Data

U.S. Agencies Grapple With Student-Data-Privacy Guidance for Schools

By Benjamin Herold — December 04, 2017 7 min read
BRIC ARCHIVE

Two federal agencies are grappling with how to guide schools on protecting students’ personal information while using educational technology. That increasingly delicate balancing act was front and center during a discussion Friday convened by the U.S. Department of Education and the Federal Trade Commission.

At issue were such fundamental questions as:
• What counts as students’ personal information?
• How should schools and companies protect parents’ legal right to access and delete information collected online from young children?
• Should ed-tech vendors be allowed to use information collected in schools to improve their products and services, or does such activity constitute impermissible commercial use of student data?
• How can the nation’s school districts maintain “direct control” of the increasingly vast troves of student information they now regularly hand over to third-party companies they designate as “school officials” under federal law?

On those issues and others, the legal landscape is marked by considerable gray areas, said Thomas B. Pahl, the acting director of the FTC’s bureau of consumer protection, during opening remarks at the event.

As a result, Pahl said, “both the FTC and the Department of Education think further discussion, and perhaps additional guidance, is warranted.” The discussion should “provide a roadmap for potential next steps at the agencies,” he said.

Modernize FERPA and COPPA?

Looming over the rapid expansion of educational technology in K-12 are two federal laws: the Family Educational Rights and Privacy Act, or FERPA, which enumerates parents’ rights with respect to their children’s educational records; and the Children’s Online Privacy Protection Act, commonly known as COPPA, which regulates third-party operators of websites, apps, and digital services that collect information from online users who are younger than 13.

Read Education Week’s in-depth explainer on COPPA and schools here.

Those statutes are supposed to provide strong guardrails that protect students’ information, enshrine parents’ rights, and establish the rules of the road for schools and vendors.

But in an age when digital devices, online instructional resources, and a dizzying array of software, apps, and platforms can be found in most classrooms, many in the K-12 sector view FERPA and COPPA as antiquated, inadequate, or both.

“We need more concrete guidance to stand on,” said Chris Paschke, the executive director of data security for the Jefferson County, Colo., schools, which has been at the epicenter of the student-data-privacy fight for several years following its role in the high-profile fight over inBloom, a controversial data-sharing initiative that has since gone under.

One big source of uncertainty is the issue of parental consent. COPPA, for example, stipulates that operators of online services seeking to collect online information from children under 13 must obtain their parents’ approval. The Federal Trade Commission has previously indicated that the law does not preclude schools from acting as parents’ agents in providing that consent, so long as the companies they contract with provide notice to the school and to parents, and so long as the information collected is not being used for commercial or non-educational purposes.

Companies’ Use of Data

That stance has opened several cans of worms.

For one, COPPA generally takes a broad view of what counts as “personal information,” including some kinds of indirect “metadata,” such as persistent identifiers that can be attached to students in lieu of their names or ID numbers, and geolocation information that children generate when using some devices and services. FERPA, however, generally does not consider such information part of students’ legal educational record. The discrepancy can create conflicting obligations for schools.

Speakers at the FTC and Department of Education event were also sharply divided over whether companies should be able to use the information they collect about children (such as log records showing how a student interacts with a digital instructional tool) to improve their products.

David LeDuc, the senior policy director for the Software & Information Industry Association, described such uses as an educational win-win-win for companies, schools, and students. But George Mason University professor Priscilla M. Regan described those same practices as a “secondary commercial use,” saying they should be forbidden under the law.

Such disputes may seem technical, but they point to a larger problem with the way current federal laws are being enacted inside schools, said Jim Siegl, who serves as technology architect for the Fairfax County, Va., schools, but emphasized he was not speaking on behalf of his district at the event.)

When schools were given authority to grant COPPA consent for the use of educational-technology products, Siegl said, the idea was that they would serve as agents on behalf of parents. Instead, he said, they have too often become agents for outside companies.

Overwhelmed Parents

Faced with such a tumultuous national landscape, 40 states have responded by taking matters into their own hands, passing a total of 124 student-data-privacy related laws since 2013, said Amelia Vance, who leads the student privacy project at the Future of Privacy Forum, a Washington think tank.

The ed-tech industry has also pushed a number of self-regulation efforts, most notably the Student Privacy Pledge, a voluntary set of privacy and security commitments now agreed to by more than 300 companies.

And districts, schools, and individual teachers have, by and large, accelerated their adoption of new technologies, making it difficult to keep track of everything that students are using—let alone what information is being collected, or how it is being used. In some districts, technology officials who seek to avoid using products and services with inadequate privacy and security policies find themselves being pressured by teachers or overruled by higher-ups, panelists at the discussion said. The challenges appear to be particularly acute in smaller and poorer districts.

The net result is that many parents are overwhelmed, said Rachael Stickland, the co-founder of the Parent Coalition for Student Privacy. She described her own experience of having a classroom volunteer sign her child up without parental notification or consent for an online platform known as Edmodo, which later suffered a massive data breach that resulted in the personal information of millions of students being put up for sale on an unregulated part of the internet.

“It seems completely inappropriate that the ed-tech industry gets a pass on using sensitive, personal student information [gathered] in a compulsory environment” in order to refine their products and market them back to schools and children, Stickland said.

Signs of Progress

There have been signs of progress.

Melissa Tebbenkamp, the director of instructional technology for Missouri’s Raytown Quality Schools, said her district and some others have grown more assertive in their privacy and security demands of companies, refusing to work with vendors that don’t meet certain minimum standards.

“We’re the customers,” Tebbenkamp said. “They’re not making money without us.”

Still, the road ahead won’t be easy.

For all the growing pressure on the FTC and the Education Department to provide clarity, there are also risks associated with taking action now.

Does it really make sense, for example, to issue guidance on how existing laws might be harmonized before FERPA undergoes its long-rumored legislative update?

In addition, “one-size-fits-all” solutions might bring greater clarity, but they could also have unintended consequences and place new burdens on schools, said Francisco M. Negrón, Jr., the chief legal officer for the National School Boards Association.

And still other experts warned that a host of emerging issues—from the growing ease with which supposedly anonymous data can be used to re-identify users, to the possibility that predictive algorithms might shut some students out of certain courses, career-placement services, or other opportunities, to the new ways in which data might exacerbate bias and discrimination—could soon swamp current concerns.

No timetable is currently in place for the two agencies to announce if and when they’ll proceed with issuing further guidance.

A version of this article appeared in the December 13, 2017 edition of Education Week as U.S. Agencies Grapple With Student-Data-Privacy Guidance

Events

This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
Classroom Technology Webinar
Educator-Driven EdTech Design: Help Shape the Future of Classroom Technology
Join us for a collaborative workshop where you will get a live demo of GoGuardian Teacher, including seamless new integrations with Google Classroom, and participate in an interactive design exercise building a feature based on
Content provided by GoGuardian
School & District Management Live Online Discussion A Seat at the Table With Education Week: What Did We Learn About Schooling Models This Year?
After a year of living with the pandemic, what schooling models might we turn to as we look ahead to improve the student learning experience? Could year-round schooling be one of them? What about online
School & District Management Webinar What's Ahead for Hybrid Learning: Putting Best Practices in Motion
It’s safe to say hybrid learning—a mix of in-person and remote instruction that evolved quickly during the pandemic—is probably here to stay in K-12 education to some extent. That is the case even though increasing

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

Data Will Coronavirus Hobble Yet Another National Education Survey?
Amid all the schooling disruptions, federal researchers are scrambling to connect with teachers and principals for a key national survey.
2 min read
Illustration of a person taking a survey.
DigitalVision Vectors
Data Spotlight Spotlight on Student Data
In this Spotlight, discover how students perform on national tests and more.
Data Using Student Data to Identify Future Criminals: A Privacy Debacle
A police department uses sensitive school data to keep a secret list of students it deems as at risk of engaging in criminal behavior.
8 min read
Silhouette of group of students with data overlay.
iStock/Getty Images Plus
Data Knowing How Students and Teachers Use Tech Is Vital
Data on the usage of educational technology tools can provide districts with a helpful road map for improving student engagement under remote, in-person, or hybrid learning conditions. See how school districts are using such data to make smart, strategic decisions.
5 min read
Ainslie Illig, 8, works on her computer at home in Ebensburg, Pa., during school closures last spring. Schools are putting together strategies for improving student and teacher engagement with online learning tools for the 2020-21 academic year.
Ainslie Illig, 8, works on her computer at home in Ebensburg, Pa., during school closures last spring. Schools are putting together strategies for improving student and teacher engagement with online learning tools for the 2020-21 academic year.
Kara Illig via AP