Several efforts in Washington are converging on the sensitive
question of how best to safeguard the information software
programs are gathering on students.
A proposed Student Digital Privacy and Parental Rights Act of
2015 is circulating in draft form. It has bipartisan
sponsorship from Democratic Rep. Jared S. Polis of Colorado and
Republican Rep. Luke Messer of Indiana.
Consumer groups like Common Sense Media and companies like
Microsoft have spoken positively of the bill.
But some student-privacy advocates are saying it doesn’t go far
enough in restricting what private companies can do with
“It is a start to try to get at a very complex issue,” says
Elana Zeide, an expert on student privacy at the Information
Law Institute of New York University, who saw an earlier draft
of the bill. “But it’s not going to satisfy a lot of parent
advocates, because it leaves a lot of discretion to schools and
Mike Goldstein works with education clients at the law firm
Cooley. He says there’s been an “explosion” of interest in
privacy issues over the past five years. Technological advances
have schools and universities outsourcing many more basic
functions than in years past. Everything from gradebooks to
tests to entire academic programs, he adds, is being handled by
third-party, for-profit providers.
And these providers are capturing far more than names,
addresses and end-of-term grades. In some cases, large amounts
of student work, and literally millions of tiny interactions,
are collected and stored in the cloud. Think of all the edits
on a school paper written in Google Docs. Or all the
interactions a student has with a Khan Academy math program.
The major federal student privacy law on the books, FERPA,
doesn’t have much to say about this avalanche of data. That’s
because it deals mainly with the security of basic demographic
information collected and held by schools themselves. “There’s
been a shift in focus in terms of privacy laws and regulations
affecting both schools and colleges — from a focus on what the
schools do, to what providers do,” says Goldstein.
In order to understand this issue, Goldstein and Zeide say,
it’s important to separate out several distinct, but related,
concerns that fall under the broad umbrella of student privacy.
1) SECURITY My child’s information will be
stolen and misused by hackers. She will be a victim of identity
theft or her information will be exposed in an accidental data
Setting rules about how long data can be stored, and who can
access it, helps security. The draft House bill contains some
broad security provisions, but security, says Zeide, is also
determined by good training and protocols, not just regulation.
2) TRANSPARENCY My child’s information is
being collected, circulated, stored and shared, but I don’t
know where or by whom or why. I won’t be informed if there’s a
This bill includes some provisions on disclosure and parental
3) COMMERCIALIZATION My child’s information
will be used to target online advertising or otherwise
exploited for commercial gain. My child will be marketed to
while she’s doing her homework — or her homework will be used
to sell things to other students.
This is where the House bill focuses. It would prohibit the
sale of student information and the targeting of advertising
based on a profile of a student assembled over time. It
contains an exception, though, meant for companies like The
College Board, which sell information on students who take the
SAT to colleges, which is then used to target scholarship
My child’s information will be “out there,” discoverable in the
ether somewhere. Her youthful mistakes and foibles, her
low-income or English-language-learner status will follow her
around. One day, her “permanent record” could limit her
These “reputational” issues are much more complicated than the
rest. They cover not only privacy, as it’s been discussed here,
but related situations, like the recent reports of Pearson
monitoring public posts on social media for mentions of the
PARCC test by students. One day, student data could start to
wield reputational power similar to what a bad credit record
does for adults: It could limit your ability to get a job, not
just your access to credit.
“There’s a whole other set of more difficult, deeply troubling
concerns about the use of information for educational
purposes,” that aren’t addressed in the new bill –– or
in most of the proposals out there, Zeide says. “There are
harms that can happen regardless of intent.”
New Law Tries To Address Student Privacy Fears