Educator Toolkit for Teacher and Student Privacy A

Educator Toolkit for Teacher and Student Privacy: A Practical Guide for Protecting Personal Data

Leonie Haimson, Co-Director The Parent Coalition for Student Privacy Marla Kilfoyle, Former Executive Director, The Badass Teachers Association Rachael Stickland, Co-Director, The Parent Coalition for Student Privacy Melissa Tomlinson, Asst. Executive Director, The Badass Teachers Association

Why we did this toolkit “Florida virtual school reveals huge data breaches. “ “Medical records of high school students leaked in 'appalling' data breach” “Sensitive information, including student medical records, may have been compromised in the Honeoye Falls-Lima Central School District. ” “OCM BOCES sees two cyber attacks in one week. ” “The Mississippi Education Department’s assessment vendor, Questar Assessment, Inc. , reported today that 562 students in the Tupelo Public School District were impacted by the data breach the company discovered last week. ”

Why we did this toolkit The FBI issued an alert Sept. 13 conveying “cyber threat concerns related to K-12 students. ” The message warned of the “privacy and safety implications” of the “rapid growth of education technologies and widespread collection of student data. ”

Questions ● How do I make sure my use of technology implements safeguards for my students? ● Is my school doing enough to make sure student data is kept safe? ● Are schools offering professional development around data safety and security laws, procedures, and best practices? ● What is my legal responsibility towards protecting personal student data? My moral responsibility?

Awareness of issues surrounding data collection ● Dangers of exposure to hacking ● Collection and selling of data for profit ● Creation of predisposed ideals around stereotypical student performance Workforce development Career pathways ● Collection of marketable data has potential racist connections to eugenics

In preparation for developing this teacher toolkit, we conducted an online survey from March 4 -March 18, 2018. • We got responses from 365 educators in 45 states and DC. The survey questions can be found here: www. bit. ly/BATs_PCSPsurvey • About 86% were classroom teachers • Also librarians, media specialists, asst principals, instructional coaches, counselors, and speech pathologists • Most taught in urban areas (44%), followed by suburban (37%) and rural districts (14%).

What we found: Most educators feel they need far more support and training on how better to protect both student data and their own.

87% of districts use ed tech either to a great extent or moderately

A large majority of districts and schools require teachers to use online instructional and assessment programs (62%)

Most said district administrators decided as to whether to use ed tech apps (38%) but many (29%) said they didn’t know who made these decisions

Nearly half (48%) of all districts use apps for student behavior tracking t r a c k i n g

• A surprising large number of schools/districts use online programs for social-emotional learning (26%) • (especially as none have been validated for this purpose)

Nearly half (48%) said their schools or districts require the use of apps with click-wrap agreements, which they just click on “I accept” button to agree to the Terms of Service. Most of these apps are free — though instead they may monetize student data in ways not immediately evident.

Insufficient PD Most teachers (69%) said that they didn’t get enough training in how to protect student privacy

BIG CONCERN: Most teachers (68% ) didn’t know if the vendors sold student data or used it for marketing or other commercial purposes.

DELETING THE DATA: 44% didn’t know if vendor deleted data after school stopped using the app; 37% said there was no policy and 12% said nothing happens.

Little knowledge of privacy laws Only 13% were very familiar with federal student privacy laws (FERPA , PPRA and COPPA)

Most had NO training in Data security

BREACHES 13% said teacher data had been breached, 8% said student data breached 61% said they didn’t know

Even after a breach, 65% said that they didn’t know if affected families or teachers were notified or security practices strengthened – only 2% said they were offered more training!

Surveillance of teachers • Though half of teachers reported that their districts did not monitor them in a way that was concerning, 12% said that they DID monitor them in ways that impinged on their privacy • 10% said their school or district monitors their social media use, even on while they’re at home on their own computers.

One respondent: “Our district has admittedly spied on us by hacking into our computer accounts including personal emails; rooms have been bugged; cameras on computers have been utilized by administrators; IT district leaders admitted they would and could use cameras to see what we are doing. ”

Compensation or conflict of interest in using apps • 7% said that they had been offered free travel or other compensation to use certain ed tech products or apps. • 78% said they did not know if their district or school restricted this practice. • Only 8% said they were aware of such restrictions.

We also held focus groups with more open-ended discussions

Data walls were a big concern Most of the teachers had witnessed the use of data walls at their schools, in which student test scores or grades are displayed in classrooms or hallways. None felt that this was positive because they believed their use shames and humiliates children and violates their privacy.

Widespread use of student data dashboards Many participants were concerned about how teachers can easily access prior discipline histories of students and other personal data from the dashboards. They worried that this might lead to forming negative preconceptions affecting their relationships with and expectations of their students.

We also held interviews with six administrators including principals and district leaders • They all complained of a lack of sufficient knowledge of data privacy issues • All but one said that they had received no formal training on how to protect student data. • All six said they were familiar with FERPA but three were not familiar with another important federal law -PPRA (Protection of Pupil Rights Amendment). • Only three said they knew what their state laws on student privacy required.

More administrator questions and concerns • There is too much data! Who is watching it? I don’t know and that concerns me. • I have no confidence in the state and what they are doing with the data. • We need to find a better balance between technology and teaching. • Student data is too often monetized. • Technology is moving too fast and districts are struggling to keep up.

Five Federal Laws • Family Educational Rights and Privacy Act (FERPA) • National School Lunch Act (NSLA) • Individuals with Disabilities Education Act (IDEA) • Protection of Pupil Rights Amendment (PPRA) • Children's Online Privacy Protection Act (COPPA)

What you should know Family Educational Rights and Privacy Act (FERPA) • Regulated by the U. S. Department of Ed. ; applies to schools receiving federal funds. • Parents have the right to access, correct, and to have some control over the disclosure of student information. • Penalties include withholding federal funds, or prohibiting access to certain data for up to 5 years.

FERPA’S General Rule Schools and teachers cannot disclose a student’s personal information – whether orally, written, or in electronic form – from education records without first obtaining parental consent. This Photo by Unknown Author is licensed under CC BY-SA-NC Photo by Unknown Author is licensed under CC BY-SA

FERPA Exceptions Directory Information School Officials Audit and Evaluation Studies

FERPA Scenarios • Do classroom apps violate FERPA? • When do data walls violate FERPA? • Can school-wide staff newsletters violate FERPA?

What you should know National School Lunch Act (NSLA) • Administered by the U. S. Department of Agriculture. • Parental consent must be obtained before FRL eligibility information (e. g. household size and family income) can be shared. • Only school officials directly responsible for a child’s education should access eligibility status (e. g. whether a child is eligible for FRL). • Schools must make efforts to prevent “overt identification” of a child’s FRL status.

NSLA Scenario My school uses color-coded lunch tickets and special eating areas designated for children who receive FRL. Does this violate NSLA?

What you should know Individuals with Disabilities Education Act (IDEA) • Regulated by the U. S. Department of Ed. • Parental consent must be obtained before their child’s information can be disclosed in certain circumstances, such as: 1) Transition services when moving a child from school to after-school activities; 2) Enrolling a child in a private school in a different district from the parents’ residence; and 3) When districts seek reimbursement from the federal government.

IDEA Scenario Some parents would like me to send their child’s IDEA progress reports via email. Does IDEA allow this?

What you should know Protection of Pupil Rights Amendment (PPRA) • Administered by the U. S. Department of Ed. • Parents must be provided notice of the right to refuse their child’s participation in certain activities: • Marketing surveys; • Non-emergency, invasive physical exam or screening; • Surveys, analyses, and evaluations …

PPRA’s 8 Sensitive Areas Political affiliations or beliefs Income (other than that required by law) Legally recognized privileged relationships Mental and psychological problems Religious affiliations and beliefs Sex behavior and attitudes Illegal, anti-social, selfincriminating, and demeaning behavior Critical appraisals of close family members *If a survey, analysis, or evaluation that deals with the issues listed above is funded in whole or in part by the U. S. Department of Education, parents must provide prior consent.

PPRA Parental Rights of Inspection • Survey content touching on the 8 areas. • Any instructional content, printed or representational materials, and audiovisual or electronic/digital materials. * Does not include academic tests or academic assessments.

PPRA Scenarios Can a survey asking students questions about their drug and alcohol use violate PPRA? My high school requires every junior to take the College Board SAT (or ACT), is parental permission required?

What you should know Children's Online Privacy Protection Act (COPPA) • Enforced by the Federal Trade Commission. • Applies to operators of child-orientated websites, including education-related programs and homework websites, that collect information directly from children. • Parents must consent before operators can collect personal information from a child under 13.

Teachers & Schools • Can provide consent on parents’ behalf – but only if the operator does not use the data for commercial purposes. • Must be provided notice of the operators’ disclosure practices and allowed to request deletion of student information and cease further collection or use. This Photo by Unknown Author is licensed under CC BY

COPPA Scenario Does COPPA allow me or my elementary school staff to download education-related apps directly to students’ personal devices?

Classroom Practices to Avoid Does Tech improve learning & teaching? Be wary of Adaptive or Personalized Ed Tech Consider Health Effects Ask for parental consent Teachers resist the urge to be recruited by tech companies to pilot their products. Do your homework first! Remember Tech is expensive! Follow District Guidelines Verify Security Practices Be open & collaborative

Classroom Practices to Avoid - Social Media Don’t post negative comments about students or parents; Never post pics of students w/o parent permission & don’t post identifying info about students. Set your account to private; Be careful what you “like” or “favorite” Don’t post offensive stuff; Don’t friend students

Practical Tips to Protect Student and Teacher Privacy Watch out for click wrap agreements! Promote a culture that respects privacy! Speak up! DATA WALLS SHAME CHILDREN! YOU PAY WITH YOUR DATA! Read up on federal and state laws! Know your district regulations

Thank you to our Advisory Board

To Download the FREE Toolkit Go To http: //bit. ly/Educator. Toolkit. BATs or http: //bit. ly/PCSP_Educator. Privacy. Toolkit