This afternoon I spoke at a press conference in NYC to support Sen. Gillibrand’s new bill to create a new federal agency specifically devoted toward protecting privacy, called the Data Protection Agency.  The bill is posted here; more about it is here.   

The statement I gave is below; and below that is the press release, with quotes from Sen. Gillibrand and the other two privacy experts pictured above, Caitriona Fitzgerald of EPIC and Prof. Ezra Waldman of NY Law School.

Hi, my name is Leonie Haimson, and I’m co-founder and co-chair of the Parent Coalition for Student Privacy.  We are one of the many organizations that have  submitted complaints to the FTC about the way companies like Facebook, Google and Google Play Apps have been illegally harvesting young children’s information and potentially using it for commercial purposes without parental consent in violation of COPPA.  And yet the FTC’s response to these complaints has been silence, or at best a mere slap on the wrist, a symbolic fine that barely touches the huge profits of these companies.

In addition, the FTC has put out a series of contradictory guidance documents about how COPPA applies to the collection of personal data from children in schools that has managed to confuse nearly everyone.  As a result, each school and district interprets their responsibilities differently about whether or not they even inform parents beforehand, no less ask for their consent, . when their children are assigned programs to use that require them to upload their personal information.

For example, Google Apps for Education, also called G-suite, is used in literally tens of thousands of schools across the country; and yet many parents are concerned about the amount of personal data Google collects from their children, including their geolocation and metadata, and how this information may be abused.

More recently, the FTC has signaled that they may be rewriting regulations for COPPA regulations to further weaken student privacy, in and out of the classroom, causing us to worry that they are more interested in serving the commercial interests of the ed tech industry instead of keeping our children safe from commercial exploitation.  We are also extremely concerned about the non-transparent algorithms increasingly being used in classrooms across the country to direct children’s learning and steer their educational trajectories – algorithms that may feature inherent biases and be based on inaccurate data.

All this further reconfirms our conviction that it is absolutely necessary that an independent agency be established that has as its first priority protecting the privacy of Americans, especially our most vulnerable children, and which can look into these troubling issues with more objectivity and care.  Thank you Senator Gillibrand, for introducing the Data Protection Act,  and our Parent Coalition is committed to doing all we can to help get it passed.

From: Gillibrand, Press (Gillibrand) <[email protected]>
Sent: Sunday, February 23, 2020 1:59 PM
Subject: STANDING WITH DATA PRIVACY EXPERTS AND ADVOCATES, GILLIBRAND ANNOUNCES LANDMARK LEGISLATION TO CREATE A DATA PROTECTION AGENCY TO COMBAT NATIONAL DATA PRIVACY CRISIS

FOR IMMEDIATE RELEASE:

Sunday, February 23, 2020

Contact: Evan Lukaske, 202-224-3873

STANDING WITH DATA PRIVACY EXPERTS AND ADVOCATES, GILLIBRAND ANNOUNCES LANDMARK LEGISLATION TO CREATE A DATA PROTECTION AGENCY TO COMBAT NATIONAL DATA PRIVACY CRISIS

The Data Protection Act Would Create a Consumer Watchdog to Give Americans Control and Protection of Their Data, Promote a Competitive Digital Marketplace, and Prepare the U.S. for the Digital Age

U.S. Still One of the Only Democracies Without a Data Protection Agency

New York, NY — Alongside data privacy experts and advocates, U.S. Senator Kirsten Gillibrand today announced her landmark legislation, the Data Protection Act, which would create the Data Protection Agency (DPA), an independent federal agency that would protect Americans’ data, safeguard their privacy, and ensure data practices are fair and transparent. The push for a national agency to oversee data privacy comes as leaders from EPIC, the Parent Coalition for Student Privacy, the New York Law School’s Innovation Center for Law and Technology and Institute for CyberSafety, and more express concern for the growing data privacy crisis that looms over the everyday lives of Americans. The U.S. is one of the only democracies, and the only member of the Organization for Economic Co-operation and Development (OECD), without a federal data protection agency.

“Technology is connecting us in new significant ways, and our society must be equipped for both the challenges and opportunities of a transition to the digital age. Data privacy is becoming an urgent concern for the everyday lives of Americans and the government has a responsibility to step forward and give them meaningful protection over their data and how it’s being used,” said Senator Gillibrand. “Data has been called ‘the new oil.’ Companies are rushing to explore and refine it, ignoring regulations, putting profits above responsibility, and treating consumers as little more than dollar signs. Like the oil boom, little thought is being given to the long-term consequences. The U.S. needs a new approach to privacy and data protection. We cannot allow our freedoms to be trampled over by private companies that value profits over people, and the Data Protection Agency would do that with expertise and resources to create and meaningfully enforce data protection rules and digital rights.”

“EPIC applauds Senator Gillibrand for filing the Data Protection Act,” said Caitriona Fitzgerald, EPIC Policy Director. “The United States confronts a crisis. The Federal Trade Commission has consistently failed to protect consumers. The system is broken. A Data Protection Agency focused on privacy protection, compliance with data protection obligations, and emerging privacy challenges is needed now.”

“It is absolutely necessary that an independent agency be established that has as its first priority protecting the privacy of Americans, especially our most vulnerable children, and which can look into these troubling issues with more objectivity and care. Thank you Senator Gillibrand, for introducing the Data Protection Act, and our Parent Coalition is committed to doing all we can to help get it passed” said Founder of Parent Coalition for Student Privacy Leonie Haimson.

“Privacy is a civil right, not a good to be traded in the market. The FTC has tried, but it has overseen the erosion of personal privacy with the lightest of light regulatory touches. It is structurally incapable or unwilling to do what needs to be done to protect privacy from companies that will do anything to extract our data. Along with other proposals from Senate Democrats, Senator Gillibrand’s Data Protection Agency is necessary to empower individuals in the digital economy” said Ari Ezra Waldman, Director of the Innovation Center for Law and Technology at New York Law School and Founder and Director of the Institute for CyberSafety.

As the United States transitions into the digital age, the DPA will address America’s growing data privacy crisis. The new agency will have the authority and resources to effectively enforce data protection rules—created either by itself or congress—and would be equipped with a broad range of enforcement tools, including civil penalties, injunctive relief, and equitable remedies. The DPA would promote data protection and privacy innovation across public and private sectors, developing and providing resources such as Privacy Enhancing Technologies (PETs) that minimize or even eliminate the collection of personal data.

Massive amounts of personal information — public profiles, health data, photos, past purchases, locations, search histories, and much more — is being collected, processed, and in some cases, exploited by private companies and foreign adversaries. In some instances, the data was not given willingly, and in many others, consumers had little idea what they were signing up for. As a result, the data of everyday Americans is being parsed, split, and sold to the highest bidder, and there is little anyone — including the federal government — can do about it. Not only have these tech companies built major empires and made billions from selling Americans’ data, but they spend millions of dollars per year opposing new regulations.

In recent years, major data breaches have occurred at banks, credit rating agencies and tech firms. In 2017, Equifax failed to safeguard the sensitive credit data of hundreds of millions of Americans, allowing a foreign government to steal and expose this information. In 2018, Facebook exposed the personal information of nearly 50 million users because it reportedly ignored warnings from its own employees about a dangerous loophole in its security. Additionally, the Federal Trade Commission (FTC) has failed to enforce its own orders and has failed to act on dozens of detailed consumer privacy complaints alleging unfair practices concerning data collection, marketing to children, cross-device tracking, consumer profiling, user tracking, discriminatory business practices, and data disclosure to third-parties.

The Data Protection Agency explained:

The DPA would be an executive agency. The director would be appointed by the president and confirmed by the Senate, serves a 5-year term, and must have knowledge in technology, protection of personal data, civil rights, law, and business. The agency may investigate, subpoena for testimony or documents, and issue civil investigative demands. It may prescribe rules and issue orders and guidance as is necessary to carry out federal privacy laws. The authority of state agencies and state attorneys general are preserved in the Act.

The DPA would have three core missions:

1. Give Americans control and protection over their own data by creating and enforcing data protection rules.

• The agency would enforce privacy statutes and rules around data protection, either as authorized by Congress or themselves. It would use a broad range of tools to do so, including civil penalties, injunctive relief, and equitable remedies.
• The agency would also take complaints, conduct investigations, and inform the public on data protection matters. So if it seems like a company like Tinder is doing bad things with your data, the Data Protection Agency would have the authority to launch an investigation and share findings.

2. Maintain the most innovative, successful tech sector in the world by ensuring fair competition within the digital marketplace. 

• The agency would promote data protection and privacy innovation across sectors, developing and providing resources such as Privacy Enhancing Technologies (PETs) that minimize or even eliminate the collection of personal data.
• The agency would ensure equal access to privacy protection and protect against “pay-for-privacy” or “take-it-or-leave-it” provisions in service contracts—because privacy, including online privacy, is a right that should be enforced.

3. Prepare the American government for the digital age.

• The agency would advise Congress on emerging privacy and technology issues, like deepfakes and encryption. It would also represent the United States at international forums regarding data privacy and inform future treaty agreements regarding data.

The full text of the legislation may be found here.

###

Today, January 28th is Data Privacy Day, the international annual day of action and awareness to promote the privacy of our personal data.

The College Board and ACT sell personal student data at a profit.  Yet twenty one states prohibit this practice by school vendors, operators or service providers,  under any  conditions; see list   below.  Most every district or state contracts with one of these organizations to administer the PSAT, SAT, AP or ACT exams to students in school.

The College Board sells student data for 47 cents per student  to colleges and other organizations, including some for-profit companies, but have refused to make the list public. They offer them student test scores within a range, and other  personal information deceptively gathered from students via surveys administered before their exams.  As the Wall Street Journal explained, one reason colleges buy the data is to lower their acceptance rates and selectivity, by luring far more students to apply than they have any intention to accept. Most outrageously, the College Board falsely claims they don’t sell student data on their privacy policy, instead saying they “license” the data, a difference without a distinction.

This needs to stop.  Please contact your state Attorneys General today, and ask them to investigate these illegal practices, which violate state student privacy laws and the laws that most every state has that bar deceptive practices.  Thanks!

Submitted in response to the FTC request for Public Comment on the Implementation of the Children’s Online Privacy Protection Rule

Dec. 11, 2019

https://www.regulations.gov/comment?D=FTC-2019-0054-0001

Federal Trade Commission
Washington, DC 20580

Re: COPPA Rule Review, 16 CFR part 312, Project No. P195404

To the FTC:

The twenty-three organizations we represent, consisting primarily of parents, educators and education advocates in states and districts throughout the country, are very concerned that the FTC is prepared to weaken the Children’s Online Privacy Protection Act (COPPA)  by allowing for the expanded collection of personal data directly from children under thirteen, without prior parental notification or consent including in schools.

This would not only contradict the original intent and language of the law, in our view, but would be extremely unwise.  As parents, educators, and advocates, we believe that the expansion of digital technologies in schools, especially those that collect data directly from children, serve neither their instructional needs nor their emotional and social well-being.

We also believe that these practices seriously risk children’s privacy, given the increased number of breaches reported by schools and districts throughout the country. Since COPPA was passed in 1998, the use of technology has expanded in schools with insufficient oversight and inadequate security protections. The number of breaches and attacks by criminal hackers has increased, so that now schools are the second-largest victims of ransomware. ^[1] We are also concerned about the potential monetization of this personal data for marketing and advertising purposes.

In September 2018, the FBI issued a Public Service Announcement, warning that the increased collection of children’s personally identifiable data in schools “could result in social engineering, bullying, tracking, identity theft, or other means for targeting children.”^[2]

And despite the protestations of the industry, there is little or no evidence to support the instructional utility of ed tech programs. As John Pane of the RAND Corporation, who has led several studies of schools using online technologies, has said, “the evidence base is very weak at this point.”[3]

Moreover, according to the nationwide surveys of teachers as reported in the Educator Toolkit for Student Privacy, released last year by the Parent Coalition for Student Privacy and the Badass Teachers Organization,[4] more than half of teachers believe that current laws do not sufficiently protect student privacy.  Among their top concerns are that too much personal student data is collected and shared with vendors with the risk that it may be monetized, and that as the use of ed tech grows, human interaction and individualism is undermined.

These findings were reinforced by recent surveys undertaken by Education Week, which show that teachers are increasingly doubtful about the use of these educational apps and programs. [5] According to the most recent Ed Week survey, only 33% of teachers said they believe that digital technologies can improve student learning either “quite a lot” or “a great deal.”

At the same time, 72% express strong concerns that “students are spending too much time on screens,”  47% say that the “technology industry is gaining too much influence over public education”, and 38% worry that companies are “collecting too much sensitive student information.”[6]

As Education Week reporter Ben Herold concludes, “Despite continued hype, K-12 educators remain skeptical that new technologies will transform public schooling or dramatically improve teaching and learning. “ [7]  Perhaps as a result, according to an earlier Ed Week survey,  33% of teachers have abandoned the classroom use of computers, and 32% have abandoned the use of online games, apps and programs.[8]

A bipartisan group of Senators recently sent a letter to the FTC, urging the Commission not to weaken the privacy protections embedded in COPPA, and to refrain from allowing “exceptions to parental consent requirements around educational technology …. Now is not the time to pull back.”^[9]

We wholeheartedly agree.  We  urge you to continue to uphold the original intent of and meaning of the law and to retain the critical parental consent requirements for the direct online collection of data from children under 13.  In fact, we believe that Congress should consider raising the age of consent for the direct online collection of student personal data to age eighteen.

Yours sincerely,

Network for Public Education
Parent Coalition for Student Privacy
Pastors for Children
The Opt Out Florida Network
Public Education Partners (Ohio)
Pueblo Education Coalition
Badass Teachers Association
Arizona Educators United
Texas Kids Can’t Wait
Northwest Ohio Friends of Public Education
New Bedford Coalition to Save Our Schools (NBCSOS)
Indiana Coalition for Public Education – Monroe County
Return To Parental Rights
Gathering Families
Stand For Schools
Northeast Indiana Friends of Public Education
Parents Across America
Ohio BATs
NYS Allies for Public Education
NYC Opt Out
Raise Your Hand for Illinois Public Education
Save Our Schools Arizona
Wisconsin Alliance for Excellent Schools

______________

Endnotes

[1] Gross, Natalie. “Ed tech’s growth breeds district IT ‘management nightmare’”, Education Dive, Oct. 3, 2019. https://www.educationdive.com/news/ed-tech-growth-has-bred-district-it-management-nightmare/564280/

[2] Federal Bureau of Investigation, “Education Technologies: Data Collection and Unsecured Systems Could Pose Risks to Students,” I-091318-PSA , Feb. 13, 2018. https://www.ic3.gov/media/2018/180913.aspx

[3] Herold, Benjamin, “What Is Personalized Learning?” Education Week, November 5, 2019. https://www.edweek.org/ew/articles/2019/11/06/what-is-personalized-learning.html

[4] Parent Coalition for Student Privacy and Badass Teachers Organization, Educator Toolkit for Teacher and Student Privacy: A Practical Guide for Protecting Personal Data, Oct. 2018. https://bitly.com/PCSP_EducatorPrivacyToolkit

[5] Education Week Research Center, Teachers and Ed-Tech Innovation: Results of a National Survey, May 2019. https://www.edweek.org/media/tc survey report-final 5.9.19.pdf

[6] Klein, Alyson, “Data: Here’s What Educators Think About Personalized Learning” Education Week,

November 5, 2019. https://www.edweek.org/ew/articles/2019/11/06/data-heres-what-educators-think-about-personalized.html

[7] Herold, Benjamin, “Ed-Tech Supporters Promise Innovations That Can Transform Schools. Teachers Not Seeing Impact” Education Week, April 23, 2019. https://www.edweek.org/ew/articles/2019/04/24/ed-tech-supporters-promise-innovations-that-can-transform.html

[8] Education Week Research Center, May 2019, op.cit.

[9] Senators Markey, Blumenthal, Hawley and Blackburn, Letter to FTC Commissioners on COPPA and Children’s Privacy, Oct. 4, 2019. https://www.markey.senate.gov/imo/media/doc/COPPA%20Letter%20to%20FTC%202019.pdf

UPDATE: Another lawsuit was filed today vs the Univ. of CA system for requiring College Board/ACT exams for admission; the lawsuit claims these exams are unconstitutional since they are racially biased and provide no meaningful info about a student’s ability to succeed.

Today a federal class action lawsuit was filed against the College Board for selling student data and for deceptive practices.  See the legal complaint here and the press release below.  If any parent is interested in learning more about the lawsuit and potentially joining in, please email us at [email protected]

There are lots of reasons to oppose the College Board selling student data through their “Student Search program” – the most obvious of which is that when they’re acting as a school vendor, this practice violates the law in 23 states by school vendors or “operators” under most conditions (see list here) , including NY, without special exceptions for the College Board and ACT.

In July 2018, the NY Times revealed that an organization to which College Board had sold student data had resold it to a for-profit company that markets expensive programs to families with dubious benefits, and that this practice may contribute to a thriving and largely unregulated commercial market in student data.  To this day, the CB refuses to make public the list of third parties and their “partners” to whom they sell the day.

The data is often collected under pressure from minor students before the administration of the PSAT, SAT and AP exams– without prior parent notification or consent – and the instructions are purposely left ambiguous so many don’t understand that this is voluntary.  Many parents have reported  that even though they told their kids not to answer them, they were pressured into doing this anyway.

The questions that College Board poses to students involve quite personal issues, including religious interests and activities that cannot be asked without parental opt out or consent according the federal law PPRA – as  the US Department of Education warned last year.

The little information the College Board provides on its website about this program is often highly deceptive – including claims that the “College Board does not sell student information”  and that they never share their actual test scores –  whereas they do sell personally identifiable student data for 47 cents a name, along with their test scores within  narrow ranges.  So, for example,  if a student decides not to submit their scores to  a score optional school they may not understand that the college may already have purchased their scores within a set range.

As Anthony P. Carnevale of  Georgetown University said, “The students are being treated as a commodity. The College Board is getting every last nickel that it can out of anybody who touches them.”

Given that these scores are highly correlated with race and class, allowing colleges to buy them may further harm disadvantaged students .  And as this recent Wall Street Journal pointed out,  the main goal of many colleges in purchasing this data is to improve their reputation for selectivity by increasing their rejection rates.

As it was recently revealed, Harvard recruits many more black students in particular  into applying than it has any intention of admitting.

Many students are so overwhelmed with the masses of marketing materials they receive through the “Student Search” process they  have a hard time distinguishing legitimate offers from schools that really would be are a right fit for them.  One high school student told me she almost threw out material sent her from a college she had applied to by mistake.

In any case, according to a research study,  the likelihood of students attending colleges whose data is purchased from the College Board increases by only 0.02 percentage points  — a tiny amount, though colleges lure five times the number to apply in this way.

The  whole practice of colleges spending millions on buying student data and marketing  to them is part of an arms race where more and more funds which should be used to improve education services is spent instead on advertising and mailings – similar to the wasteful spending of drug companies on advertising which contributes to the high cost of health care in the United States.

Today’s press release about the lawsuit follows.

Diane Tavenner is appearing in NYC  on Nov. 6, to talk about her new book with Angela Duckworth, sponsored by the Walton Family Foundation.  You can RSVP here, “for an intimate conversation between two of America’s leading CEOs, educators, researchers and mothers.” Doors open at 5:30 with a cocktail reception.  According to the invitation, “Each attendee will receive a copy of Prepared and will have the opportunity to have it signed by the author.”

As our updated Summit fact sheet explains, the controversial Summit Learning Platform that has aroused such fierce opposition from parents and students alike at public schools across the nation has now been handed off to  a new organization called T.L.P., run by a board led by Mark Zuckerberg’s wife, Priscilla Chan.

Diane Tavenner continues to run the west coast chain of Summit charter schools, which are involved in ongoing battles with teachers intent on organizing a new union.  At the same time, Taverner is launching a bunch of new initiatives, including promoting her new book that features advice for parents called “Prepared: What Kids Need For a Fulfilled Life.

The book has its own website as well as a glowing blurbs from Todd Rose, director of Harvard Graduate School of Education,  Angela Duckworth, Linda Darling Hammond and Wendy Kopp.   According to Amazon, the book is #30 in Charter Schools, #65 in Education Leadership   and #97 in Business Education.

The website says that the book will be “Your Roadmap to What Kids Need for a Fulfilled Life” and will educate parents that their children “deserve opportunities to discover their unique interests and talents” as well as  “pursue the lives they want to live—filled with financial security, purposeful work, meaningful relationships, and networks of support.”

One might imagine that an essential aspect of a child’s fulfillment would mean an ability to attend a school that allowed for meaningful relationships – which would seem to rule out most of the Summit schools, which according to many students  feature excessive screen time and allows for insufficient  human interaction with their teachers and fellow students.

To publicize the book, Summit has hired a “Growth Marketing Director” in charge of “creating and energizing a national community” of “Prepared Parents”.  This new organization’s goal: “to equip parents with research-based tools and resources to guide their kids towards a fulfilled life…Prepared Parents helps parents cut through the noise to make parenting, learning and school easier.”

“Prepared Parents” is a new program within something called Marshall Street Initiatives, an arm of Summit Public Schools.   I hadn’t heard anything online or anywhere about Marshall Street Initiatives, but I found the name mentioned in the agenda and board packet of the June 20, 2019 Summit board meeting, in the context of the off-loading of Summit Learning to CZI:

Summit Philanthropy Programs and Marshall Street Initiatives (MSI)-Estimated Need $9.2 [M]

The transition of Summit Learning has been a longer and more difficult process than originally expected. This transition has delayed the initiation of new programs and necessary fundraising. Anecdotally, former grantors have reported excitement about the new initiatives and are glad that Summit has transitioned Summit Learning to its own non-profit. By early fall there will be a more concrete fundraising plan and results in place. There is one grant for $1M that has been received and is deferred until 2019-2020.

Further down in the packet, there are details showing that the Marshall St. Initiatives will cost $10.2 million to start with :

…Philanthropy Programs and Marshall Street Initiatives $10.2M: Pivoting from Summit Learning has launched new programs that require philanthropy and include a new hub of activity named Marshall Street Initiatives (MSI). This group includes the following programs, all funded by philanthropy.

• Leadership, Analytics, & Real Estate
• Marshall Street Initiatives

○ Summit Teacher Residency
○ Continuous Improvement
○ Summit Extension*
○ School Leader Certification*
○ Prepared Parents*
■ *=new programs

A detailed budget shows that $2.4 million out of the $10. 4 million will be spent on “Leadership”, to pay for a new CEO, a new Chief Financial Officer, a new Chief Operating Office and a new Superintendent, each of whom were to receive six-figure salaries.

The packet for the October meeting of the Summit Board describes the goal of the Marshall St. Initiatives this way: “To develop shareable solutions to locally felt, globally evident problems in America’s public education system so that every student has the opportunity to pursue a fulfilled life.”  It will be headquartered in a new snazzy building at 200 Marshall St. in Redwood City,  a convenient four minute walk from the CZI headquarters at 601 Marshall Street.

The new Initiatives will include a new teacher residency program, a new School Leadership Certification program, the “Prepared Parents” organization, and more. 

At the same time, the board packet reveals that none of the Summit charter schools in California or Washington made their enrollment targets this year, which has caused an overall revenue shortfall  of nearly $5 million.

In any case, Tavenner seem to be launching three new efforts at once: A new book, a new “Prepared Parents” online community, and a new Institute for teacher and leadership training, all under the aegis of the Marshall Street Initiatives.

Interestingly, there is very little in any of these board packets about T.L.P, that took over the operations of the Summit Learning platform this fall for the approximately 300 public schools that are still using it.

On the Summit website and in an interview,  Andrew Goldin, the Executive Director unconvincingly claims that the acronym T.L.P. stands for “Teachers, Learners, and Partners.” Yet the Summit board agenda from June reveals otherwise: “The Learning Platform (TLP-new Summit Learning organization).”  As is often the case, CZI has attempted to obscure the reality of the essentially digital nature of this program in its name, and to emphasize its more human aspects – as they do in much of their promotional materials.

Check out the updated Summit fact sheet here and below, which includes new  survey results from teachers, parents and students at schools using the Summit platform.