See also our press release and our letter to the Commission, sent Nov. 14, 2016.

Recently Dan Greenstein, director of the Gates Foundation ‘s Postsecondary Division, released the Foundation’s top advocacy priorities for 2017.  Chief among them was to “push Congress” to overturn the prohibition against the federal collection of personal data of all students, called the federal student-unit record system.   More on this here.  The ban on the federal government collecting the personal data on all students has existed since the Higher Education Opportunity Act of 2008, in 20 U.S.C. sec. 1001.

The Commission on Evidence-Based Policymaking (CEP) was established by Congress last year.  One of the goals of this Commission is to consider “whether a Federal clearinghouse should be created for government survey and administrative data.”  The Commission held hearings in DC on October 21, 2016.   At the hearing, several Gates-funded groups testified, including New America, Data Quality Campaign, Education Trust and Young Invincibles.

All these organizations testified in favor of overturning the ban on federal student-unit record system, or to weaken the ban. Though they said the purpose of this would be to allow for “improvements in information on postsecondary progress and outcomes,” but the actual goal of the Gates Foundation and their allies is far more ambitious: to allow for the creation of a “national data infrastructure” that would incorporate the personal data on all public school students, starting in preK through high school, college and beyond, and to connect all data now held by different state and federal agencies.  This was revealed in the summary and chart in the Gates Foundation’s recent report on their top advocacy priorities:

GOAL

Support the development of a comprehensive national data infrastructure that enables the secure and consistent collection and reporting of key performance metrics for all students in all institutions. These data are essential for supporting the change needed to close persistent attainment gaps and produce an educated and diverse workforce with career-relevant credentials for the 21st century.

A chart was included to demonstrate the overarching and comprehensive nature of the data infrastructure envisioned:

On November 14, the Parent Coalition for Student Privacy sent a letter to the Commission to strongly oppose the overturning of the ban on a proposed federal student-unit record system.  Groups that signed  include the ACLU, Network for Public Education, NPE Action, Parents Across America, and NY State Allies for Public Education. We believe that the potential risks to student privacy that such a centralized, comprehensive federal database are enormous, as expressed in our press release.

Please send your own comments to the Commission, in opposition to allowing the federal government to collect personal data and track every public school student in the nation.

The deadline for comment is December 14, 2016 at 11:59 PM.

Below are instructions on how to submit your comments, as well as a sample comment you can use,  but please feel free write your own and/or edit this any way  you wish.

Thanks!  Rachael and Leonie, Parent Coalition for Student Privacy

Instructions:

1. Visit the Federal Register at: https://www.regulations.gov/docket?D=USBC-2016-0003
2. Click on the “Comment Now” button in the upper right hand corner.
3. Copy our “Sample comment” below and paste it into the window on the Federal Register webpage.
4. If you would like to write your own comments, don’t forget to add to the start of your message: Docket ID USBC-2016-0003-0001 “Commission on Evidence-Based Policymaking Comments”
5. Enter your name and check the box if you would like to add your contact information.
6. Encourage others to submit their comments too!

Sample comment:

Docket ID USBC-2016-0003-0001 “Commission on Evidence-Based Policymaking Comments”

I strongly oppose any proposal that would lead to the creation of a centralized, federal clearinghouse of the personally identifiable information of all students, commonly referred to as a student unit-record system or national database.

The risk that such a federal database would pose to student privacy is immense; including the very real possibility of breach, malicious attack, or the use of this information for purposes not initially intended.  Ever since a federal student unit-record system was banned by the Higher Education Act in 2008, the reasons against creating it have only become more compelling.

In the past few years, much highly personal data held by federal agencies has been hacked, including the release of the records of the Office of Personnel Management involving more than 22 million individuals, not only federal employees and contractors but also their families and friends.

The US Department of Education has been found to have especially weak security standards in its collection and storage of student data, and received a grade of D for its security protections.

In addition, preK-12 student data currently collected by state departments of education that would potentially be shared with the federal government include upwards of 700 highly sensitive personal data elements, including students’ immigrant status, disabilities, disciplinary records, and homelessness data.

I am also very concerned about recent revelations of the widespread surveillance on ordinary citizens by the federal government, and the way in which a national student data system would be used to expand the tracking of students from PreK into high school, college, the workforce and beyond. A federal data clearinghouse of student information could effectively create life-long dossiers on nearly every individual in the nation.

I urge you to strongly oppose the creation of any centralized federal data system holding students’ personally identifiable information and to support the continuation of the  ban in the report you provide to Congress.

Yours,  [name, state, and organization affiliation if any]

Our concerns about the open-ended data sharing of the  Summit/Facebook software platform was featured on the front page of today’s Washington Post. This software is in 100 schools nationwide, about two thirds of them public schools. The list is here. Two of the schools are in NYC: the Bronx Writing Academy in District 9; and J.H.S. 088 Peter Rouget in District 15 in Brooklyn.

Summit is sharing the student personal data with Facebook, Google, Clever and whomever else they please – through an open-ended consent form that they have demanded parents sign.  A copy of the consent form is here.

I have never seen such a wholesale demand from any company for personal student data, and can imagine many ways it could be abused.  Among other things, Summit/Facebook claims they will have the right to use the personal data “to improve their products and services,” to “conduct surveys, studies” and “perform any otheractivities requested by the school. ”

Here is an excerpt:

Summit may collect information that you provide or your child provides directly to Summit, such as contact information, coursework, testing, and grades. Summit also may collect information automatically from browsers, computers, and devices (such as information from cookies and browser and device identifiers in order to remember your preferences)….. Summit may use your child’s information to conduct surveys and studies; develop new features, products, and services; and otherwise as requested by your school or consistent with your consent. … Summit also may disclose information to third-party service providers and partners as directed or authorized by the school. For example, Summit uses Clever, Facebook, and Google to help develop and improve the personalized learning plan software or to provide related educational services on Summit’s behalf.

They claim they won’t use the child’s personal data for targeted ads (as would be banned anyway in the CA law called SOPIPA) but this is among the only restriction. They say they can sell the data “in connection with a corporate transaction, such as the sale of our Services, a merger, consolidation, asset sale.” The one-sided Terms of Service is here; the Privacy Policy is here.

The Summit platform has never been independently vetted for security protections – or shown to yield any educational benefits, and I believe is a very radical way to outsource instruction and student data to private companies.

Other reasons that teachers as well as parents should be concerned:

The Terms of Service claims the right to use the intellectual property of teachers in these schools, including course assignments, etc. and even student work without any recompense: “You Grant Us a non–‐exclusive, perpetual, transferable, sub–‐licensable, royalty–‐free, worldwide License to use content that you post on or in connection with the Services in any manner, media, form, and modes of uses, now known or later developed.”

–Though I’m not an attorney, the Terms of Service seems to explicitly and repeatedly waive any liability  that Summit or FB or any of its partners may have for protecting the data against breaches, complying with state or federal law,  or abiding by their own Terms of Service;

— As the Washington Post article points out, the TOS would force any school or party to the agreement (including teachers) to give up their right to sue in court if they believe their rights or the law has been violated, and limits the dispute to binding arbitration in San Mateo CA – in the midst of Silicon Valley, where Facebook and Google presumably call the shots.  This is the same sort of abuse of consumer rights that that banks and credit card companies have included in their TOS and that the federal Consumer Financial Protection Bureau is now trying to ban.

–The CEO of Summit charters, Diane Tavenner, is also the head of the board of the California Charter School Association, which has aggressively tried to get pro-privatization allies elected to California school boards and state office, and has lobbied against any real regulations or oversight to curb charter school abuses in that state.

– –  Summit says they won’t sign individual contracts with school districts or schools, for the    following ostensible reasons, and suggests a legal loophole for states and districts that require such contracts:

Summit Public Schools is unable to sign contracts, MOUs, or other legal documents from other districts, CMOs, or individual schools. Straying from our Summit Partnership contracts would add immeasurable risk to our organization as we are unable to acquire third party validation on different contracts in the way that we did for our own participation agreement. It would not be legally sound for us to enter into two legal contracts with two sets of potentially conflicting commitments for one program.

Some districts that have policies where all third party vendors need to sign one designated contract were able to bypass that requirement given the status of Summit Public Schools as an educational organization rather than a vendor and the nature of the partnership as a free exchange of ideas and services rather than a paid service relationship.

And then they add – presumably to assuage the fears of parents or school administrators:

In order to ensure that our legal agreement meets the high quality demanded by school organizations across the U.S., Summit Public Schools has gone the extra mile to work with one of the best legal teams in the country to draft this agreement. We worked with Jules Polonetsky – CEO of the Future of Privacy Forum, a Washington, D.C.-based think tank that seeks to advance responsible data practices – and his team to review our privacy policies and provide his 3rd party stamp of approval. Straying from the language in our participation agreement would add risk as we are unable to also acquire third party validation on different contracts.

What they don’t reveal is that the Future of Privacy Forum is largely funded by the technology industry and the Gates Foundation, and Polonetsky was a big supporter of inBloom.  (Nevertheless, the sample contract they apparently offered to Kentucky schools did not include the binding arbitration clause, though it limits Summit’s liability to $10,000.)

For these and other reasons, I think parents and students should be VERY concerned.  

In my view and that of many other parents, the explosion of ed tech and the outsourcing of student personal data to private corporations without restriction, like this current Summit/Facebook venture, is as risky for students and teachers as the privatization of public education through charter school expansion.  In this case, the risk is multiplied, since the data is going straight into the hands of a powerful charter school CEO – closely linked to Gates, Zuckerberg and Laurene Powell Jobs, among the three wealthiest plutocrats on the planet.

Gates has praised Summit to the skies, has given the chain $11 million, and has made special efforts to get it ensconced in his state of Washington; Zuckerberg is obviously closely entrenched in this initiative, and Laurene Powell Jobs has just granted the chain $10 million to launch a new charter school in Oakland.

I sent the following list of questions to Summit at [email protected] nine days ago, but have received no response.  Others — especially parents at these schools and/or privacy advocates — might like to send their own questions or resend mine as well.  And if you are a parent or a teacher at one of these schools, please contact me ASAP at [email protected]  Thanks! Leonie

Questions for Summit:

1. 1. What is Summit’s definition of “reasonable and comprehensive data protection and security protocols to protect student data”?  What does that specifically include in terms of encryption, independent audits, security training, etc?  And where is that in writing?
2. 2.   If my child’s data does breach, what rights would I have as a parent to secure damages?
3. 3.  Does Summit claim unlimited rights to share or utilize my child’s homework and intellectual property without notice or compensation that they are claiming with teacher work in the TOS?
4. 4. Can Summit specifically itemize the companies/organizations that they will share my child’s data with, aside from those mentioned below?
5. 5.  Are each of these third parties barred from making further redisclosures of my child’s data?
6. 6.  Are each of these third parties, and any other organizations or companies or individuals they redisclose to, legally required to abide by the same restrictions as listed under your TOS and PP, including being prevented from using targeted or non-targeted advertising, and/or selling of data, and using the same security protections?
7. 7. Does Summit promise to inform parents over the course of the year all the additional third parties the company plans to disclose my child’s data to?
8. 8. What is the comprehensive list of personal data Summit is collecting and potentially sharing from my child?  You mention a limited list below, but does it also include my child’s homework, grades, test scores, economic status, disability, English proficiency status and/or race as well?
9. 9.  The TOS mentions survey data.  Is there any personal data from my child that Summit promises NOT to collect via a survey or otherwise?  Will parents have the right to see these surveys before they are given and opt out of them, or does signing this consent form basically mean a parent is giving up all their rights under the PPRA?
10. Why can’t Summit simply give the software platform to schools to use if it is beneficial, along with links to instructional materials, rather than demand as “payment” in the form of all the student information as well?

1   11. Do you promise not to use the information gained to market products directly to students and/or their parents, and are all your partners and/or those they disclose the information to barred from doing so as well?

1   12. The PP says you will use my child’s personal data to develop new educational “products” – what does that mean?  Why can’t you use de-identified data for this purpose?

13. It also says you will use this data to “communicate with students, parents, and other users.”  What does that mean? What kind of communications will you engage in with my child or with me?
14. The PP states a parent can “review, correct or have deleted certain personal information”.  Which kind of personal information can I delete, how will I be able to do that and will that stop my child from using the platform?

1    15. The PP also says you will share the data with anyone “otherwise directed or authorized by the school.”  What does that mean? Does my signing a consent form mean that the school can authorize to share this information with ANYONE else, without specifying the sort of third party, for what reason, or without limitation, without informing me or asking for my further consent?

1   16. It says it will send notice of proposed changes to the PP ahead of time to the participating schools; why not parents if you have their contact info?  Shouldn’t they hear this directly from you and immediately if you are considering changes?

17. Does Summit consider this parent consent form to mean that parents are waiving the privacy rights of their children under all three federal student privacy laws, including FERPA, COPPA and PPRA?

1  18. The PP says that “FERPA permits schools to share students’ information in certain circumstances, including where the school has gotten a parent’s’ consent or where the organization receiving the student data operates as a “school official.” Summit Public Schools operates as a “school official” consistent with the Department of Education’s guidance under FERPA.”  If this is true, why does Summit need to ask for parental consent?  What additional rights does my consent afford Summit that you would not have without consent in terms of the collection, use and disclosure of a student’s personal information?

19. Summit says that “Participating schools and individual teachers own, and are responsible for, student data provided through the Summit Personalized Learning Platform.” Why don’t students own their own data?
20. This raises another related question: the Summit Privacy Policy and Terms of Service grants schools and teachers some rights (however limited.) What rights do parents and students have under these conditions?
21. The TOS says that if schools believe Summit has violated its promises or complied with the law, instead of suing they must submit to binding arbitration in San Mateo CA and are barred from filing class action complaints.  This type of provision has been heavily criticized when banks and credit card companies have included in their consumer agreements, and the Consumer Financial Protection Board is considering restricting their use. Why is this clause any more acceptable in your TOS?
22. What legal recourse do schools, teachers or parents have if Summit violates the law or its TOS, for example if Summit decides to sell or give away or carelessly store the data given that the TOS  says “UNDER NO CIRCUMSTANCES, INCLUDING WITHOUT LIMITATION, NEGLIGENCE, WILL SUMMIT, ITS AFFILIATES, OR ANY PARTY INVOLVED IN CREATING, PRODUCING, OR DELIVERING THE SERVICES BE LIABLE FOR DAMAGES OR LOSSES” in any case?
23. In yet another clause of the TOS, Summit requires schools to “agree to indemnify, hold harmless, and defend Summit, and its affiliates, licensors, and service providers, and each of their respective officers, directors, contractors, agents…etc.et. against any and all demands, claims, liabilities, judgements, fines, interest, penalties… etc. including attorneys’ fees etc.” Why the need for so many layers of self-protection and disclaimers of liability?
24. What rights does a parent have in general if Summit violates the TOS or the PP?  Are they bound to the binding arbitration clause in the TOS that the school must agree to?
25. In another FAQ here, Summit says that it will not sign contracts or written agreements with individual school districts, and if the state requires this under law, districts or schools should try to “bypass that requirement” by claiming that a) Summit is not subject to the law because it is not a “vendor” but an “educational organization” and b) that they should not have to sign a contract because of the “nature of the partnership as a free exchange of ideas and services rather than a paid service relationship.”  But if you are gaining potential economic and programmatic benefits from your access to student data, including using it to build new and better “products” as the TOS states, why isn’t this a commercial relationship bound by state law?  And if this relationship is truly a “partnership” with a free exchange of ideas, why is the TOS so one-sided and seems to protect Summit from any possible liability, and not the school?

For Immediate Release: September 21, 2016

Contact: Rachael Stickland; [email protected], 303-204-1272

Parent Coalition for Student Privacy relieved Daines/Blumenthal SAFE KIDS Act pulled

Coalition members feared the bill would open up the floodgates of commercialism

 

The Parent Coalition for Student Privacy, composed of parents, advocates and educators throughout the nation, and whose members led the fight against inBloom, are relieved that the SAFE KIDS Act, co-sponsored by Senators Daine and Blumenthal, scheduled to be marked up in the Commerce Committee today was pulled at the last minute.

Rachael Stickland, co-chair of the Parent Coalition for Student Privacy said, “While we appreciate the sincere motivation of these Senators to put controls on how personal student information is used by companies and organizations, we believe that this bill would have inadvertently further eroded student privacy.  Right now, both the Student Privacy Pledge and FERPA, as well as other federal laws, actually ban the use of student data for non-educational purposes including behavioral advertising, while this bill would seem to have allowed for that possibility.  There is also much confusion and ambiguity in the bill’s language about how parents would be informed about how their children’s data was being used by companies, how to request its deletion, when this would occur, as well as what specific security protections would be required to protect against breaches.”

Josh Golin, Executive Director of Campaign for a Commercial Free Childhood, said: “The bill, though well-intentioned, had far too many loopholes to give children the protection from commercial exploitation that they deserve. It allowed unlimited targeted ads to students through the use of apps assigned by schools, as long as these ads were based on personal information gained through an individual online session.  It also exempted some of the most frequently assigned websites and apps such as YouTube.  This is unacceptable, as advertising is harmful to children and detracts from any educational benefits the program might otherwise provide.”

Leonie Haimson, the Executive Director of Class Size Matters and the co-chair of the Parent Coalition concluded, “We would like to work with Senators Daine and Blumenthal and the other members of the Commerce Committee on improving this bill to ensure that student privacy is strengthened rather than further eroded, given the push from some sectors of the ed tech industry to exploit our children’s personal information and to treat them as consumers rather than as students.  Parents are increasingly concerned about the accelerated adoption of so-called educational apps in schools; we strongly believe their use must be approached with caution and regulated with a firm hand, to ensure that they do not violate children’s privacy and safety, or undermine the learning experience. We feared that this bill would further open up the floodgates of commercialism.”

###

Note: POLITICO Morning Tech reported on our press release, found here.

Back to school season can be a busy or even stressful time for both parents and children. As the days grow shorter, the “to-do” list grows longer. Number one on the list – because of its importance and time sensitivity – should be to opt out your child from directory information sharing at school.

What is directory information?

According to the U.S. Department of Education, directory information is a limited set of personal “information that is generally not considered harmful or an invasion of privacy if released” and often includes a student’s name, address, telephone number, email address, photograph, date and place of birth, etc.  It does NOT include even more intimate and sensitive personal information like test scores, grades, disability or disciplinary records that schools can legally share with companies, contractors and other third parties without parental knowledge or consent for operational, evaluation, and research purposes. The federal government has allowed these growing number of exceptions through regulatory amendments over the last decade or more, described in detail here and here.

The federal law known as the Family Educational Rights and Privacy Act (FERPA) enables schools or school districts to share directory information with any person or organization outside the school/district without parental consent — but only when the school/district provides public notice to parents first. Notice must include:

• The types of student information that the school/district has designated as directory information;
• Details about a parent’s right to refuse to allow the school/district to designate any or all of those types of information as directory information; and
• The amount of time the parent has to notify the school/district in writing that he or she does not want any or all of this information shared with others outside the school.

FERPA allows schools/districts to adopt their own directory information policies, but if they choose to provide students’ directory information to a limited number of third parties, their public notice to parents must specify the individuals, groups or companies who may receive directory information and/or for what purposes. Unfortunately, this public notice may not always be provided, and when it is, it is often difficult to find because it may be buried in hundreds of pages of information during registration, in a student handbook, a parent newsletter, school announcement, local newspaper, or website.

Most schools/districts give parents only ten to thirty days from the start of the school year to exercise their right with regard to directory information, and most offer parents a limited choice between two options:

1) Allow schools and districts to share students’ directory information with anyone including marketing companies and the media — often referred to as “opting in” to sharing directory information; or

2) Refuse to allow schools and districts from sharing directory information with anyone, including parent organizations for purposes of creating school phone directories, graduation brochures, or companies who publish yearbooks — often referred to “opting out” of sharing directory information.

This type of “all-or-nothing” approach presents a huge challenge for many parents. On the one hand, parents don’t want their children’s private information shared with anyone who requests it. On the other hand, most parents would like their children to be included in school-related publications like yearbooks, directories, brochures, and newsletters.

While FERPA doesn’t require schools to allow parents the option to select which types of directory information can be shared with whom, some privacy-minded school districts in Maryland, Montana, and North Carolina, for example, have abandoned the “all-or-nothing” approach for a “menu selection” which gives parents more control over their student’s directory information.

The Parent Coalition for Student Privacy and the Campaign for a Commercial-Free Childhood have prepared a model Directory Information Opt Out form for parents to submit to their schools at the start of the school year, as part of a larger privacy toolkit that we will release soon, via a grant from the Rose Foundation.  Our Directory Information Opt Out form is designed to respect the ability of parents to choose what information they would like shared for what purposes, while also protecting their children’s privacy.

Why should parents opt out?

FERPA became law in 1974 at a time when students’ directory information was used primarily in school-sponsored publications like yearbooks, and to identify student athletes for local newspaper articles. Over the last forty years, individuals, groups and companies have recognized the value of this student information – especially with the creation and growth of the Internet – for commercial and non-educational purposes. Companies who access students’ directory information can sell it to others or use it to market products directly to students, political offices can use it to build their voter tracking systems, thieves can use it to steal identities, and perpetrators can use it to stalk students or commit other crimes.

How can parents opt out?

1. Ask the school or school district for its “directory information” policy.
2. If the school/district has a policy, read it carefully to find out which personal details are considered directory information and with whom it can or will be shared.
3. If the policy forces parents to choose between opting in or opting out of all sharing of directory information, parents should opt out to protect their children’s privacy. However, doing so could mean that their children’s names and pictures will not be listed in the yearbook or other school-related publications.
4. Share the model Directory Information Opt Out form we have prepared with the school’s principal or other school officials and encourage them to adopt a new policy giving parents more control over their children’s information.
5. If the school/district does not have a directory information policy, ask if they will be sharing student’s directory information with third parties outside of the school. If the answer is yes, explain that FERPA requires that parents must be given public notice as described above, then complete the model Directory Information Opt Out form and submit it to the school/district. Follow-up in writing to ensure that the request will be honored.

Disclaimer: This commentary does not constitute legal advice. Consult a private lawyer or call your local ACLU should you have specific questions.

Download the Directory Information Opt Out from here (.docx) or here (.pdf).