Computers and the Internet have changed the
way we live and learn. We work, shop, communicate, share pictures and video, research information,
and play games online. Many schools and districts have embraced the
new technologies and are using them to improve education services and instruction. Today
weíre going to talk about your responsibility as teachers and administrators for student
privacy when using online educational resources. __
Because the fact is, no matter where student records resideÖ they should still be protected.
Letís take a look at the ways teachers, administrators, and staff can practice good data management
when using online educational apps and services. Then weíll talk about how you can protect
the privacy and security of student data when using these types of services in your schools
and districts. ___
Before using educational apps or services, it is important to learn about the variety
of Federal, State, and local laws impose requirements and restrictions on how student data can be
used — and the conditions under which it can be shared with application developers
or online service providers. Letís examine some key privacy laws that may apply.
The first is the Family Educational Rights and Privacy Act, or FERPA. FERPA is a Federal
law which protects the privacy of student education records. Most public schools and
districts are required by law to comply with FERPA. Simply put, FERPA restricts on how
PII ñ thatís Personally Identifiable Information — from education records may be released
without the parentsí consent. FERPA may allow schools to disclose certain
information, like studentís name, date of birth or photos, without consent as ìDirectory
Information.î This is often done in school yearbooks and athletic programs.
___ A school may provide directory information
without consent to third parties, such as service providers only if they publically
notify parents about its directory information policy. This notice has a number of requirements,
like it must state what personal information is considered directory information, and that
parents have a right to ìopt out.î But be carefulÖ because parents can opt out at a
later time, so using directory information with online services can be tricky. Another FERPA provision that permits PII from
education records to be disclosed to third parties without consent is the School Official
exception. Schools often use this exception to outsource IT and other institutional functions.
It is sometimes advantageous to outsource school functions, to save money or to get
better services. If your school outsources under FERPAís school official exception you
must make sure that the third party is providing a service or function that the school would
otherwise provide itself, and you must be sure to retain direct control over the use
and maintenance of the information you disclose. ___
Sorry! FERPA isnít the only federal law in question — letís briefly review a few others
that might apply. ___
Another law is the Childrenís Online Privacy Protection Act, or COPPA. It applies to websites,
apps, and online services that collect information from children who are under the age of thirteen.
COPPA requires verifiable parental consent prior to collecting personal information from
children online. In some cases, like when a student must use
a website or an app for school and there is no commercial purpose, COPPA allows schools
to exercise consent on behalf of parents. ___
In addition to FERPA and COPPA, other federal laws may apply like the Protection of Pupil
Rights Amendment, or PPRA, and the Individuals with Disabilities Education Act, or IDEA.
While we are not discussing them here, these other laws may impose additional requirements
on your use of online apps or services. As you might expect, not all laws apply in
all circumstances. To spare yourself a headache, spend a little time researching which requirements
apply to your particular situation before signing up for a new service.
Oh, and donít forget about laws in your own state! ó they may apply as well! ____
You may wonder, ìDoes FERPA allow schools to share PII from education records with online
service providers?î Yes, FERPA does allow you to share PII from
education records with online providers in some instances:
With prior written parental consent itís always acceptable to share PII from education
records. Through the directory information exception.
And under the school official exception. But remember Ö officials can only use PII
from education records to perform the specific service or function that you directed them
to provide. ___
We just reviewed how FERPA protects studentsí education records, but the truth is that FERPA
may not apply to all of the data collected by online service providers.
That is why you must pay close attention to written agreements, contracts and terms of
service. If your school or school district wants to
use third party online educational services, it is important to get your ducks in a row
and create a proper written agreement. ___
Even if itís not required, it is always best to create one. A written agreement sets expectations
for necessary security controls as well as specifying data collection, use, re-disclosure,
and retention and destruction procedures. Your contracts should specify how long the
agreements will last and how they can be modified or terminated. ___
When drafting a written agreement, remember all applicable legal requirements. This process
may be difficult, but a little pain now can save a lot of pain later.
___ So far, we covered what you should do when
contracting for online services in a conventional manner, through a written agreement.
___ Increasingly, however, online services and
applications use a licensing model known as ìClick throughî or ìClick-wrapî, where
you can sign up by simply clicking a button or a checkbox to accept the terms of service.
This can lead to potential problems. __
Meet Ms. Jones, a high school teacher. She just found a great new app to help kids with
math through games. Her students love to play games, and the app is free.
___ More and more teachers like Ms. Jones are
making use of apps and online services. Many providers offer innovative and helpful content,
often ìahemî for free. But be wary that sometimes the saying, ìNothing
is freeî might apply. ___
Some apps require the acceptance of terms of service. These can be long, boring and
full of complicated legal language. Ms. Jones needs to fully understand what she
is agreeing to in the terms of service! We may not think of clicking an ìacceptî button
as the same thing as signing a written contract, but they can be legally binding agreements.
For these reasons and more, Ms. Jones should talk to the appropriate individuals about
the schoolís policies and procedures before signing up for the app. Administrators should
review the app and the terms of service to make sure it wonít adversely affect student
privacy — or the security of the schoolís systems.
___ If your school or school district doesnít
already have a process for reviewing and approving apps and online services for classroom use,
you should create one. Here are a few suggestions for reviewing apps
or services that use a ìClick-wrapî agreement: Identify who within your school or district
will be responsible for approving the use of apps and services
Create an easy way for faculty to receive feedback about third-party apps or services
they would like to use in the classroom. Use this process to screen out those that may
pose security or privacy risks. Read through terms of service carefully. They
may be long and full of ìlegalese,î so, talk to your administrative or legal team
to help make sense of them. Print and save a copy of the terms of service
for your records. Online providers sometimes include provisions
in the terms which enable them to change the terms at will. Check often to ensure that
the terms have not been changed unacceptably. ___
Technology in classrooms can improve education by expanding our knowledge, communication,
and productivity. But as we enjoy these new tools, we must be mindful of the risks they
bring, and follow best practices to secure and protect studentsí private information.
We have discussed how to protect privacy when using online educational services, but there
is a lot more to know. Talk to your school or school district administrators
about local policies and procedures for using online services.
Also, check out the U.S. Department of Educationís Privacy Technical Assistance Center website
at ptac.ed.gov for more information on protecting student privacy while using online educational