Navigating Student Privacy Laws: A Comprehensive Overview

In an era defined by digital learning and increasing reliance on technology in education, understanding student privacy laws is more critical than ever. The growing use of surveillance technology and digital learning tools in school settings has posed new threats to student privacy. These laws aim to protect students from invasive data collection, exploitative uses of their personal information, and unfair and discriminatory automated decision-making systems. This article provides a comprehensive overview of the key federal laws and emerging challenges in student data privacy.

Federal Laws Protecting Student Privacy

Several federal statutes play a crucial role in safeguarding student privacy:

The Family Educational Rights and Privacy Act (FERPA)

The most significant federal statute concerning student privacy is the Family Educational Rights and Privacy Act (FERPA), enacted in 1974. FERPA protects student privacy by limiting who can access student records. FERPA protects the confidentiality of educational records while also giving students the right to review their own records. Anyone who accesses records must specify the purpose for accessing that data. FERPA applies to any public or private elementary, secondary, or post-secondary school. It also applies to any state or local education agency that receives funds under an applicable program of the US Department of Education.

Key Provisions of FERPA:

Right to Inspect and Review Records: A parent or eligible student must be given the opportunity to inspect and review the student's education records maintained by the school.
Right to Request Corrections: Parents have the right to request that a school correct records they believe to be inaccurate or misleading. If the school decides not to change the record, the parent or eligible student then has the right to a formal hearing.
Parental Consent for Disclosure: Schools need written permission from the parent or eligible student to release any information from a student's education record.
Annual Notification of Rights: Schools must inform parents of their FERPA rights each year.

Schools that do not comply with FERPA risk losing federal funding. Because parochial and private schools at the elementary and secondary levels generally do not receive funding under any program administered by the US Department of Education, they are not subject to FERPA.

The Americans with Disabilities Act (ADA)

The Americans with Disabilities Act (ADA) prohibits all public entities, including schools, from disability discrimination. The Department of Education’s Office of Civil Rights enforces the ADA along with other federal civil rights laws to protect students.

The Federal Trade Commission Act (FTC Act)

The Federal Trade Commission Act (FTC Act) prohibits unfair and deceptive trade practices, including the misuse of student data. The FTC enforces the FTC Act to protect consumers and competition.

Children’s Online Privacy Protection Act (COPPA)

COPPA is a federal law that applies to online companies. COPPA requires companies to obtain “verifiable parental consent” before collecting personal information from children under 13 for commercial purposes.The law recognizes that the school can consent on behalf of the parent to create accounts and enter personal information into the online system- but only where the operator collects personal information for the use and benefit of the school, and for no other commercial purpose.

Emerging Challenges in Student Privacy

Biometric Technology and Surveillance

In recent years, schools have increasingly employed facial recognition and other biometric technology to monitor students. These systems collect vast amounts of biometric and personal information, use opaque and unproven algorithms, and are often biased against students of color and students with disabilities.

Biometric record, as used in the definition of personally identifiable information, means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual.

During the COVID-19 pandemic, the use of these digital surveillance tools increased dramatically. One example of one such technology is online proctoring software. Online proctoring services purportedly maintain academic integrity by discovering and flagging signs of cheating. Online proctoring companies claim that they can reliably and consistently find cheating. Despite these claims, the efficacy of these systems remain unproven. Students may also have to submit to facial recognition software, eye scans, key stoke logging, and other invasive technology as an academic requirement.

Read also: Guide to UC Davis Student Housing

Moreover, the fundamental fairness of online proctoring systems has been called into serious doubt. Research has shown that AI-particularly facial recognition systems-can encode bias and disproportionately harm students of color and students with disabilities. Test-takers subjected to AI-based proctoring have reported that the systems struggle to recognize faces of color and flag students with certain disabilities at higher rates.

AI in Schools

As schools rapidly incorporate AI tools into their teaching, new privacy concerns also emerge, raising questions of how the vast amounts of data generated will be used and protected. This is especially important since hacks of education tech companies have already jeopardized the personal information of millions of American schoolchildren.

Data Security and Vendor Compliance

Educational software, learning management systems, and other similar tools will likely process private student information on behalf of your institution. If they are not compliant or experience a data breach, you may share some responsibility. It’s important to thoroughly vet the vendors you work with and ensure that they are actively protecting your students’ data.

State Laws and Regulations

Policymakers in almost every state have considered laws to ensure the safety of student data, and the US Congress is considering seven bills on student data privacy. At the same time, the Every Student Succeeds (ESSA) Act requires that states adopt evidence-based interventions to improve school performance. The education research to inform these interventions depends on access to student data.

California's Approach to Student Data Privacy

SOPIPA is a California law that will go into effect in 2016 and applies to companies that provide online services for K-12 students. But there are some loopholes. SOPIPA may also allow Google to collect a broad array of browser data when students are logged into the Chromebook (i.e., Chrome OS/Chrome browser).

Read also: Investigating the Death at Purdue

The California Constitution arguably requires public school districts to provide parents and their children the opportunity not only to opt out of any classroom technology use that implicates the privacy of students, but also to provide alternative accommodations so students can benefit from technology in the classroom without giving up their privacy. The California Supreme Court held in Butt v. California, 4 Cal.

Additional Compliance Laws Education Institutions Need to Know

California Consumer Privacy Act (CCPA) This CCPA impacts how for-profit organizations handle private information. Non-profit educational institutions may be exempt, but their vendors and third-party service providers may not be.

A good example is the Pearson hack that occurred in 2019. Pearson, a company that creates educational software, experienced a data breach that affected more than 13,000 school and university accounts - some accounts with thousands of students each.

Health Insurance Portability and Accountability Act (HIPAA) HIPAA protects individually identifiable health information, which includes information relating to the individual’s physical or mental health, medical conditions and demographic data. Department of Health and Human Services for compliance investigations or reviews. Most institutions have collected some form of their students’ medical data, such as allergy information. On-campus health clinics also collect private student information protected under HIPAA.

Payment Card Industry Data Security Standard (PCI DSS) PCI DSS is a set of security standards that require any organization that accepts, processes, stores or transmits credit card information and cardholder data to maintain a secure environment. This applies to all organizations regardless of size. College and university campuses need to ensure that their payment processing systems and databases properly protect this information. Many payments by students are made at their campus’ financial aid office or admissions office.

Best Practices for Protecting Student Data

Below are several steps an institution can take to protect student data and ensure legal compliance.

Understand the Data You’re Dealing With

Many organizations believe that they know what types of data they are collecting, where that data lives and who has access to it. But, as organizations create and process greater quantities of hard-to-find unstructured data, the reality is that it’s easy for pieces, or even troves, of data to remain out of sight and vulnerable to a breach. Sensitive data discovery tools can help organizations locate all types of sensitive data across their entire digital landscape. While robust data privacy management tools will be able to find both structured and unstructured data, whether it’s stored on-premise or in a cloud-based platform.

Sensitive data discovery gives your organization a full view of your sensitive data footprint and enables you to assess what actions need to be taken. Moving forward with efficient, effective data security begins with understanding the data your team is dealing with.

Know Who Has Access to Sensitive Student Data

Authorized disclosure of sensitive data is critical for adhering to data privacy laws. When you have many members and departments within your organization, it’s important to create accurate and updated access rights. By classifying your data, your organization’s security team can work more efficiently by seeing the following information at a glance:

Each piece of data’s associated values and risks
Which pieces of data are subject to compliance regulations
Who is allowed to access and use the data at question

Automated data classification can make this task easier. Additionally, to stay compliant with laws like GDPR and CCPA, educational institutions and organizations should be able to provide authorized individuals with visibility into how their data is being used and stored in a timely manner. Automated workflows for these requests can cut down on the hours spent trying to manually locate data, and eliminates the possibility of human error.

Stay Current with the Latest Data Privacy Laws

Data privacy laws are ever-changing, especially with more consumers becoming savvy about how much of their personal data is collected by organizations. It’s advised that all organizations be privacy-forward to prepare for changes in federal and state laws that protect users’ privacy rights.

Education institutions that process large volumes of personal data need to stay up-to-date on the latest privacy laws and the technologies that can help aid their teams in remaining compliant. Data privacy tools with the ability to locate complex, unstructured data, monitor data in real-time, and provide insights to help you understand your data, can turn this heavy-lift into an efficient process.

Data Redaction Techniques

The process of masking the data displayed (putting an asterisk * in place of the actual number) to protect student privacy. Different applications may utilize different redaction techniques depending on the tool being used, data being displayed and the way that the data is being combined for display. Each redaction technique has been vetted within the agency and through other groups like PTAC to ensure that each application meets the applicable privacy laws to ensure that student privacy is protected.

Resources and Guidance

The Department of Education established the Privacy Technical Assistance Center (PTAC) as a “one-stop” resource for education stakeholders to learn about data privacy, confidentiality, and security practices related to student-level longitudinal data systems. PTAC provides timely information and updated guidance on privacy, confidentiality, and security practices through a variety of resources, including training materials and opportunities to receive direct assistance with privacy, security, and confidentiality of longitudinal data systems.

Protecting Student Privacy While Using Online Educational Services: Model Terms of Service

This document is a framework for evaluating online “Terms of Service” agreements. This document is designed to assist educators, schools, and districts in understanding how an online service or application may collect, use, and/or transmit user information. The guidance will assist users in deciding whether or not to sign-up for specific services.

Resources for Parents

The Data Quality Campaign provides parents the questions they should be asking their children's educators about the value of education data and how student privacy is ensured.

tags: #student #privacy #laws #overview