澳门跑狗论坛

With education technology companies facing increasing pressure to protect students鈥� data privacy, a pair of organizations set out recently to help them鈥攂y staging a 鈥渂oot camp鈥� meant to cut through vendors鈥� confusion and make sense of shifting legal obligations.

The event, held last week in the nation鈥檚 capital, is expected to be the first of several of the tutorials for ed-tech companies, according to the Future of Privacy Forum, which along with the investment company Rethink Education, organized the two-day tutorial.

The boot camp drew about 40 companies, many of them startups or small- to medium-size businesses that aren鈥檛 likely to have their own lawyers on staff to advise them on how to navigate the legal terrain of student-data privacy.

The organizers closed most of the event to the press, and they would not release the names of the companies attending. They said they wanted to allow company officials to be free to ask questions of the speakers, and each other, without having their statements aired publicly.

Jules Polonetsky, the executive director of the Future of Privacy Forum, a Washington-based organization that aims to help build more responsible data practices, said one of his group鈥檚 primary goals was to help K-12 vendors understand their legal and other obligations at the federal, state, and district levels鈥攁nd how to address those demands during the conception of products, rather than after a problem occurs.

Legal Concerns Rising

K-12 organizations, such as the Consortium for School Networking, which represents school technology officers, and the Software & Information Industry Association, have also sought to provide clarity on various laws for their audiences.

In addition to the major federal laws that address student-data privacy鈥攖he Family Educational Rights and Privacy Act, or FERPA, and the Children鈥檚 Online Privacy Protection Act, or COPPA鈥攎ore than 20 states have passed their own laws related to safeguarding student data over the past two years. Individual districts are also tailoring their own requirements for vendors.

鈥淧rivacy and contracting across thousands of school districts is getting very complex,鈥� said Mr. Polonetsky, who served previously as New York City鈥檚 consumer-affairs commissioner and as AOL鈥檚 chief privacy officer.

To vendors, each district seems to have 鈥渁 different checklist,鈥� he added. 鈥淕ood companies want to get it right, but it鈥檚 really hard to come up with different versions of your product, or negotiate different versions of contracts.鈥�

The boot camp was held at the downtown Washington offices of 1776, a business incubator and seed fund that backs companies in education and other areas. It was co-sponsored by Rethink Education, a White Plains, N.Y.-based venture capital firm that invests in educational technology.

The setting was designed to be informal: On the opening day of the event, Mr. Polonetsky and other organizers sported 鈥淔ERPA sherpa鈥� T-shirts, an allusion to their efforts to guide companies through challenging terrain.

Attendees heard from speakers such as Terrell McSweeny, a member of the Federal Trade Commission; representatives of individual school districts; lawyers who study data-privacy law; and privacy- and industry-advocacy groups.

In comments to attendees at the beginning of the boot camp, Ms. McSweeny said she was aware of the potentially 鈥渋ncredible benefits鈥� that innovative tools for using data can bring to schools, even as the FTC鈥攚hich seeks to protect consumers on privacy and other issues鈥攊s determined to make sure K-12 companies follow the law.

Companies鈥� worries about the legal landscape were evident in an opening question-and-answer session, when a business official told Ms. McSweeny that concerns about data privacy can potentially scuttle fledgling education vendors鈥� ability to raise capital.

鈥淗ow do you figure out how to regulate with the lightest possible touch?鈥� the company official asked.

Ms. McSweeny responded that the FTC鈥檚 duty is to enforce the law鈥攊t can fine providers it deems to have committed violations鈥攂ut that its staff also strives to answer individual companies鈥� detailed questions about how to interpret COPPA, and how it applies to their business practices.

She also urged companies to embrace 鈥減rivacy by design.鈥� They should make efforts to notify parents about how information is used, and to be transparent about privacy practices, as part of their product development, she said, rather than cobble together a policy for a district after the fact.

When companies take that step, 鈥渁t the very least, one advantage is your technology matches what your privacy policy says,鈥� Ms. McSweeny said in an interview after the session. 鈥淚t鈥檚 been those disconnects that can result in liability鈥� problems for businesses, she said, when they fail to do so.

When companies are proactive in addressing privacy, 鈥渋t actually generates, in and of itself, new innovation,鈥� Ms. McSweeny added, and 鈥渃hanges to the product that are very marketable and interesting.鈥�

As it is, figuring out what is required by FERPA, COPPA, myriad state laws, and individual district policies has involved considerable 鈥渄etective work,鈥� particularly for up-and-coming ed-tech companies, said one boot-camp attendee, Karina Linch. She is the senior vice president of product management for BrainPOP, a New York City-based company that creates digital learning games and other academic content.

That鈥檚 the case even for BrainPOP, which has its own legal counsel and does business with schools in all 50 states, Ms. Linch said.

When it comes to districts鈥� privacy policies, she said, 鈥渨e get a lot of very, very different requests, that sometimes conflict with each other.鈥�

Widespread Confusion

The company has sought to bake privacy policy into the development of products so that schools and districts can either subscribe to the company鈥檚 services without sharing any student data or enable usage to keep track of individual student learning, Ms. Linch said. Creating those options requires much more work for BrainPOP on the development end, she said, but the company believes it appeals to parents and districts.

Mr. Polonetsky hears particular frustration among vendors about cases in which FERPA and COPPA may overlap, and how companies sometimes have trouble deciphering which law governs their various practices. COPPA is designed to give parents control over what information is collected from their children. FERPA is meant to protect the privacy of students鈥� education records, and generally applies to schools that receive funds from the U.S. Department of Education.

But confusion is widespread. Decisions about whether FERPA or COPPA applies can hinge on whether schools are creating online student accounts and have contracts with vendors, or if teachers provide permission and enable students to create accounts, Mr. Polonetsky noted.

Federal lawmakers, meanwhile, have been drafting legislation meant to update and broaden student-data-privacy policies, in a way that could pre-empt the various laws being enacted by individual states.

The confusion, of course, doesn鈥檛 just flow one way. Mr. Polonetsky said the flurry of local privacy policies reflects K-12 officials鈥� desire to make their protections as broad as possible, to account for the fast-evolving and often-bewildering set of apps, tools, and cloud-based systems being marketed to them.

Districts are 鈥済oing through their checklist, and they鈥檙e saying to companies, 鈥榃hy can鈥檛 I tell if you meet [our data-privacy requirements] or not? Here are the things I need to know,鈥� 鈥� Mr. Polonetsky said. 鈥淭here鈥檚 been complexity on both sides that鈥檚 made it hard for good-meaning schools and good-meaning companies to have a meeting of the minds.鈥�