Are Schools Protecting Your Kids’ Data?

Published

August 8, 2014

Bob Sullivan is author of the New York Times best-sellers Gotcha Capitalism and Stop Getting Ripped Off. His stories have appeared in The New York Times, the Wall Street Journal, and hundreds of other publications. He has appeared as a consumer advocate and technology expert numerous times on NBC's TODAY show, NBC Nightly News, CNBC, NPR's Marketplace, Terry Gross' Fresh Air, and various other radio and TV outlets. He helped start MSNBC.com and wrote there for nearly 20 years, most of it penning the consumer advocacy column The Red Tape Chronicles. See more at www.bobsullivan.net. Follow Bob Sullivan on Facebook or Twitter.

A 40-year old federal law protects kids’ school records from the prying eyes of outsiders, but the law is in desperate need of a 21st-Century overhaul. Efforts to do that began last week with the introduction of the Protecting Student Privacy Act in Congress by Senators Edward J. Markey (D-Mass.) and Orrin Hatch (R-Utah), but it’s a baby step that’s unlikely to close a Pandora’s Box.

To some, data mining of kids offers the promise of much more efficient education. To others, it conjures up Orwellian nightmares about the fine-tuned marketing manipulation of an entire generation. At the moment, federal laws are mostly silent about limits on for-profit use of kids’ data by private corporations.

The central problem is this: Forty years ago, school records consisted mainly of hand-written report cards. Today, the potential data collected on students is nearly infinite. And it’s not just school districts that collect the information. Hundreds of third-party firms — from giants like Google to ed-tech startups like Knewton — routinely collect thousands of data points about kids while servicing school districts.

Many school districts do a poor job or informing parents where their kids’ data is going. A survey published last year by Joel Reidenberg, a professor at Fordham Law School, found that only 25% of the districts that responded told parents they were using cloud services, for example. Worse: Only 7% of contracts signed by responding districts restricted the sale or marketing of student information by vendors.

The 1974 Family Educational Rights and Privacy Act (FERPA) strictly limited who could access educational records such as grades or attendance. It has two serious flaws, however. It doesn’t cover new kinds of data that are collected, such as metadata generated when kids use email — where they are, what time they log in, and so on. Also, FERPA is essentially unenforceable. The only recourse it provides to parents for wrongly shared data is filing a report with the Department of Education, and the only punishment that agency can mete out is the drastic step of withholding federal funding. But according to EducationCounsel, it has never done so.

The new Protecting Student Privacy Act addresses neither issue. While it does clarify that third parties need to implement data security safeguards, forbids use of educational records for marketing purposes, and compels private companies not to store “detailed inventories on students” forever, it does not address the metadata issue, nor expand penalties.

“The introduction of the Protecting Student Privacy Act is a good first step; however, it needs to be amended to have the intended effect of updating FERPA to account for the Digital Age,” said Washington D.C.-based lawyer Bradley Shear, an expert in school privacy issues. “For example, the bill needs to expand the definition of educational records to include student emails and digital metadata created on school provided services, platforms, and equipment.”

Shear also said parents should enjoy a “private right of action,” so they can directly sue corporations that violate the law.

“To be truly effective, the legislation must hold vendors legally accountable,” he said.

Conflicts that arise from the mix of technology and schools are not new. A national controversy erupted two years ago when school officials began routinely demanding social media passwords from students and athletes; several states have since passed laws banning the practice. And when InBloom Inc., backed by $100 million from the Bill and Melinda Gates foundation, started signing up schools around the country for its cloud services, it faced a huge backlash — and hasty withdrawals — after parents found out kids’ Social Security Numbers and other private information had been shared with the firm.

Still, advocates of educational technology fear that privacy concerns might force schools to throw the baby out with the bath water, and reject tools that could really help students.

“We share the privacy protection goals of Senators Markey and Hatch, but it’s critical to ensure that any new rules do not inadvertently create obstacles to the effective use of information,” Mark MacCarthy Software and Information Industry Association vice president, said to Education Week. “Innovative education technology is essential to improving education for all students and to ensuring U.S. economic strength in an increasingly competitive global environment.”