounds like [the bill is intended] to assuage the fears of parents who want there to be something done to protect their children’s data, but who aren’t really informed about the issues,” Ms. Haimson said.

Bills that contain more specifics but don’t take as comprehensive an approach have gained some traction in other states. In New York, for example, Ms. Haimson and her nonprofit organization, Class Size Matters, have helped push more-targeted bills crafted to stop the release of sensitive student information without parental consent and to allow parents the opportunity to opt out of data-sharing efforts involving third-party vendors.

Both bills passed in the state Assembly last spring but have yet to move in the state Senate.

Legal Action in New York

Class Size Matters also played a leading role in a recent filing for a court injunction to stop the New York state education department from moving forward with a partnership with inBloom Inc., an independent nonprofit based in Atlanta that has met stiff opposition to its efforts to create a cloud-based education-data repository for states.

“This is the most bipartisan education issue that anyone in the state of New York has ever seen,” Ms. Haimson said of data privacy. “Parents are wildly angry.”

For his part, Mr. Brumbaugh, the Oklahoma lawmaker, said his state’s efforts should be construed as a first step.

“We want to shore [students’ privacy] up even more,” he said, pointing to parental-consent provisions as one area where the state could see further action. “This is all new territory.”

Ms. Russell of ALEC said that in the coming weeks, she expects much conversation in other states regarding the group’s model bill, which its members are likely to bring to their legislatures in the coming months. She said the ALEC template could be changed to accommodate local concerns.

“As January comes and people start to craft their legislative agendas,” Ms. Russell said, “we’ll have a better sense of which states are going after this aggressively and which are still in the discussion phase.”

A version of this article appeared in the December 11, 2013 edition of Education Week as Group’s Model Bill Aims to Protect Privacy of Student Data


Classroom Technology Webinar Making Big Technology Decisions: Advice for District Leaders, Principals, and Teachers
Educators at all levels make decisions that can have a huge impact on students. That’s especially true when it comes to the use of technology, which was activated like never before to help students learn
Professional Development Webinar Expand Digital Learning by Expanding Teacher Training
This discussion will examine how things have changed and offer guidance on smart, cost-effective ways to expand digital learning efforts and train teachers to maximize the use of new technologies for learning.
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Student Well-Being Webinar
The Social-Emotional Impact of the Covid-19 Pandemic on American Schoolchildren
Hear new findings from an analysis of our 300 million student survey responses along with district leaders on new trends in student SEL.
Content provided by Panorama

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

School & District Management 4 Ways to Keep Staff and Students Safe From the Delta Variant
Just as schools reopen, a super-contagious COVID-19 variant is infecting people nationwide at alarming rates. Here's what schools can do.
5 min read
Students and parents walk into school on the first day of school at Enrique S. Camarena Elementary School on July 21, 2021, in Chula Vista, Calif.
Students and parents walk into school on the first day of school at Enrique S. Camarena Elementary School on July 21, 2021, in Chula Vista, Calif.
Denis Poroy/AP
School & District Management A View From the Hot Seat: How One District Leader Is Confronting COVID-19's Latest Twists
An assistant superintendent in Texas talks about how to keep the pandemic in check for the new school year even as the Delta variant spreads.
9 min read
Jeanie Johnson, assistant superintendent for administration, is a kind of the air traffic controller in Midway ISD, absorbing the glut of information from the Centers for Disease Control and Prevention, Texas education Agency, Tex. Gov. Greg Abbott, Waco-McLennan County, Public Health District and others, to help the Waco School District devise safety protocols and plans for students. She’s doing so amid rapidly changing and sometimes conflicting guidance. She talks about what she learned over the last year and that’s helping the school district prepare for the second COVID-19 school year.
Jeanie Johnson, assistant superintendent for administrative services, helps lead the COVID-19 response for the Midway Independent School District in Texas.
Eric Guel for Education Week
School & District Management Opinion Q&A Collections: Education Policy Issues
Posts on the key education policy issues from the past 10 years.
13 min read
Images shows colorful speech bubbles that say "Q," "&," and "A."
School & District Management Opinion Leaders, Your Communication Plan Needs to Start With Your Staff
Staff members are the point of contact for thousands of interactions with the public each day. They can’t be the last to know of changes.
Gladys I. Cruz
2 min read
A staff meeting around a table.
Vanessa Solis/Education Week and Getty Images