Enhancing Student Data Privacy in Education Systems

1. Education Data Privacy PanelJuly 2014Prepared for AASA Panel DiscussionContact David DeSchryver, Co-Director, Whiteboard Advisors www.whiteboardadvisors.com

2. About W/A • Education policy counsel • Proprietary research and analysis • Strategic planning • Implementation & support • Leadership development and facilitation Whiteboard Advisors provides technical support and analysis of federal funding and policy issues for district, state and school leaders. We also provide implementation support and can assist with the design of innovative educational programs. Our team has unparalleled experience–having worked within the U.S. Department of Education and the White House on a wide range of regulations and grant programs. Whiteboard Advisors enables busy education leaders to make the most of their resources by providing accurate, helpful answers to complex questions. Contact us to learn how we can help your district and organization.

3. Laws & Regulations: Necessary but Not Sufficient How Practitioners Feel Data is Policy Agenda

4. Data is Policy

5. Background A New Era The ARRA signaled a major change in the federal theory of action in education. Moving away from NCLB, the government began to create the scaffolding for the next generation of policy organized around data & evidence. Redesign professional development Rethink intervention and personalized learning. More state discretion to identify and intervene in schools More useable/transparent data and common measures

6. Background A New Era Today’s schools and entrepreneurs are charting new paths. They are reimagining classroom instruction and school management. They are necessarily forging new contracts, new terms of service, and new business rules. They have and will make mistakes – and that is good (yes – good!) because it tends to be the byproduct of ambition and vision. System change is as murky and difficult as it is critical. It is critical because the effective use of student and administrative data is likely the most important policy issue of the next decade.

7. Laws and Regulations are Necessary but Not Sufficient

8. STATE LAW Statutory Framework is Necessary but Not Sufficient Key Points The weave of federal and state laws provide some basic guidance, but they do not sufficiently address all the variable of today’s technology, never mind tomorrow’s technology.

9. Statutory Framework is Necessary but Not Sufficient Source: http://ir.lawnet.fordham.edu/cgi/viewcontent.cgi?article=1001&context=clip Perspective Key Points • Only 25% of districts inform parents about their use of cloud services, and many districts do not have privacy policies included in their contracts with vendors. • Many agreements with vendors allow for disclosures of student information, or do not specifically prohibit the sale or marketing of student information. • Contracts with vendors often are missing parental notice requirements, and many allow vendors to retain information in perpetuity.

10. How do Practitioners Feel? National Association of Federal Education Program Administrators (NAFEPA) Member Survey (July 2014)

11. Q1: How concerned are you about student data privacy?

12. Q1: How concerned are you about student data privacy? • “We are constantly asked for and data are continually extrapolated from our student profiles and security is a concern for schools as it should be for businesses.” • “I take protection of student data very seriously. I evaluate very carefully before I release any student data.” • “It is difficult, if not impossible, to keep the most sensitive of data secure - and requires a significant amount of investment. We have seen data breaches at the university level already this year.” • “There are so many third party vendors hosting student data i.e. online assessments, online achievement software, student information systems etc.”

13. Q2: Are you comfortable with your knowledge of The Family Educational Rights and Privacy Act (FERPA)?

14. Q2: Are you comfortable with your knowledge of The Family Educational Rights and Privacy Act (FERPA)? • “I know a little, but I feel that I need to be more knowledgeable on this matter. I am fairly new to my position and only have been briefly informed about this ACT. I know that it is my responsibility to become knowledgeable on it, so it is on my list of priorities to read up on the Act.” • “It is a yes and no answer. Training and updating needs to occur regularly to see what new interpretations have occurred but time and training issues are factors for staff.” • “I am comfortable with my knowledge but not the knowledge of others.” • “Even though I believe I understand the FERPA provisions, it is difficult to ensure that all of the policy changes have been clearly communicated and local policies and regulations have been changed and effectively communicated.”

15. Q3: Are you comfortable with the way your district handles student data issues?

16. Q3: Are you comfortable with the way your district handles student data issues? • “In most instances we are very conscientious but it only takes one time.” • “The district I just left violated student privacy on a regular basis. It was disappointing and startling. I think there was a real lack of knowledge and some apathy.” • “Our district is very clear on how we are to handle student data issues.”

17. Q4: Do you feel the your district is in the "driver's seat" or that your contractors are in the "driver's seat" when it comes to student data?

18. Q4: Do you feel the your district is in the "driver's seat" or that your contractors are in the "driver's seat" when it comes to student data? • “With the recent changes in state law, FERPA has been exceeded by a wide margin. It is now a crime to send an unencrypted electronic file to anyone if the file contains personally identifiable information.” • “This is debatable and almost on a case by case issue.”

19. Q5: Should Congress play a stronger role in this issue?

20. Q5: Should Congress play a stronger role in this issue? • “It would only bring confusion and lose focus.” • “BUT only if it is real help and NOT just regulation.” • “Not sure - this issue has not been a topic of concern in my region. Any attempt to regulate by placing mandates should take funding into consideration. School districts are required to do more resulting in additional cost with no way to increase revenue.” • “Yes, if there are districts/states that are not in the driver's seat.” • “Many states are gathering a huge amount of data on our students and their academic progress. This data can be used in a plethora of ways. Parents should have a greater voice in whether their children participate in high stakes testing and how this data is used. There is a need for serious reform when it comes to high stakes testing in general and the data that we collect on children. Congress should only be enacting legislation which reduces the amount of data that we collect on children.” • “We don't need new or additional rules. Districts need to follow what's in place. I think state & district monitors can do that.”

21. Consideration Moving Forward Perspective • FERPA/statutory compliance is not sufficient • Increasingly, privacy experts have criticized the law, and the Podesta report released earlier this year noted that it is lacking as well. FERPA compliance is very much a floor, not a ceiling, in the privacy space. • Internal structures and business rules are critical • Chief Privacy Officers, Privacy Advisory Boards, clearly defined and available privacy policies, and a crisis communications and response strategy in case of breach are all critical. • Building a culture of trust • Being a transparent, trusted partner to districts, parents, and students is an important prerequisite for success in the privacy space.

22. Whiteboard Advisors Email: info@whiteboardadvisors.com Follow: WhiteBdAdvisor Blog: http://www.whiteboardadvisors.com/news Visit: http://www.whiteboardadvisors.com Sign up for Whiteboard Weekly Notes for the latest education news. Subscribe using your QR Code reader or by visiting: http://eepurl.com/nW3D