EFF Education Technology Report Raises Student Privacy Issues for Some Advocates

Thursday's report looked at industrywide trends and encouraged everyone to act, EFF researcher Gennie Gebhart, a co-author of the paper, said in an interview Friday. Google, Microsoft and others were listed, but no company came under the spotlight. The report says educational technology providers aren't using best practices for encryption, data retention and de-identification and aggregation -- trends that line up with reports from other organizations, she said. “Across the industry, best practices are not being implemented consistently. It’s spotty, at best."

Educational technology providers include large companies like Google, which offers its G Suite for Education and may have a totally different privacy conditions than a much smaller web-based service offered for free, Gebhart said. The report says 30 million students, teachers and administrators across the U.S. use Google's education suite. Google said in a statement it's committed to keeping student data secure and private: "We regularly gather feedback from schools, communities, non-profit organizations, and industry groups about how we can better equip them with information about privacy, security and online safety."

Contributing to inadequate privacy protection is that resource-strappe​d schools are eager to get free tech and don't have time or expertise to evaluate the apps, services and privacy policies, Gebhart said. The report says the industry is valued at more than $8 billion annually and moving so fast that regulations can't keep up. States like Colorado and Connecticut are trying to enact legislation that will provide more resources and templates to help schools do in-house evaluations. "It's really a capacity-building process," she said. Teachers and parents lack transparency about student information being collected, along with no notice or privacy policies, the co-author said. It's hard for parents to get their questions answered because schools may not know or lack processes to address concerns, she said. Parents lack choice because if they opt their kids out of a particular technology or tailor it in a different way, education experience is degraded, Gebhart said.

Future of Privacy Forum (FPF) Policy Counsel Amelia Vance said the outlook for classroom tech "isn't as bleak" as EFF's report suggests. Public school parents surveyed in a couple of polls during the past two years overwhelmingly viewed tech and digital learning resources as valuable tools. But she said many of EFF's recommendations are "quite reasonable and consistent." They're in line with an FPF survey that found parents want to be informed about why their children's data is shared and with whom, she said. "Transparency and communication need to improve between schools, companies, and parents. We agree that student privacy training for teachers and administrators needs to be a much higher priority for policymakers," Vance said. FPF's board members include representatives from Google and Microsoft.

Vance said 38 states have passed 91 new student privacy laws since 2013, with another 166 bills introduced this year. Alliances like the Student Data Privacy Consortium in 14 states are helping schools develop stronger privacy contracts with vendors and enhance transparency. She said some states should look to model laws like the Student Online Personal Information Protection Act and Georgia’s Student Data Privacy, Accessibility and Transparency Act (see 1601050064) to enhance federal Family Educational Rights and Privacy Act and Children's Online Privacy Protection Act's pre-existing protections.

Center for Digital Democracy Executive Director Jeff Chester, who said he quickly reviewed the paper and blogged about it, said it's well researched, showing how tech and education industries are "sacrificing" children's well-being and undermining privacy. "The report should provoke outrage from parents, policymakers and educators. It’s time to stop transforming the classroom into a haven for stealth digital spying," he emailed.

William Tucker, National Association of State Boards of Education's education data and technology project manager, said the privacy, security and confidentiality of student data have been a state legislative priority for years, with state boards of education and state and local educational agencies addressing "nuanced" challenges. Ed tech can improve student academic achievement, but it "can only be the result of a delicate balancing act between access to data and privacy," he said. "Truly transformative results are unlikely without the public transparency, and safeguards necessary to ensure data safety and security.”

Independent education researcher and privacy activist Sheila Kaplan said generally, parents shouldn't worry about vendors but rather schools, which sell the information to data brokers. The 1974 Family Educational Rights and Privacy Act allows schools to sell kids' date and place of birth, name, address, phone number and names of clubs they belong to, she said. "There's no prohibition against that. It's an exception from protection under federal law." She said that for the 11 years she's been working on a bill in New York to close that loophole. It has passed the state Senate twice but not the Assembly, she said.