Educational technology has demonstrated numerous benefits for both educators and students; however, recent advancements are not without concerns.
As ed tech becomes more prevalent in the classroom, privacy rights activists and the Federal government are growing concerned about how sensitive student data is being handled and secured.
The Center for Democracy & Technology, along with the law firm BakerHostetler, developed a state-by-state compendium of privacy laws relating to the collection, use, and sharing of student data.
While the practice of collecting data about students is not new–schools have been gathering and reporting test scores, grades, retention records, and the like for years–the means by which student data is collected, the types of data collected, and the entities that ultimately have access to this data have expanded dramatically, the report explains.
In order to understand the laws on a state level, as well as in a regional and national context, let’s look at each state and regional individually, using the United States Census Bureau’s four statistical regions–the Northeast, Midwest, South, and West.
Northeast
- Connecticut–Connecticut does offer strong definitions of what are considered educational records and student data, meaning that if the right laws are in place, students would be well protected. However, the Nutmeg State doesn’t codify any rules regarding data retention limits or the requirement of de-identification or aggregation of data. Additionally, the state’s Department of Education is charged with the development of a statewide school information system, which tracks student data while maintaining its confidentiality. However, according to the report, educational records “which are not subject to disclosure under FERPA (Family Educational Rights and Privacy Act” are excluded.
- Maine–Maine provides detailed definitions for both educational record and student data. According to the report, the state also prohibits a third-party operator from using student data to engage in targeted advertising, amass a profile of a student except for K-12 purposes, sell student data, or otherwise disclose student personally identifiable information unless the disclosure is made pursuant to a limited set of exceptions. However, the report also notes that third-party operators may disclose student personally identifiable information for limited purposes including, but not limited to, advancing the K-12 school purposes of the operator’s website, service, or application, as long as the recipient of the student data disclosed may not further disclose the student data other than to allow or improve operability and functionality of the website, service, or application for use in the classroom. The state also requires third-party operators to delete student data within 45 days of their request and maintain safeguards to protect data under their control.
- Massachusetts–Regulations in the Bay State provide a definition for educational record, but not student data. Additionally, regulations prohibit sharing of student data except in limited circumstances. The state also has security protocols, data reduction policies, and de-identification rules in place. How long the state can keep student data depends on what type of data it is. Student transcripts must be kept for 60 years after a student has left the school; whereas, a student’s temporary record must only be kept for seven years after a student graduates.
- New Hampshire–In addition to providing detailed definitions, the state also prohibits student data to be shared with third parties, except under limited circumstances. The state also has security protocols and data disposal policies in place. In terms of de-identifying data, the report notes that an operator may use de-identified student covered information within the operator’s [service] or other [services] owned by the operator to improve educational products and to demonstrate the effectiveness of the operator’s services, including in its marketing. An operator may further share aggregated de-identified student covered information for the development and improvement of educational sites, services, or applications.
- New Jersey–New Jersey regulations provide strong definitions for data privacy related words. Additionally, the Garden State doesn’t allow student data to be shared, has regulations regarding data disposal and security protocols, and requires data used for research to be de-identified.
- New York–While statutes do refer to educational records, no definition is provided; however, New York does provide a definition of student data. New York has extremely lengthy regulations regarding sharing data with a third party, including requiring the third party to notify the state if they ever experience a data breach, requiring them to use encryption technology and maintain safeguards to protect data. Additionally, the report explains that the state allows an educational agency to opt out of providing personally identifiable information of a student to a “shared learning infrastructure service provider” or data dashboard operator for the purpose of creating data dashboards. This request must be made directly to the New York State Education Department. According to the report, the state is developing security protocols, data minimization policies, and de-identification requirements.
- Pennsylvania–Pennsylvania provides adequate definitions for educational records and student data. Additionally, the state has provided security protocols and requires data used in reports to be used in aggregate. The state isn’t allowed to share student data except in limited circumstances and with security controls in place. For instance, data can be shared with researchers as long as the researcher doesn’t disclose the data to a third party and if the data is destroyed after the research is completed. However, the Keystone State hasn’t codified data retention limits with respect to K-12 educational records, according to the report.
- Rhode Island–The Ocean State provides adequate definitions for words concerning student data privacy, as well as prohibiting student data to be used for any commercial purposes. Educational institutions are also required to submit records control schedules to the public records administration program. Additionally, Rhode Island also has a “Children’s Cabinet” within its executive branch that oversees security protocols concerning student data. However, the state doesn’t have regulations regarding de-identification or aggregation of data.
- Vermont–The state doesn’t have any definitions in its statutes; however, in 2008, the Department of Education approved a data suppression policy for student information that applies to all Vermont Department of Education contracts and reports as well as those generated by third parties working on its behalf. So, while there are few state statutes governing student data, the data suppression policy does discuss many issues. According to the data suppression policy, all analysis of student-level data must take place on a Vermont Department of Education network, and personally identifiable student information may not be removed from a Vermont Department of Education network. The state also requires that student data used for research or analysis must be de-identified by a Vermont Department of Education staff member.
Also in this Report:
Regional Analysis of State Student Data Privacy Laws: South
Alabama, Arkansas, Delaware, Florida, Georgia, Kentucky, Louisiana, Maryland, Mississippi, North Carolina, Oklahoma, South Carolina, Tennessee, Texas, Virginia, Washington, D.C., West Virginia
Regional Analysis of State Student Data Privacy Laws: West
Alaska, Arizona, California, Colorado, Hawaii, Idaho, Montana, Nevada, New Mexico, Oregon, Utah, Washington, Wyoming
Regional Analysis of State Student Data Privacy Laws: Midwest
Illinois, Indiana, Iowa, Kansas, Michigan, Minnesota, Missouri, Nebraska, North Dakota, Ohio, South Dakota, Wisconsin
