FERPA Finding Reminds Schools to Review Terms of Service
- By Dian Schaffhauser
The Department of Ed has long held that under the terms of the Family Educational Rights and Privacy Act, families can't be required to waive the rights and protections accorded under FERPA as a condition of acceptance into a school or training program. That held true here too. As the brief, known as the Agora letter, laid out, these terms "in effect, required the parent's forfeiture of her rights under FERPA to protect against the unauthorized disclosure of PII from her child's education records that was posted or submitted to the site as 'Member Content.'" The school violated the legal requirements of FERPA.
A second allegation that the school had violated FERPA's "school official exception" requirements was found to be groundless. This exception enables schools to disclose personal information from student records to third parties without consent from parents as long as the school keeps "direct control" over the use and maintenance of the information and the outside entity only uses the data for the purposes for which the school disclosed it.
In this case, ED found that while the way Agora handled student information "could have been more effective," the school didn't violate the legal terms of FERPA. However, the school was encouraged to better follow the best practices the department has issued in various guidance documents "when entering into future agreements for online educational services with a third party."
"The Agora letter has a number of implications for stakeholders," noted FPF in its analysis. As FPF's Lindsey Barrett and Amelia Vance wrote, this was the first time that the federal agency had found fault "with the policies and practices of an ed tech company." More scrutiny could happen, not just at the federal level, but also at the state level. FPF's advice: that schools "carefully review their parental consent policies, and more importantly, the content of the privacy policies and terms of service of their ed tech partners."
A redacted version of the Agora letter is posed on the Department of Education website.
The legal analysis appeared on the Future of Privacy Forum.
[Editor's note: Some portions of this article have been modified since the original publication yesterday, in particular paragraph 5, which required substantial factual corrections. —D.N.]
Dian Schaffhauser is a senior contributing editor for 1105 Media's education publications THE Journal and Campus Technology. She can be reached at email@example.com or on Twitter @schaffhauser.