FERPA Finding Reminds Schools to Review Terms of Service

• By Dian Schaffhauser
• 01/30/18

Do parents have to relinquish their students' rights under FERPA when the school signs an agreement with a company whose terms of use don't comply with FERPA? Not according to the U.S. Department of Education.

The case, which is amply explained in a clearly written article on the Future of Privacy Forum, began when a parent contended that she was forced to agree to terms of use set out by K12 Virtual Schools when it contracted with the charter her student attended, Agora Cyber Charter, a public charter school in Pennsylvania. Agora held an agreement with K12 Virtual to deliver educational services online. Without that agreement, the parent asserted, her student wouldn't be allowed to participate in the school.

According to the K12 terms of use, parents agreed to grant the company "and its affiliates and licensees" free rein to "use, reproduce, display, perform, adapt, modify, distribute, have distributed, and promote the content in any form, anywhere and for any purpose." Content was defined as "all information, data, text, software, music, sound, photographs, graphics, video, messages, tags or other materials," including "personally identifiable information from student education records that is posted to ... K12 Online School."

The Department of Ed has long held that under the terms of the Family Educational Rights and Privacy Act, families can't be required to waive the rights and protections accorded under FERPA as a condition of acceptance into a school or training program. That held true here too. As the brief, known as the Agora letter, laid out, these terms "in effect, required the parent's forfeiture of her rights under FERPA to protect against the unauthorized disclosure of PII from her child's education records that was posted or submitted to the site as 'Member Content.'" The school violated the legal requirements of FERPA.

The department found that signing the K12 terms of use was "forced" upon the family as a requirement for attending the school in spite of the school arguing otherwise. As FPF explained, even though Agora was a charter school and  "parents were free to enroll their children elsewhere," the requirement that the parent accept the K12 terms of use when she enrolled her child "constituted a forced waiver of parental rights under FERPA."

A second allegation that the school had violated FERPA's "school official exception" requirements was found to be groundless. This exception enables schools to disclose personal information from student records to third parties without consent from parents as long as the school keeps "direct control" over the use and maintenance of the information and the outside entity only uses the data for the purposes for which the school disclosed it.

In this case, ED found that while the way Agora handled student information "could have been more effective," the school didn't violate the legal terms of FERPA. However, the school was encouraged to better follow the best practices the department has issued in various guidance documents "when entering into future agreements for online educational services with a third party."

"The Agora letter has a number of implications for stakeholders," noted FPF in its analysis. As FPF's Lindsey Barrett and Amelia Vance wrote, this was the first time that the federal agency had found fault "with the policies and practices of an ed tech company." More scrutiny could happen, not just at the federal level, but also at the state level. FPF's advice: that schools "carefully review their parental consent policies, and more importantly, the content of the privacy policies and terms of service of their ed tech partners."

A redacted version of the Agora letter is posed on the Department of Education website.

The legal analysis appeared on the Future of Privacy Forum.

[Editor's note: Some portions of this article have been modified since the original publication yesterday, in particular paragraph 5, which required substantial factual corrections. —D.N.]