Protecting Student Privacy in a Digital Age

Legal Brief

The use of online educational services has skyrocketed, raising new concerns for student privacy that didn’t exist even a decade ago. With students now spending more or much of their school lives online, school districts shoulder additional responsibilities to ensure the data housed in those programs are collected, used and stored responsibly.

Suppose your district uses an online teaching program that shares students’ personally identifiable information with the program provider in order to establish individual accounts for each student. The provider sends reports on student progress but also collects and stores students’ browsing history, the search terms they use and location data. The provider uploads this student data to the cloud.

After students receive targeted advertisements based on their browsing histories, parents call to complain. You contend the district has a legitimate educational reason to collect and share the student data and that no prior consent was necessary. The parents argue that they have a legitimate expectation of privacy for their children’s personal information and should have been put on notice and been provided with the opportunity to opt out. Who is right?

Restrictive Statutes

Several federal laws restrict the unauthorized use and disclosure of student data. These include the Family Educational Rights and Privacy Act, or FERPA, the Protection of Pupil Rights Amendment, or PPRA, and the Children’s Online Privacy Protection Act. These laws contain exceptions that allow districts to disclose student data without parental consent in some cases.

FERPA does not require consent for the disclosure of student data to service providers, so long as the provider has been determined to meet the criteria for being a school official with a “legitimate educational interest” and is under the direct control of the district regarding the use of education records. Similarly, although PPRA requires districts to allow parents to opt out of activities in which data will be used for marketing purposes, an exception exists for information that is collected for the purpose of providing educational products or services to students.

In addition, many states have proposed solutions for localities to address parental privacy concerns. Since 2013, more than 410 bills addressing student privacy have been introduced across the country.

Mitigating Risks

The following practices can help school leaders balance the educational interests of the district with the expectations of privacy of parents and students:

Inventory the online education services currently used in the district.
Not only will an inventory help assess the scope of student information being shared with providers, but having a master list of online educational services will help you evaluate which services are most effective and foster informed communications with parents.

Develop policies to evaluate proposed online educational services.
Be clear about how proposed online educational services can be approved and who has the authority to enter into agreements with providers. In addition to thinking about pedagogy and learning benefits, ask questions about data security, collection, use, retention, disclosure, destruction, access and modification of data.

Use a written contract or legal agreement.
Having a written contract or legal agreement helps maintain the required control over the use and maintenance of school data. The Privacy Technical Assistance Center, managed by the U.S. Department of Education, has developed a checklist for evaluating online educational tools’ terms of service.

Be transparent with parents and students.
Inform students and their parents of what information is being collected and how it will be used. Transparency enables parents and students to be informed about the benefits and risks of using education technology and helps alleviate confusion about what data will be shared and how it will be used.