Student Data Privacy
Kristina Helrigel
Table of contents
1. Student Data Privacy
a. What is it?
b. Why protect it?
2. FERPA
a. What is it?
b. Examples
3. PPRA
a. What is it?
b. Examples
4. COPPA
a. What is it?
b. Where do schools get involved?
c. Examples
b. How schools are involved
Table of contents
c. Examples
5. CIPA
a. What is it?
b. Why must schools comply?
c. Impact on school libraries
d. CIPA and book banning
e. My thoughts on book banning
f. Examples
6. Differences between the laws
7. What it means for teacher instruction
8. Platforms we cannot use
What is Student Data Privacy?
Data privacy refers to an individual’s right to control how personal information about them is collected and used, particularly by digital systems.
Student data, specifically, refers to students’ Personally Identifiable Information (PII), which is any information that can be used to distinguish or trace an individual’s identity either directly or indirectly through linkages with other information.
Any data about a student’s identity that is particular to an individual student is PII. Types of PII/student data include students’ names, dates of birth, home addresses, home languages, demographic information, school and grade level, education records, class schedules, special needs (IEP status), school ID numbers, phone numbers, email addresses, and online usernames.
Why Protect Student Data Privacy?
Students have a right to privacy. As technology advances, it is being implemented more and more in schools. While the internet can be useful and enhance student’s learning, the expansion in technology has resulted in an increased number of cyber attacks and privacy breaches. Districts have the power and responsibility to promote student safety by ensuring the protection of student data privacy.
What is FERPA?
FERPA stands for Family Educational Rights and Privacy Act. This law provides parents the right to have access to their children’s education records, the right to seek and have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. These rights transfer to the student when they reach the age of 18 or attend a school beyond the high school level. The schools, however, may disclose, without consent, “directory” information which includes the student’s name, address, phone number, date and place of birth, honors and rewards, and dates of attendance.
What is FERPA?
FERPA allows schools to disclose student records, without consent, to the following parties and/or under the following conditions: school officials with legitimate educational interest, other schools to which a student is transferring, specified officials for audit or evaluation purposes, appropriate parties in connection with financial aid to a student, organizations conducting certain studies for or on behalf of the school, accrediting organizations, to comply with a judicial order or lawfully issued subpoena, appropriate officials in cases of health and safety emergencies, or state and local authorities, within a juvenile justice system, pursuant to specific State law.
Examples of FERPA
Some examples of FERPA violations include: sharing student information via email, exposing social security numbers, posting grades publicly, and revealing a student athlete’s academic status.
Examples of education records that are not to be shared include academic evaluations, such as student examination papers, transcripts, test scores, and other academic records, general counseling and advising records, disciplinary records, and financial aid records, including student loan collection records.
What is PPRA?
PPRA stands for Protection of Pupil Rights Amendment.This federal law provides certain rights for parents of students—and students once they are 18 years old—regarding, student participation in surveys, the inspection of instructional material, certain physical exams, and the collection, disclosure, and use of personal information for marketing purposes.
What is PPRA?
Under this law, consent is needed before a student submits a survey that concerns one or more of these eight protected areas: (1) political affiliations or beliefs of the student or student’s parents, (2) mental or psychological problems of the student or student’s family, (3) sex behavior or attitudes, (4) illegal, anti-social, self-incriminating, or demeaning behavior, (5) critical appraisals of others with whom respondents have close family relationships, (6) legally recognized privileged or analogous relationships, such as with lawyers, doctors, or ministers, (7) religious practices, affiliations, or beliefs of the student or student’s parent, (8) income, other than as required by law to determine program eligibility.
What is PPRA?
Also, under this law, students and parents will receive notice and an opportunity to opt a student out of any protected information survey administered or distributed to a student by any local educational agency that is a recipient of funds under an applicable program (LEA) if the protected information survey is either not funded as part of a program administered by the Department or is funded as part of a program administered by the Department but to which a student is not required to submit, any non-emergency, invasive physical examination or screening required by an LEA as a condition of attendance; administered by the school and scheduled by the school in advance; and, that is not necessary to protect the immediate health and safety of a student, with some exceptions or activities of an LEA involving collection, disclosure, or use of personal information collected from students for the purpose of marketing or sale (or to otherwise, distribute such information to others for that purpose), with some exceptions.
What is PPRA?
Upon request, students and parents may inspect protected information surveys and surveys created by a third party, before the administration or distribution by an LEA of the surveys to a student, any instrument used by an LEA to collect personal information for the purpose of marketing or sale (or otherwise distributing such information for that purpose), before the instrument is administered or distributed to a student, with some exceptions or, instructional material, excluding academic tests or academic assessments, used by an LEA as part of the educational curriculum for a student.
Examples of PPRA
Some examples of surveys commonly used by schools that may touch upon one or more of the eight protected topics are college admissions surveys, career interest surveys, social-emotional learning surveys, school climate surveys, mental health screening, threat assessment screenings, and community health screenings.
What is COPPA?
COPPA stands for Children’s Online Privacy Protection Act. This law provides parents with control over what information websites can collect from their children. It also imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information from a child under 13 years of age.
What is COPPA?
COPPA requires that operators post a “clear and comprehensive” online privacy policy, give parents “direct notice” before collecting information from children under 13, obtain “verifiable parental consent” before collecting such information, allow parents to review their children’s information, and request that it be deleted, allow parents to opt out of further collection, use, or sharing of information pertaining to their child, maintain the confidentiality and security of any child’s information that is collected, and delete children’s information after it is “no longer necessary to fulfill the purpose for which it was collected”.
What is COPPA?
COPPA covers personal information such as first and last name, a home or other physical address including street name and name of a city or town, online contact information, a screen or user name that functions as online contact information, a telephone number, a Social Security number, a persistent identifier that can be used to recognize a user over time and across different websites or online services, a photograph, video, or audio file, where such file contains a child’s image or voice, geolocation information sufficient to identify street name and name of a city or town, information concerning the child or the parents of that child that the operator collects online from the child and combines with an identifier described above.
Where do schools get involved?
Many school districts contract with third-party website operators to offer online programs solely for the benefit of their students and for the school system. In these cases, the schools may act as the parent’s agent and can consent under COPPA to the collection of kids’ information on the parent’s behalf.
With this, schools and operators should consider their obligations under FERPA and PPRA.
It is recommended by the Federal Trade Commission that schools or school districts decide whether a particular site’s or service’s information practices are appropriate, rather than delegating that decision to the teacher.
The school should consider providing parents with a notice of the websites and online services whose collection it has consented to on behalf of the parents under COPPA.
Examples of COPPA
Examples of “collecting” personal information under COPPA include: requesting, prompting, or encouraging the submission of information, even if it is optional, allowing information to be publicly available (for example, with an open chat or posting function), and passively tracking a child online.
New Proposed
Amendments
Here is a link to an article discussing new proposed amendments under COPPA
FTC Publishes Proposed Amendments to COPPA Rule | WilmerHale
https://www.wilmerhale.com/en/insights/blogs/wilme rhale-privacy-and-cybersecurity-law/20240112-ftc-pub lishes-proposed-amendments-to-coppa-rule
What is CIPA?
CIPA stands for Children’s Internet Protection Act. This law addresses concerns about children's access to obscene or harmful content over the internet. It imposes certain requirements on schools or libraries that receive discounts for internet access or internal connections through the E-rate program. The E-rate program helps eligible schools and libraries by making certain communications services and products more affordable.
What is CIPA?
Under CIPA, schools and libraries may not receive the discounts offered by the E-rate program unless they certify that they have an internet safety policy that includes technology protection measures that block or filter internet access to pictures that are obscene, contain child pornography, or are harmful to minors.
Schools subject to CIPA have additional certification requirements. Their internet safety policies must include monitoring the online activities of minors. They also must provide education for minors about appropriate online behavior, including interacting with other individuals on social networking websites and in chat rooms, and cyberbullying awareness and response.
What is CIPA?
Schools and libraries subject to CIPA are required to adopt and implement an Internet safety policy addressing access by minors to inappropriate matters on the internet, the safety and security of minors when using electronic mail, chat rooms, and other forms of direct electronic communications, unauthorized access, including so-called “hacking”, and other unlawful activities by minors online, unauthorized disclosure, use, and dissemination of personal information regarding minors, measures restricting minors’ access to materials harmful to them.
Schools and libraries also must hold a public meeting to discuss their approach to an Internet Safety Policy.
Why must schools comply?
In short, these are the four rules that schools must follow to comply with CIPA: (1) create an internet safety policy, (2) install a technology protection measure (a filter), (3) a public notice and meeting, and (4) education for students.
It is important that schools comply with this law for the safety of the students. By following each step of the law, it enforces safety precautions to protect the students during their time on the internet.
Also, if schools fail to comply, they will not receive E-rate funding. Schools certifying that their institution is in compliance with this law is a condition of receiving E-rate funding for internet services.
How does this law directly affect school libraries?
School libraries serve as information centers and provide the tools for research done by students. The American Library Association (ALA) believes that CIPA is unconstitutional in the context of public and school libraries. They say that “The filtering mandate imposed by Congress imposes restrictions on access to constitutionally protected speech on the patrons served by libraries. Restrictions on access to speech in the library are antithetical to the mission of the library to provide patrons with unfettered access to all available and constitutionally protected speech.”
Here is a link to a lawsuit from ALA challenging CIPA
ALA files lawsuit challenging CIPA | Advocacy, Legislation & Issues
https://www.ala.org/advocacy/advleg/federallegislation/ cipa/alafileslawsuit
CIPA and banned books in school libraries
Book banning, a form of censorship, occurs when private individuals, government officials, or organizations remove books from libraries, school reading lists, or bookstore shelves because they object to their content, ideas, or themes. Those advocating a ban complain typically that the book in question contains graphic violence, expresses disrespect for parents and family, is sexually explicit, exalts evil, lacks literary merit, is unsuitable for a particular age group, or includes offensive language.
My thoughts on book banning and censorship
I think book banning is far too often taken to an extreme. Instead of looking for books that are actually harmful to readers/students people are instead putting their political beliefs forth and basing their bans on that. Too often books discussing race, sexuality, or LGBTQ+ communities are being found “inappropriate” through inaccurate accusations. While looking through lists of banned children’s books, the reasons for them being challenged are unbelievable and quite frankly sad. Books are an amazing tool for students to use to learn about life. This includes not only how it looks for them but how it looks for others too. They help show the various experiences people face based on who they are. In most cases, books about diverse people and experiences help educate people and help them avoid/get rid of any biases against minorities of any group…they do not “push their ideas” on readers or “force them” to be like the characters they read about.
Examples of CIPA
Differences between the laws
FERPA protects information that the school district already has about the student (student education records).
PPRA protects information that the district does not have, but might otherwise obtain from the student that is private in nature.
COPPA addresses data protection regulations for children under the age of 13 regarding websites or online services.
CIPA governs the filtering of Internet access, acceptable use, and digital citizenship education.
Which laws influence teachers’ instructional choices?
With FERPA, teachers need to be careful about where they keep or put student information such as advising notes, examinations, or grading sheets. A common FERPA violation happens when teachers leave student data out on their desks or up on their computer screens.
With PPRA, all instructional material—including teachers' manuals, films, tapes, or other supplementary instructional material—that will be used in connection with any research or experimentation program or project shall be available for inspection by the parents or guardians of the children engaged in such program or project. It is important for teachers to keep this in mind when planning to ensure none of their instructional strategies or material violate any of the eight areas under PPRA.
Which laws influence teachers’ instructional choices?
With COPPA, teachers need to be aware of what this law requires for the technology and sites they use in the classroom. If a website or program is beyond what the district as a whole uses, teachers need to be careful and look into what information it requires of the students and if it is compliant with COPPA.
With CIPA, school districts may adopt filters that over-restrict what can be used and this may disrupt teachers’ instruction if a website cannot be accessed. However, teachers can work with their district to that their adopted filters and policies are flexible and have the fewest possible restrictions on student searches and access—all while maintaining CIPA compliance.
Online technology platforms teachers cannot use
The main concern under these Student Data
Privacy laws, is that teachers cannot use websites that collect personal data from children without parent consent (COPPA).
Examples of a Website that violated COPPA
Edmodo collected personal data from children without obtaining their parent’s consent and used that data for advertising.
FTC Says Ed Tech Provider Edmodo
Unlawfully Used Children’s Personal Information for Advertising and Outsourced Compliance to School Districts (Link to Article)
References
Student Data Privacy
https://studentsupportaccelerator.org/tutoring/data-use/measures-data-co llection/student-data-privacy-guidance#:~:text=FERPA%20protects%20the %20access%20to,who%20else%20can%20access%20them.
https://www.edutopia.org/article/protecting-student-data-privacy/#:~:text= Although%20digital%20tools%20can%20enhance,protection%20of%20stud ent%20data%20privacy.
FERPA
https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html
https://studentprivacy.ed.gov/faq/what-ferpa
https://www.jotform.com/what-is-ferpa/#:~:text=Examples%20of%20FERPA %20violations%20include,a%20student%20athlete's%20academic%20statu s.
https://www.jefferson.edu/life-at-jefferson/handbooks/policies/undergradu ate-policies/ferpa-student-record-access-and-confidentiality.html#:~:text= Examples%20of%20education%20records%20include,including%20student %20loan%20collection%20records.
PPRA
https://studentprivacy.ed.gov/training/what-protection-pupil-rights-amen dment
References
PPRA
https://studentprivacy.ed.gov/resources/protection-pupil-rights-amendmen t-ppra-general-guidance
https://studentprivacycompass.org/faqs-ppra/ COPPA
https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy
https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-prot
ection-rule-coppa
https://www.edweek.org/technology/coppa-and-schools-the-other-federal-s
tudent-privacy-law-explained/2017/07
https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cyb
ersecurity-law/20240112-ftc-publishes-proposed-amendments-to-coppa-rul e
https://www.freeprivacypolicy.com/blog/coppa/ CIPA
https://www.fcc.gov/consumers/guides/childrens-internet-protection-act
https://e-ratecentral.com/Resources/Educational-Information/CIPA
https://www.ala.org/advocacy/advleg/federallegislation/cipa/schoolsandcipa
https://www.ala.org/advocacy/advleg/federallegislation/cipa/alafileslawsuit
https://firstamendment.mtsu.edu/article/book-banning/#:~:text=Book%20b anning%2C%20a%20form%20of,content%2C%20ideas%2C%20or%20themes.
https://managedmethods.com/blog/hybrid-learning-cipa-compliance/
Videos and Extra References
FERPA
https://youtu.be/vDkFaW2JuU4?si=tQK9nuck7j1qeGlyv PPRA
https://youtu.be/RU9Ot-Vaehc?si=zNQEBDtLn8Llivf5
https://youtu.be/xuPxvdlAKRE?si=-S5A9MmYIMCkD-ph
CIPA
https://youtu.be/PmO-Uw9_ta4?si=Tv8vv4r7-MAvBCbM
https://youtu.be/6bVKQ8Wwfo0?si=UQAuvMY4BLSMHWQR Differences
https://www.pullcom.com/education-law-notes/what-is-the-difference-bet
ween-ferpa-and-ppra-protecting-student-privacy-and-confidential-educati
on-records#:~:text=A%20very%20simplified%20explanation%20of,that%20is %20private%20in%20nature.
https://educationframework.com/resources/student-privacy-laws/federal-la
ws#:~:text=FERPA%2C%20or%20the%20Family%20Educational,under%20th e%20age%20of%2013
https://www.eastgreenwich.k12.nj.us/Page/3767#:~:text=Established%20by% 20the%20FCC%2C%20the,students%2Fchildren%20and%20their%20records.
Videos and Extra References
Teacher Instruction
https://www.dremilywhitehorse.com/blog/ferpa-the-hipaa-in-education#:~:t ext=BE%20MINDFUL!,open%20with%20student%20data%20displayed. .
https://studentprivacy.ed.gov/content/ppra
https://learnsafe.com/how-coppa-affects-schools/
https://resilienteducator.com/classroom-resources/how-internet-filtering-aff ects-education/
Online Technology Platform Violations
https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ed-t ech-provider-edmodo-unlawfully-used-childrens-personal-information-adv ertising
