• Parents would not be able to delete any of the personal information obtained by a vendor from their children, even upon request, unless the data resulted from an “optional” feature of the service chosen by the parent and not the district or school.
• The bill creates a huge loophole that actually could weaken existing privacy law by allowing vendors to collect, use or disclose personal student information in a manner contrary to their own privacy policy or their contract with the school or district, as long as the company obtains consent from the school or district.  It is not clear in what form that consent could be given, whether in an email or phone call, but even if a parent was able to obtain the school’s contract or see the vendor’s privacy policy, it could provide false reassurance if it turns out the school or district had secretly given permission to the company to ignore it.
• Vendors would be able to redisclose students’ personal information to an unlimited number of additional third parties, as long as these disclosures were made for undefined “K12 purposes.”
• Vendors would be able to redisclose individual student’s de-identified or aggregate information for any reason or to anyone, without restrictions or safeguards to ensure that the child’s information could not be easily re-identified through widely available methods.

Rachael Stickland concludes: “This bill reads as though it was written to suit the purposes of for-profit vendors, and not in the interests of children.  It should be rejected by anyone committed to the goal of protecting student privacy from commercial gain and exploitation.”

On September 18, 2014 Lisa Shultz, public education advocate and member of the Parent Coalition for Student Privacy, tagged @leoniehaimson and @parents4privacy in a tweet about Pearson’s new collaborative partnership with an edtech startup called LearnSprout. Her tweet linked to a public document (link now here) that listed the data schema used for their product. At the time we knew little about the company, but their name was familiar because they had once been listed as a partner of inBloom.

Lisa’s tweet also caught the attention of Paul Smith, Marketing Director for LearnSprout. He quickly engaged in a thoughtful and productive Twitter exchange between @lisa4schools, @leoniehaimson and @parents4privacy. In 140 characters or less, we asked Paul numerous questions about the types of data his company collected, how they used the data, their data retention and deletion policies, and how they contracted with schools and school districts. Though Paul did his best to field the barrage of questions, we agreed it was best to take the conversation offline.

Paul reached out to us by email and encouraged us to provide feedback on LearnSprout’s Privacy Policy and Terms of Service.  We were happy to help but first we wanted to know more about the company ‘s services and customers. What we learned didn’t put us at ease. Paul described how, at the time, schools would setup LearnSprout with limited-access administrator account to the student information system (SIS) in order to send data to LearnSprout for analysis. This included a number of personally identifiable data fields from the system. LearnSprout would then analyze the data and present the school user with a series of graphs and charts to “identify historical trends, track college readiness and spot at-risk students.” Authorized school/district personnel could then access reports profiling individual student’s attendance, gender, free/reduced lunch status, etc. (See image below.)

Further, to sign up for this free service, the “customer” or school employee simply accepted the “click wrap” agreement. There was no negotiated contract between LearnSprout and the school/district – a teacher or administrator merely agreed to the Terms of Service which, of course, favored LearnSprout by stating: “We reserve the right, at our discretion, to change the Terms on a going forward basis at any time. Please check the Terms periodically for changes.”

Upon learning more about LearnSprout, we were clear with Paul that we disagreed with the underlying principles of their service and would we never endorse their product because we believe strongly that profiling individual students – no matter how pure the intention – stigmatizes children and can harm or limit their future chances for success. We also insisted that the “click wrap” agreement insufficiently protected schools/districts (and their students) and at the very least LearnSprout should require an electronic signature so the school employee signing up for the service would consider the gravity of his/her decision before sharing sensitive student data. Paul assured us that he understood our position about the value of the service but respectfully disagreed, and he was committed to improving their “onboarding” process. With that behind us, we started digging into their policies.

We found LearnSprout’s Privacy Policy and Terms of Service to be vague, contradictory, and full of legalese  and outdated terms for products and services that the company no longer supported. It was clear to everyone that a lot of work needed to be done. But after several months, a handful of long but congenial conference calls, and dozens of clarifying email discussions, the resulting policies are a vast improvement from where LearnSprout started in September. Paul outlines the comprehensive list in his blogpost http://blog.learnsprout.com/ but highlights include:

• Termination of the “free” service model and an end to “click wrap” agreements. LearnSprout is now a paid service and Paul assures us the “Terms of Service and Privacy Policy are attached as a condition of each new contract.”
• If LearnSprout should go bankrupt, all data in its possession will be deleted in 30 days.
• When the Terms of Service are changed, customers will be notified and must accept the terms in order to continue using the service.
• They post on their website the full data dictionary of what data they store for schools/districts.
• Breach notification within 24 hours of a suspected incident.
• Student’s personally identifiable information will not be used to improve or enhance LearnSprout’s products or services, and will be removed 60 days after the student is not longer enrolled in the school/district.

Paul’s collaborative nature and sincere desire to improve their policies set a great example for other ed tech companies to follow. We still don’t agree with LearnSprout’s business goals but we do believe they are a leader in forging partnerships with parents and advocates to safeguard the data entrusted to them. Our hope is that others will engage in equally civil and productive dialogue.

(Correction: The previous blogpost stated that LearnSprout would “backdoor” SISs. The term “backdoor” was an oversimplified description of the technical process, and was not intended to imply that LearnSprout was accessing student information stored in the SISs in an unauthorized manner.)

February 11, 2015

Dear Representatives Polis and Messer:

We write on behalf of the Parent Coalition for Student Privacy, a nationwide network of parents, citizens, and privacy advocates, concerned with the widespread, rampant, and poorly regulated data collection, data-sharing, data-tracking, data-warehousing, data-mining, and commercial exploitation of personally identifiable student information. We thank you for your interest in this important topic and for your ongoing efforts to strengthen student privacy protections.

As you are well aware, parents across the country are increasingly alarmed about the everyday uses and abuses of their children’s personal data. Many parents are only recently learning how much of their children’s most sensitive information is being collected and shared via their schools with commercial vendors, private organizations, state agencies, and other third parties. Though the evidence of the benefits of this widespread collection and disclosure of children’s personal information is weak, the risks are all too evident. Families are mobilizing to counter this virtually unfettered third-party access to their children’s private data, and have demonstrated the effectiveness of their advocacy at the state level.

While we welcome federal legislation to strengthen student privacy protections, we are concerned that this effort may be incomplete, inadequate, or co-opted by special interests. As the tide of opposition to non-consensual capture, disclosure, and re-disclosure of student educational data has grown, various groups have sought to placate parents with various assurances. These assurances, however, are weak, as they fail to deal with student privacy within the framework of fair information practices. The recent voluntary corporate Student Privacy Pledge, for example, was a first step in addressing these issues; but the Pledge has deficiencies and gaps that render it ineffective in addressing our legitimate concerns.

One of our crucial concerns is the current lack of a clear affirmative obligation on the part of schools and districts to notify parents about what student data is being collected, what data is being shared with which third parties, and under what conditions. Another crucial concern is the lack of a clear legal obligation on the part of schools and districts to notify parents about which vendors the schools have authorized to collect information directly from children in class, as schools – not vendors – are the sole contact point for most parents.

Accordingly, we are writing to urge you to draft legislation that deals with educational and student privacy in a more comprehensive and effective manner. Here is a framework that we respectfully ask you to consider:

• All personally identifiable data collected directly from students, by vendors or other third parties, whether collected in school or assigned by teachers in class or for home, should require that the school provide full notification and informed consent to parents, or to the students themselves if they are over age 18. At a minimum, parents should be informed of what data is being collected, the purpose of the data collection, how long the data will be retained and by whom and where, and the security provisions and safeguarding practices utilized by the third party. As pursuant to COPPA, parents must be afforded the right to opt out of any collection of their child’s data, at any time, if they so choose;
• All disclosures of students’ personally identifiable information by schools, districts, and states to third-parties must require parental notification. There must be written agreements specifying the use of the data, and these agreements must be made publicly available. The agreements should also specify that only employees of the company or organization with a legitimate educational interest be allowed to access it, that adequate breach prevention and notification technologies and policies are in place, including levels and standards of encryptions for data in-motion and at-rest, that independent audits be required, and that the third party will assume financial liability for any damages caused by any breach;
• Parents must be afforded the opportunity and ability to inspect any personal student data that is collected, shared, or warehoused, correct if it is wrong, request that it be deleted, and opt out of further collection;
• Parental consent must be required before any school, district or state can share any student data with any third party that includes sensitive information that could harm a child’s future if breached or abused, including but not limited to their grades, test scores, disabilities, health conditions, biometric information, disciplinary or behavior records;
• There should be an absolute ban on selling any student data, including in case of a bankruptcy, merger, or sale of a company, as well as a ban on using personal student data for advertising or marketing purposes, or for developing or refining commercial products;
• There must be protections against schools or vendors creating “learner profiles” of students, whether through “predictive and adaptive analytics” or other measures. These profiles could lead to a student being stereotyped or their chances of future success undermined;
• Absolutely no re-disclosures or repurposing of personally identifiable student information by third parties without informed parental consent should be allowed;
• Tough monitoring and enforcement provisions should be required, including substantial fines to be levied on any school, state agency, nonprofit organization, or third party vendor that violates the law’s provisions;
• A clear private right of action should be created, with parents afforded the right to sue if schools, districts, state agencies, nonprofit organizations, or third party vendors have violated the law and their children’s privacy;
• Each state must publicly report all the data elements being collected for their state longitudinal student databases, as well as publicly report with which governmental and non-governmental third parties they plan to disclose and/or share such data;
• State advisory boards made up of stakeholder groups, including parents, security experts, and privacy advocates, should be created to ensure that these state longitudinal databases collect the minimum amount of personal data necessary, and develop rigorous restrictions on access to such data;
• Any new federal law should recognize the right of states to legislate more robust requirements and provide for more vigorous privacy and security protections. Federal law should therefore not preempt state laws if such state laws are stronger.

Only if these principles and provisions are adopted in a new federal student privacy law will parents be assured that the unregulated and irresponsible trafficking of personal student data will have been adequately addressed. We thank you for your leadership on this important issue and stand ready to work with you and your colleagues to ensure that a strong, workable federal student privacy law is enacted as soon as possible.

Yours sincerely,

Leonie Haimson and Rachael Stickland

Co-chairs, Parent Coalition for Student Privacy

www.studentprivacymatters.org

[email protected]

303-204-1272

 

For immediate release: January 29, 2015

Contact: Leonie Haimson, [email protected], 917-435-9329                                                                                                                            Rachael Stickland, [email protected], 303-204-1272

Obama privacy bill fails to put children’s safety first

Education Week has gotten hold of a draft student privacy bill out of the White House that from its description is far too weak to satisfy most parents concerned about the use and sharing of their children’s personal data.   The EdWeek article describing the bill is here: http://go.shr.lc/1vahJrs

Said Leonie Haimson, Executive Director of Class Size Matters and co-chair of the Parent Coalition for Student Privacy, “We were startled by the slide released by the White House after the President gave his speech at the FTC that students’ personal data should be able to be sold as long as it was for “educational” purposes.  Student personal data should never be sold, without the knowledge and consent of their parents.  I am very concerned that the Obama administration and the Department of Education  have been captured by the interests of ed tech entrepreneurs, and are members of the cult that believes that outsourcing education and “big data” into the hands of corporations is the answer to all educational ills. This is, after all, the administration that revealed a blind spot as to the need to protect children’s privacy by creating huge loopholes in FERPA in the first place, to encourage the amassing of highly sensitive and confidential student information and allowing it to be disclosed to a wide variety of commercial ventures.”

Rachael Stickland, co-chair of the Coalition for Student Privacy said, “Parents will now fight even harder for a bill that takes their children’s interests into account; that minimizes data sharing without parent notification and consent, and provides for real protections for student privacy and security.  We will continue to speak out until a new law is passed which puts our children’s safety first.  As described by the Ed Week article, the Obama bill clearly does not do the job.”

Weaknesses of the Obama proposal similar to California’s law, according to the EdWeek description:

1. Operators may use personal student information for internal commercial purposes including “for maintaining, developing, supporting, improving, or diagnosing the operator’s site, service or application.”

2. The proposal would allow the use of student information for “adaptive or personalized student learning purposes.” The Parent Coalition for Student Privacy cited this weakness in our press release critiquing the California law here: http://go.shr.lc/1IlSVil

3. Allows the sale of data in mergers and acquisitions “so long as the information remains subject to the same legal protections in place when it was originally collected.” (Quoted section is from EdWeek.)

4. Requires companies to “maintain reasonable security procedures and protocols” for student information, and allow the information to be deleted at the request of a school or district. However, there needs to be specific security and encryption provisions in the law,  as well as parental rights to be notified, consent or delete data.

Areas where the proposal appears to be even weaker than California law:

1. There appears to be no prohibition on vendors amassing profiles of students for non-education purposes. Profiling – whether for targeted advertising or sorting students based on abilities or disabilities – is one of our greatest concerns.

2.  Does not prohibit the collection of student information from an online education site to be used on other commercial websites or services for targeted advertising or marketing purposes. Presumably, this means that if a child uses Google Apps for Education (GAFE), Google would be unable to target ads to the child using GAFE but could target ads to the child on other commercial services linked to Google.  This is entirely unacceptable.

###

For immediate release: January 12, 2015

Contact: Leonie Haimson, [email protected], 917-435-9329;                                                                                                                            Rachael Stickland, [email protected], 303-204-1272

Parent Coalition for Student Privacy on President’s Announcement of Need for New Federal Student Privacy Protections

The Parent Coalition for Student Privacy thanks the President for recognizing the need for new federal student privacy protections, but points out how the California law that the President lauded as a model cannot be used without strengthening its provisions around parental notification, consent, security protections and enforcement.

“Any effort to ban the sale of student information for targeted advertising is a good first step, but the White House’s proposal appears to allow companies to sell and monetize student data for unspecified ‘educational purposes,’ including to develop products that would amass enormous personal profiles on our children. Profiling children based on their learning styles, interests and academic performance and then being able to sell this information could  undermine a student’s future. Parents want to ban sale of student data for any use and demand full notification and opt-out rights before their children’s personal information can be disclosed to or collected by data-mining vendors,” said Rachael Stickland, co-chair of Parent Coalition for Student Privacy.

Leonie Haimson, Parent Coalition co-chair and Executive Director of Class Size Matters said, “We also need strong enforcement and security mechanisms to prevent against breaches.  Schools and vendors are routinely collecting and sharing highly sensitive personal information that could literally ruin children’s lives if breached or used inappropriately.  This has been a year of continuous scandalous breaches; we owe it to our children to require security provisions at least as strict as in the case of personal health information.“

Here is a summary of the gaps and weaknesses in the California student privacy bill, which the President said should serve as a model for a federal law:

• Bans vendors using personally identifiable information (PII) student data to target advertising or selling of data, but not in case of merger or acquisitions, or presumably in case of bankruptcy, as in the recent Connectedu case.  The President’s proposal would be even weaker, as it would apparently allow the sale of student data for unspecified “educational purposes”;
• Only regulates online vendors but not the data-sharing activities of schools, districts or states;
• Provides no notification requirements for parents, nor provides them with the ability to correct, delete, or opt out of their child’s participation in programs operated by data-mining vendors;
• Unlike HIPAA, sets no specific security or encryption standards for the storage or transmission of children’s personal information, but only that standards should be “reasonable”;
• Allows tech companies to use children’s PII to create student profiles for “educational” purposes or even to improve products;
• Allows tech companies to share  PII with additional and unlimited “service” providers, without either parent or district/school knowledge or consent – as long as they abide by similarly vague “reasonable” security provisions;
• Allows tech companies to redisclose PII for undefined “research” purposes to unlimited third parties, without parental knowledge or consent –without requiring ANY sort of security provisions for these third parties or even that they have recognized status as actual researchers;
• Contains no enforcement or oversight mechanisms;
• Would not have stopped inBloom or other similar massive “big data” schemes designed to hand off PII to data-mining vendors – and like inBloom, would also be able to charge vendors or “service providers” fees to access the data, as long as states/districts consented.

###