#Schoolprivacyzone: emerging best practices for a contentious issue

Advocacy group Common Sense Media held a summit in Washington, DC on Monday as part of a national campaign on the highly contested topic of student data privacy.

The results of Common Sense Media's January survey show most parents concerned about student privacy.

The results of Common Sense Media’s January survey show most parents concerned about student privacy.

A recent study by Fordham University Law School found that as schools and districts adopt cloud computing services, they are transferring student information to third-party providers, often leaving it open to data mining and commercial purposes such as reselling and ad targeting. These services may be in violation of federal law. These agreements allow vendors to do whatever they want with student demographic records and other personal information. Of the districts studied, fewer than 25% of the agreements between districts and vendors specified the purpose for disclosures of student information, and fewer than 7% restricted the sale or marketing of student information by vendors in any way. And that is to say nothing of the risk of hacking or other security breaches.

There are a number of attempts in the works to establish better guidelines for the $8 billion educational software industry. The Software&Information Industry Association, a trade group, yesterday announced a list of best practices for agreements between software groups and schools:

That data should be used only for educational purposes, that its use should be fully disclosed and transparent and full consent obtained from families, that all reasonable security procedures should be followed and schools be notified in case of actual data breaches.

Even as the industry is taking baby steps to govern itself, lawmakers are converging on a solution with more teeth. California State Senator Darrell Steinberg just introduced a bill in that state enforcing some of these same principles: educational purposes only, encryption and deletion of data. Massachusetts Senator Ed Markey plans to do the same at the federal level.

At the Common Sense Media event, according to the lively discussion on Twitter, industry representatives like Cameron Evans of Microsoft and Joel Klein of Amplify argued that a rush to legislate might cause more problems than it solves. Best practices for data privacy and security continue to evolve as the technology does. The large-scale use of cloud computing and web-based data storage itself dates back only to the mid-2000s. It is difficult for the law to catch up. Also, while contracts may specify “educational purposes only,” the nature of the beast in ed-tech is that a large source of educational innovation is coming from for-profit startups whose involvement with the day-to-day experience of teachers and students is becoming increasingly intimate, if not intrusive. In practice the line between educational and commercial purposes may be somewhat blurry. As Katherine Varker, Associate General Counsel, McGraw-Hill Education, asked at the summit: ‘Where does targeted advertising end and personalized learning begin?’

 

Big data and schools: Education nirvana or privacy nightmare?

InBloom, a nonprofit start-up founded with funding from the Bill & Melinda Gates Foundation and Carnegie Corporation, is taking center stage and spreading around some significant funds as an official sponsor of the South by Southwest Education conference in Austin, Texas this week. It hosted the official opening night party on Tuesday, is sponsoring a “networking lounge” with free coffee and snacks at the Hilton next to the convention center, and is debuting the first live demonstrations of its technology with representatives from pilot districts and states.

SAMSUNG

Iwan Streichenberger

It’s quite a splash for what is basically a highly technical, behind-the-scenes infrastructure company. InBloom promises to bring all the potential of “big data” to classrooms in a big way for the first time. Its stated mission: to “inform and involve each student and teacher with data and tools designed to personalize learning.”

“We want to make personalized learning available to every single kid in the U.S.,” says CEO Iwan Streichenberger. “The way you do this is by breaking the barriers—making data much more accessible.”

But to some educational activists, InBloom represents a danger, not an opportunity.

InBloom began as the Shared Learning Collaborative in 2011. It gets a bit technical, but basically, 10 districts in nine states agreed to build a shared technology infrastructure. Currently, student data—from attendance to standardized test scores—are locked in dozens of different “student information systems” that don’t talk to each other. “In one district we work with in Massachusetts, teachers had to use 20 different assessment storage places with different log-ins,” says Streichenberger.

InBloom offers a single middleware layer that hosts student data using Amazon Web Services, with some centralized dashboard-style functions and an API (application programming interface) that would allow start-ups to build education apps, aligned with Common Core standards, that anyone could use. It’s a similar strategy to how Facebook and Apple allow outside developers to build apps that pull your profile information from the cloud. Instead of designing for  thousands of school districts across the country, all of whom have their own idiosyncratic data storage systems, the InBloom platform will eventually allow developers to build one application—like DreamBox, a differentiated math game, or Kickboard, a dashboard program that allows teachers to track students’ performance and behavior—and have it work automatically in several states. This coordination, in turn, is likely to attract even more technology entrepreneurs to a market for educational IT spending estimated to be worth $20 billion in 2013. And similar to the way that electronic health records promise to reduce costs and increase efficiency and effectiveness in medicine, the use of centrally hosted data, says Streichenberger, offers similar cost savings and improvements in education.

But the very moves that make this idea a huge opportunity from the point of view of edtech entrepreneurs—the ability to find a large market for learning games and systems all in one place, to pull student data automatically, and to coordinate effortlessly with other apps—makes parents “horrified,” in the words of school activist Leonie Haimson of Class Size Matters.

“There are no limitations on the time-frame, or the kind of data. There’s no provision for parental consent or opt-out. The point is to give our kids’ data away for free, and share it as widely as possible with for-profit ventures to help them market and develop their learning products,” she says. “For-profit vendors are slavering right now at the prospect of being able to get their hands on this info. and market billions of dollars of worth of so-called solutions to our schools.”

Class Size Matters has been working with a lawyer to get public access to the agreements between InBloom and the nine states that are members of the collaborative (New York, Massachusetts, Louisiana, Colorado, Illinois, North Carolina, Georgia, Delaware and Kentucky), to learn under what circumstances student data will be released, and whether there are potential violations of FERPA, the Family Educational Rights and Privacy Act, which generally requires written consent from parents to release the records of students under 18. They are also trying to get states to agree to opt-out policies so parents can withhold children’s information from InBloom, especially sensitive information like disciplinary records, health records, and personally identifiable details like addresses.

Streichenberger says that InBloom’s terms of service are fully compliant with FERPA, but privacy policies—including parental notification and opt-out—will be in the hands of individual districts, which will hold and control all access to the data that InBloom hosts. “Privacy is a very emotional issue,” he says. “I have two children, four and six. I would never join InBloom if I thought it would compromise my kids.” At the same time, he says, “The privacy discussion is an important one, but one of my concerns is it’s preventing the discussion of what’s going on in the classroom. Are we preparing the children for the future? Do we have the tools to prepare them for the jobs of tomorrow?”

So far, Haimson says, her group has generated thousands of letters from parents concerned about their students’ privacy to the Gates Foundation and to individual states. She says that her biggest problem in spreading the word is that many parents don’t believe this is really happening. “Parents are outraged and can’t believe it’s legal,” she says. “The tech companies and foundations shrug their shoulders. People are living on two separate planets.”

Note: The Bill & Melinda Gates Foundation and Carnegie Corporation are among the various funders of The Hechinger Report.