Category Archives: Student Data Privacy

Every year, parents of junior and senior high school students are inundated by marketing materials from hundreds of post-secondary public or private schools and for-profit trade schools – many you might never have heard of before. One of the common statements I hear is “How did my son or daughter’s name and address get out?” Welcome to the new age of big data.

Anya Kamenetz, NPR’s Lead Education Blogger, wrote a great article published on NPRed entitled, What Parents Need To Know About Big Data And Student Privacy.

In her article she explains the main law that governs data kept by public schools is based on the 1974 Family Educational Rights and Privacy Act, or FERPA. It gives parents and students, once they turn 18, three rights: to inspect their own records, to correct those records, and to give consent in writing before the release of those records to any third party.

Kamenetz writes, “Well, for the most part. There are two blanket exemptions. One covers the “what” (of student information) and the other the “who” (is authorized to see it).”

According to Sheila Kaplan, a privacy activist mentioned in Kamenetz article, “The big hole in FERPA is directory information”. She explains: FERPA allows schools to release a student’s “name, address, telephone number, date and place of birth, honors and awards, and dates of attendance” without first obtaining consent (although they are supposed to disclose the release and allow parents to opt out of directories).

The second hole got much, much wider in the past few years.

FERPA always allowed school officials to release records to other education officials without parental consent. In 2008, that right was expanded to contractors and volunteers, as long as they were under “direct control” of schools. This included for-profit cloud service providers.

Are Marketers Providing a Service or Simply Making Money?

One of the concerns that Kamenetz raises in her article is whether student data will be monetized. It already has – in a billion dollar way. Reidenberg’s study found that fewer than 7 percent of district contracts restricted the sale or marketing of student information by vendors. It did not, however, say how many of the cloud service providers are actually selling that info. And who are these vendors?

You don’t have to look any further than your local school board and junior high and high school counselors. They have likely signed “site licenses” with cloud based solution providers such as XAP (“XAP Corporation is the pioneer in electronic and Internet-based information management systems for college-bound students and the leader in online data”) or Naviance, a program of Hobsons. XAP’s privacy statement states that “We will not share your personal information with outside parties except when we have your permission or we are required by law to provide it.” As the saying goes, the devil is in the details. You are giving your permission and they are selling your information.

At the College Board, their privacy policy states “Our Student Search Service is a voluntary program that connects students with information about educational and financial aid opportunities from more than 1,200 colleges, universities, scholarship programs and educational organizations. According to their policy, here’s how it works:

• Students may choose to participate in Student Search Service when registering for a College Board exam.
• As part of taking a College Board exam, students are asked to fill out a Student Data Questionnaire (SDQ).
• Participating, eligible organizations can then search for groups of students who may be a good fit for their communities and programs, but only among those students who opt to participate in Student Search Service.
• The search criteria can include any attribute from the SDQ, except the following: disability, parental education, self-reported parental income, social security number, phone numbers and actual test scores.
• The most searched items are expected high school graduation date, cumulative GPA and intended college major. A full list of SDQ questions is available in College Board test registration materials.

According to Kamenetz, often the issue is murkier than the outright sale of information. For many cloud services, like Google Apps, the entire business model is based on mining data for marketing. “A quarter of the services are free to the districts — the providers are monetizing it somehow,” Reidenberg says. Even the nonprofit Khan Academy allows third parties like Youtube to track students’ Web usage.

In practice, defining the commercial misuse of student data is tricky. A program such as Pearson’s enVisionMATH, a software-based tutoring platform, continuously analyzes millions of data points on student performance in order to improve its products and pitch more relevant products to school systems. That’s both an educational and a commercial use.