Student Data Not a 'Product' To Be 'Sold to the Highest Bidder'

• By David Nagel
• 01/14/14

A United States senator is questioning FERPA guidelines that he said could put student privacy at risk. Today Sen. Edward Markey (D-MA) said he'll introduce legislation in the coming weeks to protect students' sensitive information from commercial exploitation and from potential mishandling.

At issue are changes to the U.S. Department of Education's guidelines to the Family Educational Rights and Privacy Act (FERPA) issued in 2008 and 2011. Late last year, Markey requested clarification from ED on these changes, which in particular address the handling of student data by private contractors. ED responded in a letter (available as a PDF on senate.gov) this week justifying the changes and insisting that, while the protection of student data is paramount, there are legitimate cases in which schools must disclose student data without parental consent. (That letter is available as a PDF on senate.gov).

ED also responded that the department shares Markey's concerns about the commercialization of student data and that guidance will be issued on that topic, particularly addressing these key points:

• Contractors never own student data;
• Contractors must act "at the direction of the disclosing entity and in compliance with FERPA";
• Schools may only disclose the data to contractors for the performance of institutional services or functions that have a legitimate educational purpose;
• While FERPA-protected data held by a private contractor may be used to improve the contractor's product used by the disclosing entity (the school or district), it may not be used to create or improve products that were never intended for the school or district;
• Data could not be disclosed to a third party for the purpose of developing a product to market to a school or district.

ED did not indicate when formal guidance would be released.

Following ED's response, Markey today revealed that he'll introduce legislation to build in further statutory protections for parents and students. The legislation will be predicated on four principles:

1. That student data may never be used for commercial purposes;
2. That parents must be able to access and amend their children's data, as FERPA provides, even when the database is in the hands of a private company;
3. That safeguards must be in place when private companies transfer and store data; and
4. That private companies must delete student data no longer required for an educational purpose.

At an event hosted by the Electronic Privacy Information Center (EPIC), Sen. Markey announced his plans to introduce the legislation, telling attendees that while there are upsides to student data collection, safeguards have to be in place to protect that information.

"The business of storing and sifting through the records of grade-school students is growing even faster than students themselves. There are positives which can be extracted from this new trend in educational policy by collecting information about students' test results and learning abilities. Teachers may find better ways to educate their students and tailor lessons to increase student achievement. With better data, there's a potential to increase test scores, improve teaching techniques and better prepare our young scholars for a brighter future. But at the same time, there are perils from a privacy perspective.... It can ennoble and enrich, or it can degrade and debase. Our job is to imbue this digital ecosystem with America's time-tested values of privacy, respect, fairness and accessibility for all regardless of race, income or disability."

He continued: "I believe that putting students' sensitive information in private hands raises a number of concerns about the privacy rights of parents and their kids — kids who may be as young as 5-years-old. The information currently shared by schools extends far beyond just test scores, grades and attendance. It can include sensitive data such as health, disability and even criminal and disciplinary information about the child.

"Parents today need the tools to protect their children not just from the dark corners of the World Wide Web but also fro the whole wide world of businesses that now acquire and analyze information about students. Parents, not companies, have the right — should have the right — to control personal information about their children. A [child's] educational record should not be a product to be bought and sold to the highest bidder."

In response to Sen. Markey's comments, the Software and Information Industry Association today released a statement saying that existing law already protects student data and that there is a "culture of business practices that respects student privacy beyond basic compliance. School service providers know that if they do not protect student information entrusted to them, they will lose their customers and face legal repercussions for non-educational purposes."

Sen. Markey also introduced bipartisan legislation in November to amend the Children's Online Privacy Protection Act (COPPA), called the Do Not Track Kids Act, which similarly addresses the collection and use of student data. That legislation is currently in committee.