Safeguarding Student Data

While technology has opened new doors for teachers, the use of innovative technology in the classroom has resulted in the collection of sensitive student data. Many state lawmakers are now acting to secure vulnerable student information, while also allowing for the educational edge technology provides.

According to the Data Quality Campaign, 110 student data privacy bills were introduced in 2014, 180 student privacy bills were introduced in 2015, and 112 student data privacy bills were introduced in 2016—all at the state level.
“Technology is an important component in today’s classroom,” Kentucky state Rep. Steve Riggs said. “But it’s imperative that policies and procedures are in place to protect students vulnerable to data breaches.”
Kentucky House Bill 232, sponsored by Riggs in 2014, requires consumer notification when a data breach reveals personally identifiable information and prohibits cloud computing service providers contracting with educational institutions from processing student data for advertising purposes, or selling, disclosing or processing student data for any commercial purposes.
“The bill originally just focused on cyber liability insurance policies,” Riggs said. “When it came to our attention that some companies were mining student data, an amendment was proposed to further extend the issue of data security to include data collected from students.”
From names and addresses to family income, record keeping has always been a practice for schools. As these records moved from pen and ink to the virtual cloud, data has not only become more useful, but also more vulnerable.
The federal government initially took on privacy of student education records with the Family Educational Rights and Privacy Act, or FERPA, in 1974. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA gives parents rights to their children's education records, and these rights transfer to the student when he or she reaches the age of 18.
According to the U.S. Department of Education’s website, schools must obtain written permission from the parent or student in  rder to release information from a student's record. However, schools may disclose information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance without prior consent.
This information is available to school officials and other similar groups, but revisions to FERPA in 2008 allow educational  institutions to disclose information and personally identifiable information without prior consent to contractors, volunteers, or other nonemployees performing services for the educational institution if the request is based on legitimate educational interest. This is what has led many states to enact further protections for student data.
In 2016, Arizona passed House Bill 2088, dubbed the “informed consent act,” that requires schools to gain written parental consent before administering surveys that gather information about students such as gun ownership, political affiliations, religious practices, etc. It also restricts non-test data from being included in a state’s longitudinal data system. 
HB 2088 bill sponsor, Arizona state Rep. Mark Finchem, said he introduced the bill because parents were concerned about the growing number of surveys being administered in schools without parental review or consent. Finchem, who compared the data collection world to the “wild west,” said parents need to be the first line of defense for children.
“Many parents had had enough of the intrusion into their lives and were not comfortable with the amount of information being collected,” Finchem said. “Parents were asking, ‘Wheredoes this stop?’”
According to Finchem, claims that student data collection help improve education are not enough to justify the practices that were in place. “Education was never meant to be a factory,” Finchem said. “The real mission is to provide a quality education.”
While some lawmakers and parents are fearful sensitive student data will be used by companies for profit, or be compromised by hackers, there is research that shows data collection—when done responsibly—has benefits in the form of educational and economic outcomes.
In fact, a 2013 summary of research from the Appalachia Regional Comprehensive Center on the role of technology in student learning found that while no single research study can address the general question of whether technology improves student outcomes, there is evidence that technology can boost student knowledge and skills.
The summary referenced a report from Johns Hopkins University Center for Research and Reform in Education that analyzed 84 studies to compare the impact of various technologies on K-12 reading achievement and found that computer-assisted instruction, along with other activities in a reading program produced the largest improvements in reading scores.
In addition, a 2013 report from the McKinsey Global Institute showed the exchange of educational data could add as much as $1.2 trillion to the economy through more efficient, effective instruction.
One example of how technology in education is producing outcomes is AT&T’s Aspire program. It has invested $400 million since 2008 to support student success through developing educational applications and curriculum, creating online educational pathways to industry-relevant skills and providing young people across the country with mentoring by AT&T employees.
“Education has always been an important part of what we want to invest in. Because we want a great workforce coming along, we want to continue being an innovative company and you can’t do that without having young people prepared with the skills to go in and do it,” said Nicole Anderson, president of the AT&T Foundation. “That is why we invest in education and one of the best ways you can invest in education is through technology.”
AT&T expanded this program to the Aspire Accelerator program that aims to enhance education by supporting and mentoring promising and innovative startups in education technology. The companies from the first two classes of the AT&T Aspire Accelerator have reached more than 4 million students and are exceeding industry growth rates.
“Folks in the education space are very comfortable with technology in the classroom. There is a rapid acceptance and adoption in using these tools,” Anderson said. “It’s become more commonplace for people to have these tools. Technology is advancing rapidly and I think the kids are driving this change as well.”
And it’s not just state lawmakers who are stepping up to protect kids’ data. AT&T along with companies such as Microsoft, Apple and Blackboard have recently signed on to the Student Privacy Pledge.
The pledge, now with 316 signatories, requires school service providers to not collect, maintain, use or share student personal information beyond what’s needed for authorized educational purposes, to not sell student personal information, to maintain a comprehensive security program, and other steps that aim to keep students data secure.
“Since AT&T is a tech company, we know that the best way to get to underserved and at-risk populations, and distribute and scale quality education, is to do that through technology and take our core competency and put it forward,” Anderson said. “So, by being interested in that space and putting our philanthropic mic there, we also want to be sure we are safeguarding—and the groups we work with are safeguarding—the information of the students while also helping them improve their academic outcomes in that space. Student privacy is something wetake seriously and that’s why it was important for AT&T to sign the Student Privacy Pledge and to be part of that conversation.”