An influential legislative-advocacy group鈥檚 promotion of a model bill meant to protect the privacy of student data sends a strong signal that the hot-button issue will be debated in statehouses around the country in lawmakers鈥� 2014 sessions.
The template being provided to state lawmakers by the controversial American Legislative Exchange Council, known as ALEC, would require state school boards to appoint a 鈥渃hief privacy officer,鈥� create a data-security plan, publish an inventory of all student-level data being collected by the state, make sure that contracts with some vendors include privacy and security provisions, and ensure compliance with federal privacy laws.
The group鈥檚 model legislation mirrors a recently enacted bill in Oklahoma that is widely regarded as the first attempt in the country to comprehensively address growing concern over the collection, electronic storage, and sharing of oceans of student-specific information. Such data cover matters from academic performance to family background to disciplinary and health records.
鈥淭his is an issue of importance to our members,鈥� said Lindsay M. Russell, the director of ALEC鈥檚 education task force. 鈥淧retty much all [48] states that are represented on our task force have shown interest in the bill.鈥�
Other advocacy groups and industry representatives reacted warily to the approach embodied in the Oklahoma and ALEC bills. They praised the efforts as good first steps, but expressed concern over a lack of substantive details, particularly when it comes to placing limits on the noneducational uses of student data by third-party vendors.
鈥淔ocusing on transparency and accountability is always a good start, but I鈥檓 not sure that [the ALEC model bill] is comprehensive in covering the education-technology landscape,鈥� said Joni Lupovitz, the vice president of policy at Common Sense Media, a San Francisco-based nonprofit that in October launched a campaign to press for increased safeguards on student data.
Lawmakers from both major parties have recently introduced or passed a variety of other student-data-privacy bills in such states as Arizona, Massachusetts, Nebraska, and New York.
A bipartisan group of U.S. senators also has introduced a bill that would ramp up existing federal protections of students鈥� online privacy.
Issues surrounding the privacy of student information are taking on new significance as policy and technology combine to produce a mass of detailed data, both academic and nonacademic, on individual students. Some states have recently enacted laws to beef up data privacy; similar measures are developing in other states. Here is a sampling of that legislative activity.
ARIZONA
Gov. Janice K. Brewer, a Republican, signed into law in June a bill designed to strengthen parental-consent procedures around the release of student 鈥渄irectory information鈥濃�攊ncluding name, address, and phone number鈥攖o third-party vendors. The measure provides a pathway for reporting suspected violations of the federal Family Educational Rights and Privacy Act, or FERPA. 鈥淭he bill maintains the privacy of students on campuses from outside vendors who want to obtain [directory] lists to increase their client bases,鈥� said state Sen. Kimberly Yee, the Phoenix Republican who sponsored the legislation.
NEBRASKA
Gov. Dave Heineman, a Republican, signed into law in April a measure guaranteeing students, and their parents or guardians, access to school files and records concerning themselves. Students鈥� parents or guardians and teachers, counselors, and school administrators are granted the same access. Some broad limits are placed on the transfer of such data to other parties without parental consent, although the legislation is explicit that 鈥渢he sharing of student data, records, and information among school districts, educational service units, learning communities, and the state department of education, to the fullest extent practicable and permitted by law, is vital to enhancing education in this state.鈥�
NEW YORK
No fewer than six bills related to student-data privacy are currently pending in the New York state legislature, including proposals that would give parents greater say in how their children鈥檚 education data may be used and limit third-party providers of cloud-computing services to noncommercial uses of student data. Most of the bills have received bipartisan backing in the Assembly, the lower house. None has yet been enacted.
David K. Albert, the director of communications and research for the New York State School Boards Association, said the state鈥檚 data-sharing partnership with Atlanta-based nonprofit inBloom Inc. has taken concerns about student privacy in the state 鈥渢o a different level.鈥�
鈥淲e want to protect student privacy, and at the same time make it so that schools can continue their regular day-to-day operations without putting too many roadblocks in place,鈥� he said. He cited routine functions ranging from student transportation to yearbook creation that require some degree of student-level data-sharing with outside vendors.
MASSACHUSETTS
A bill proposed by state Rep. Carlo P. Basile, a Boston Democrat, would prohibit 鈥渟ervice providers who offer cloud-computing services to K-12 educational institutions from processing student data for commercial purposes,鈥� including targeted advertising to children. 鈥淚 felt something had to be done to protect the integrity of our children鈥檚 business,鈥� Mr. Basile said. 鈥淣ow that [lawmakers] have become educated on [cloud computing], there鈥檚 definitely an appetite to do something.鈥� The bill is currently in committee.
OKLAHOMA
The Student Data Accessibility, Transparency, and Accountability Act, passed in June and signed into law by Gov. Mary Fallin, a Republican, is poised to become a national model for how state lawmakers propose to comprehensively address student data-privacy issues. The law mandates creation of a data-security plan, publication of an inventory of all student-level data being collected by the state, data-privacy and security provisions in contracts with outside vendors, and compliance with federal privacy laws. It also served as the template for model legislation adopted by the American Legislative Exchange Council, an influential legislative-advocacy group based in Arlington, Va.
Looking to Oklahoma
The Arlington, Va.-based ALEC brings together state legislators and private-sector business leaders to craft sample legislation based on free-market and limited-government principles. In the education arena, the group has been involved in promoting such measures as 鈥減arent trigger鈥� and voucher legislation. On another front, its role in some states鈥� adoption of 鈥淪tand Your Ground鈥� laws鈥攚hich allow individuals to use deadly force to protect themselves without a requirement to retreat in the face of danger鈥攄rew intense national scrutiny in the wake of the killing of Florida teenager Trayvon Martin.
Ms. Russell said the model data-privacy legislation, approved by ALEC鈥檚 members in late September and formally known as the Student Data Accessibility, Transparency, and Accountability Act, shares 鈥渃ore concepts鈥� with the Oklahoma legislation of the same name, which was approved in June. The language in the two documents is virtually identical.
State Rep. David Brumbaugh, a Republican whose district includes Tulsa, sponsored the Oklahoma bill.
Mr. Brumbaugh said his focus was on building a 鈥渟ystem of safeguards鈥� to protect students鈥� privacy while also recognizing the value of tracking their 鈥渆ducational pathways.鈥�
He argued that the collection of some of the roughly 300 pieces of student-level data compiled for use in state longitudinal-data systems such as Oklahoma鈥檚鈥攅specially information that is nonacademic鈥攃onstitutes 鈥渄ata-gathering without a legitimate purpose.鈥� Mr. Brumbaugh also expressed concern that such data is often not properly secured.
鈥淚f we ignore small, gradual erosions to privacy in the name of policy or convenience, we risk a larger overall loss that we aren鈥檛 aware of until it鈥檚 too late,鈥� he said.
The Oklahoma Student DATA Act requires the state education department to publish an inventory that lists and defines each piece of individual student data it collects, as well as the reason it is being collected. It outlines broad guidelines for restricting access to student data and limiting the conditions under which student data can be shared with other entities.
The law also calls for contracts with outside vendors that will handle student data to include 鈥渆xpress provisions that safeguard privacy and security and include penalties for noncompliance.鈥�
Stricter Limits Proposed
Given the recent 鈥渟ea change鈥� in the volume of data that education institutions collect and their capacity to process it, the focus in the Oklahoma law and the ALEC model legislation on increasing transparency and establishing new accountability structures is 鈥渁bsolutely critical,鈥� said Stephen Mutkoski, the worldwide policy director for the Microsoft Corp., based in Redmond, Wash.
But Mr. Mutkoski is among those who expressed reservations that the Oklahoma and ALEC bills do not go far enough, especially when it comes to establishing an 鈥渋nitial bar鈥� that would clearly limit the use of student data to educational purposes鈥攁 major concern, given the proliferation of educational app makers, 鈥渃loud鈥�-based information-storage providers, and other vendors seeking to monetize student data through targeted advertising and other means.
鈥淚t鈥檚 a time of great growth in the ed-tech industry, and I鈥檓 not sure everybody鈥檚 motivation in terms of how they want to use data is clear,鈥� Mr. Mutkoski said.
Leonie Haimson, a New York City-based parent and public schools advocate, also questioned the wisdom of not providing families more say in whether and how their children鈥檚 information is being shared.
鈥淭o me, it sounds like [the bill is intended] to assuage the fears of parents who want there to be something done to protect their children鈥檚 data, but who aren鈥檛 really informed about the issues,鈥� Ms. Haimson said.
Bills that contain more specifics but don鈥檛 take as comprehensive an approach have gained some traction in other states. In New York, for example, Ms. Haimson and her nonprofit organization, Class Size Matters, have helped push more-targeted bills crafted to stop the release of sensitive student information without parental consent and to allow parents the opportunity to opt out of data-sharing efforts involving third-party vendors.
Both bills passed in the state Assembly last spring but have yet to move in the state Senate.
Legal Action in New York
Class Size Matters also played a leading role in a recent filing for a court injunction to stop the New York state education department from moving forward with a partnership with inBloom Inc., an independent nonprofit based in Atlanta that has met stiff opposition to its efforts to create a cloud-based education-data repository for states.
鈥淭his is the most bipartisan education issue that anyone in the state of New York has ever seen,鈥� Ms. Haimson said of data privacy. 鈥淧arents are wildly angry.鈥�
For his part, Mr. Brumbaugh, the Oklahoma lawmaker, said his state鈥檚 efforts should be construed as a first step.
鈥淲e want to shore [students鈥� privacy] up even more,鈥� he said, pointing to parental-consent provisions as one area where the state could see further action. 鈥淭his is all new territory.鈥�
Ms. Russell of ALEC said that in the coming weeks, she expects much conversation in other states regarding the group鈥檚 model bill, which its members are likely to bring to their legislatures in the coming months. She said the ALEC template could be changed to accommodate local concerns.
鈥淎s January comes and people start to craft their legislative agendas,鈥� Ms. Russell said, 鈥渨e鈥檒l have a better sense of which states are going after this aggressively and which are still in the discussion phase.鈥�
