Study: It's Time to Regulate Brokers of Student Data

• By Dian Schaffhauser
• 06/13/18

Student information has become fair game for data brokers, which don't adhere to any protective measures currently in place, according to a new study by Fordham University's Center on Law and Information Policy (CLIP). As "Transparency and the Marketplace for Student Data" reported, lists of student information are widely available for purchase "on the basis of ethnicity, affluence, religion, lifestyle, awkwardness and even a perceived or predicted need for family planning services." Those who trade in student information are governed under no federal privacy law.

As a summary of the report by Future of Privacy Forum explained, data brokers buy and sell information about people culled from "a wide variety of sources," including public records and commercial sources. That data can be cross-referenced with other data for all kinds of marketing purposes, such as identifying families with children who are about to head back to school or graduate.

To develop its results, CLIP spent years examining publicly available sources, making public records requests to schools and collecting marketing materials received by high school students. What they found was that data was prolific. In the course of their work researchers came across one company, ASL Marketing, with a database of more than 5 million high school students; another company, Lake B2B, makes a database list available on students between the ages of two and 13. In total, the research uncovered just 14 data brokers that specialize in the sale of student information. Frequently, the companies identified by the researchers "change names, merge and have affiliated relationships."

What the project couldn't identify were the primary sources for the data. School districts queried by the researchers denied selling directory information, other than to military branches and other educational organizations. And after years of research, the report acknowledged, "Fordham CLIP was largely unable to discover data sources." Researchers concluded that student information available in the commercial marketplace suffers from a "lack of transparency."

The regulations in place don't apply to data brokers in the private sector, according to the report. For example, FERPA protections only apply to educational records, and some of that may be disclosed by schools without written consent from parents. COPPA protects the collection of information from children online; but data brokers are frequently the "downstream recipients of personal data" that has been collected by others.

State legislators have taken up the call to secure student data in ways not already covered by federal regulations, such as with California's Student Online Personal Information Protection Act (SOPIPA), which imposes rules on website and online service operators serving K–12 users. However, data brokers themselves "remain largely unfettered at the federal level." One state exception: Vermont enacted a law last month that requires data brokers to register with the state and disclose the kind of information about minors that they maintain.

The study offered a set of recommendations:

• The commercial marketplace shouldn't be so opaque. People should be able to find out the identities of student brokers; the lists and "selects" they're selling access to; and where the data came from. One model for this is the Fair Credit Reporting Act, a version of which could apply to the compilation, sale and use of student data once it has left a school or been separated from FERPA protections. As the researchers noted, "If data brokers are selling information on students based on stereotypes, this should be transparent and subject to parental and public scrutiny."
• Data brokers should be required to follow "reasonable procedures to assure maximum possible accuracy of student data" and to alert purchasers and other "downstream users" when the information they're dealing in has "proven inaccurate" so that they can correct the mistakes as well.
• Parents and emancipated students should be able to opt out of uses of student data for commercial purposes unrelated to education or military recruitment, akin to the "right to be forgotten" that's part of the European Union General Data Protection Regulation.
• When students take surveys at school, including those distributed through teachers, guidance counselors and online, the use of data — and especially, the commercial use — should be made clear to the students and their families beforehand.

As a result of the study, suggested the Future of Privacy Forum, the Federal Trade Commission or state attorneys general may choose to pay closer "regulatory attention" to the companies that deal in student data. Or local, state and federal lawmakers may decide to push through new regulations. What's really needed, the Forum offered, is a "baseline privacy law in the United States that would provide more consistent protections for all consumers."