School districts that administer the SAT or ACT to all students are getting a bracing warning from the U.S. Department of Education: They must take steps to protect students’ personal information, or risk running afoul of federal privacy laws.
The warning came in the form of guidance issued Wednesday by the department’s Privacy Technical Assistance Center. The 11-page document takes on two practices: how districts sign students up for the college-admissions exams, and how they handle the pre-test surveys that accompany the ACT and SAT.
The pre-test surveys explore a wide range of topics, including students’ academic interests, extracurricular activities, and religious affiliations. Those surveys are entirely voluntary, but that’s often not clear to students and their families, the new guidance says. (You can see the SAT’s survey here, and the ACT’s survey here.)
“We have heard from teachers and students ... that the voluntary nature of these pre-test surveys is not well understood,” the document says. Additionally, many students think they must answer every question, and opting out isn’t that easy: It requires the student to “affirmatively indicate in response to multiple questions that the student does not wish to provide the information,” the guidance says.
Transparency and Permission on ACT, SAT Surveys
The Education Department’s Privacy Technical Assistance Center, or PTAC, recommends that districts make it abundantly clear to parents and students that participating in those pre-test surveys is optional.
The practice of signing students up for college-admissions exams needs re-examination, too, the PTAC says. The spotlight has focused on this practice as states steadily shift the way they use the SAT and ACT. Years ago, students signed up for the tests themselves.
But as states and districts change strategy—giving the tests for free to all students to build college awareness and readiness, or using them as high school achievement tests for accountability under federal law—many districts take on the registration process.
That puts them at risk of violating federal and state privacy laws, since they’re providing students’ information to the College Board and ACT Inc. There are two layers of transaction that raise potential problems, because the students’ data doesn’t stop traveling at the College Board’s or the ACT’s doors; the testing companies share it with colleges and scholarship organizations.
David Hawkins, who oversees policy at the National Association for College Admission Counseling, said the concerns reflect the “unintended consequences” of the big shift in the way the SAT and ACT are being used: as required tests by many states and districts.
Officials from ACT and the College Board deferred any detailed comment, saying they were still reviewing the new guidance. ACT issued a statement saying that it “appreciates” the guidance, “recognizes the importance” of protecting students’ private information, and will “continue to work closely” with states and districts on the issue.
The survey materials ask students whether they will consent to receive information from colleges, scholarship organizations and other groups. They then sell that information to those organizations, the guidance says.
Students can benefit from the process, connecting with colleges or scholarships they might not otherwise know about, the document says, but the practice also raises privacy concerns that schools must address.
The guidance is focused on the Family Educational Rights and Privacy Act, the confidentiality provisions of the Individuals with Disabilities Education Act, and the Protection of Pupil Rights Amendment. It seeks to “remind [states and districts] of their responsibilities” under those laws, and suggest ways they avoid running afoul of them.
When is Parental Permission Needed?
There are a few exceptions to the privacy protections in FERPA and IDEA that could allow districts to provide students’ information to the testing companies, the guidance says. But they might well need parental permission to address the part of the process in which the testing companies sell students’ information to other organizations.
The PPRA, passed in 1978, requires districts to protect students’ privacy when they administer surveys that ask them to reveal information that falls into eight protected categories under that law, the guidance says. Districts have to notify parents at least annually that they are asking students for this kind of information, and give them a chance to opt out, the document says.
The pre-test surveys included with the SAT and ACT include questions that fall into one or more of those eight PPRA-protected areas, the guidance says, including students’ religious practices, affiliations, and beliefs, and student and parent income. Such questions would “trigger” PPRA protection and require districts to provide appropriate notifications and options for parents, it said.
(The other six PPRA-protected categories are students’ or parents’ political affiliations or beliefs; mental or psychological problems; sexual behavior or attitudes; illegal, anti-social, self-incriminating, or demeaning behavior; critical appraisals of people with whom students have close family relationships; and information about their relationships with lawyers, physicians, and ministers.)
The Future of Privacy Forum said the new guidance suggested that the PPRA could be a bigger issue for school districts in the future than it has been in the past. In a blog post, Amelia Vance, the organization’s policy counsel and the director of its education privacy project, called the guidance document “the most extensive technical assistance released on PPRA in almost 40 years.”
Hawkins, of the college-advising group, said that the concerns outlined in the new guidance are significant, but addressing them is probably “a relatively easy fix” for states and districts if they go the extra mile to make sure students and parents understand their options in the registration and information-sharing process, and get parents’ permission at the beginning of the year.