Policy & Student Data Privacy

Feds Tackle Student Privacy for Pre-Test Surveys in SAT and ACT

• By Dian Schaffhauser
• 06/22/18

Schools have a new set of worries about student data privacy. The department within the U.S. Department of Education in charge of protecting student privacy has issued a document that raises concerns and offers guidance about what happens to the data generated from pre-test surveys, such as those given before the SAT and ACT.

According to the Privacy Technical Assistance Center (PTAC), until recently, most students who took the SAT or ACT college admissions tests registered for them on their own or with their parents' consent. Now, however, schools are registering students to take the tests and paying the test providers for a couple of reasons:

1. As part of ESSA-mandated assessments in reading/language arts and math; and
2. To boost college enrollment efforts by covering the cost of this pre-college application necessity.

As part of those tests, the testing companies administer voluntary pre-test surveys that ask questions about all kinds of topics: academic interests, participation in extra-curricular activities and religious affiliation. That information is then sold by the testing companies to colleges, universities, scholarship services and other organizations for the purposes of college recruitment and scholarship solicitation.

But teachers and students are often confused about the "voluntary nature" of the pre-tests, in which the questions require responses, including those queries that a student may not wish to answer. Therein lies the problem. Because the data generated in those surveys is part of school-required activities, it falls under the purview of multiple laws that protect the privacy of student data.

As a detailed analysis by the nonprofit Future of Privacy Forum explained, PTAC legal scrutiny has found that under the Protection of Pupil Rights Amendment (PPRA), for example, districts or schools must notify parents (or students over 18) "and given the opportunity to opt-out of participation" in the pre-surveys. Under the Family Educational Rights and Privacy Act (FERPA) and the Individuals with Disabilities Education Act (IDEA) there must be "data protections" set up around the personally identifiable student information in education records. On top of that, state-specific laws protecting student information may also come into play.

The implications are many.

First, local education agencies need to make sure the contracts they're signing with testing companies lay out how and whether student data can be used and how it must be protected. For example, under FERPA and IDEA written consent is needed for disclosure of a student's education records.

Second, under the terms of PPRA, parents have a right to be consulted on development of district policies related to surveys covering restricted topics; they must also be notified annually about the policies and "informed "whenever a survey includes questions on a restricted topic or when student information will be for the purposes of marketing or selling.

The PTAC technical advisory also offered other "reminders" for school systems:

• To make pre-test survey questions available for review by parents and students and on the relevant websites;
• To be "explicit" with stakeholders -- faculty, staff, parents and students -- about the voluntary nature of the pre-test survey;
• To provide parents (and emancipated students or those 18 or older) with notice of the survey administration or distribution date and their right to opt out of taking the pre-test survey as required under PPRA; and
• To obtain prior written consent if personally identifiable information from education records (including test scores or even test score ranges) are going to be included in the information provided by the testing companies to third parties for college recruiting purposes.

In the conclusion to its technical advisory, PTAC acknowledged the "potential benefits" to students who take the college admission tests and those pre-test surveys, while reminding schools that they have responsibility under privacy rules to make sure student data is appropriately protected.

PTAC's technical assistance document is located on its website. The Future of Privacy Forum analysis appears here.