This post was previously published on the Future of Privacy Forum blog.
Ed Tech vendors that use student data to provide services in schools must navigate a complicated legal landscape, including intertwining state and federal laws, all of which are designed to protect student privacy. Newly-released technical assistance from the US Department of Education’s (USED) Privacy Technical Assistance Center (PTAC) explores student data use practices by state and local education agencies (SEAs and LEAs) that register students for college admissions examinations. School registration of students for these exams or the use of these exams as Title I assessments can raise questions about statutory compliance obligations.
A key finding in the PTAC guidance: optional surveys administered to students as part of the SAT and ACT exams can violate the Protection of Pupil Rights Amendment (PPRA), Family Education Rights and Privacy Act (FERPA), and Individuals with Disabilities Education Act (IDEA) if appropriate transparency, consent, and other privacy safeguards are not employed.
The guidance is not limited to administration of the SAT and ACT in particular; PTAC intends the guidance to inform LEA and SEA practices whenever schools register students for third-party examinations and surveys that collect protected information. Also, it is worth emphasizing that this technical assistance does not apply when students take the SAT or ACT independently.
Why is this happening now?
Originally, students signed up to take the ACT and/or SAT on their own to fulfill college admissions requirements for certain schools. In recent years, states have elected to make the ACT and/or SAT mandatory for high school students and have begun administering the test directly. This change occurred for two reasons. First, states and districts want to increase college access – by making the ACT/SAT free, it removes an economic barrier to entering college. Second, the ACT/SAT is now being used by some states as the high school english and math assessment required and authorized by Title I of the ESEA. In states where this shift occurred, information collected in conjunction with the administration of those tests becomes part of the student’s educational record, and therefore subject to legal obligations under FERPA.
The Issue
As part of an SAT or ACT test, students can fill out a pre–survey that asks questions about various topics, including religious affiliation and parental income. Students currently “opt in” to taking the survey and having the information they enter into the survey shared with education-related third parties. The primary purpose of these surveys is to help colleges, universities, scholarship services, and recruiters identify students who may be of interest to their programs. However, it is not always clear that these surveys are voluntary; PTAC wrote in the technical assistance:
We have heard from teachers and students…that the voluntary nature of these pre-test surveys is not well understood, and that each of the questions requires a response, and the student must affirmatively indicate in response to multiple questions that the student does not wish to provide the information.
PPRA
The Protection of Pupil Rights Amendment (PPRA), passed in 1978, “seeks to ensure that schools and contractors obtain written parental consent before minor students are required to participate in any ED-funded survey, analysis, or evaluation that reveals” certain sensitive information – including religion and parental income, two categories of information included in the SAT and ACT pre-surveys. Under PPRA,
LEAs must also adopt policies to protect student privacy in the event of the administration or distribution of any survey containing questions that ask students to reveal information from one of the eight PPRA-protected areas and also provide notification to parents, at least annually, at the beginning of the school year, of the specific or approximate dates during the school year when such a survey is scheduled or expected to be scheduled and an opportunity for parents to opt their students out of participation in any such survey.
The technical assistance finds that, under PPRA, parents – or students if they are over 18 – must be notified and given the opportunity to opt-out of participation in the SAT and ACT pre-surveys by LEAs.
FERPA and IDEA
FERPA requires data protections around student personally identifiable information in education records. FERPA limits what data can be disclosed, to whom, and determines when consent is required for disclosure. IDEA governs the rights of students with disabilities, requiring broader student data protections than FERPA. Under FERPA, re-disclosing information from student records can only occur with prior written parental consent or under a FERPA exception. Under IDEA Part B regulations, re-disclosures also cannot occur without written parental consent or an applicable exception.
Implications
The college admission exam technical assistance letter has a number of implications for stakeholders. Because the technical assistance and its implications are layered, more information and impressions will become apparent over the next few weeks. Here are some of our initial takeaways from the letter:
Contracts with Ed Tech Companies
Interestingly, the technical assistance says that “[c]ontracts between testing companies and SEA, LEAs, or schools for testing…should include provisions assuring that before [personally identifiable information] is disclosed nonconsensually, the testing companies (when acting on behalf of the SEA, LEA, or school) will comply with the privacy protections required by Federal law, specifically FERPA and IDEA.” It is unclear – but not unlikely – whether this requirement would apply to contracts between non-testing ed tech companies and SEAs, LEAs, or schools.
Specifically, the technical assistance “encourages SEAs and LEAs to consider the following when contracting with testing companies:
- Ensure that the contract with the testing companies specifies the FERPA exception under which PII from students’ education records is to be disclosed to the testing company;
- Include specific prohibitions in the contract governing unauthorized use of PII and redisclosure of PII from education records (including biographic or demographic information provided by the SEA or LEA and students’ test scores or test score ranges) without written consent of the parent or eligible student;
- Include specific requirements on how the testing companies should safeguard student PII; and
- Include any additional requirements that may be mandated by your State.”
This appears to be the first time that PTAC or USED has articulated these best practices.
PPRA: A Bigger Issue Moving Forward?
This is the most extensive technical assistance released on PPRA in almost forty years. It is possible that this indicates that USED has a heightened interest in providing guidance regarding PPRA, and that further guidance may be forthcoming. This is not only interesting because of the issues that PPRA’s survey restrictions raise, but also because PPRA has many little-known but significant restrictions and requirements:
- LEAs must develop and adopt policies, in consultation with parents, regarding both surveys on restricted topics and all of the below issues;
- These policies must include a policy on “[t]he collection, disclosure, or use of personal information collected from students for the purpose of marketing or for selling that information (or otherwise providing that information to others for that purpose), including arrangements to protect student privacy that are provided by the agency in the event of such collection, disclosure, or use.” However, this does not apply when the marketing or selling is “for the exclusive purpose of developing, evaluating, or providing educational products or services for, or to, students or educational institutions;”
- PPRA also requires policies regarding student physical examinations or screenings administered by schools; and
- Parents have the right to inspect any instructional material used as part of the educational curriculum for the student.
Parents must be annually notified about these policies, and also notified whenever there is a survey that includes questions on a restricted topic or when student personal information will be “collected from students for the purpose of marketing or for selling that information (or otherwise providing that information to others for that purpose).”
Many schools are unaware of the full scope of PPRA, and additional guidance and technical assistance around the law would likely be beneficial. In this technical assistance, PTAC recommends that LEAs:
- Establish policies compliant with PPRA protections that consult parents and eligible students (18 years or older) regarding the distribution and notification of pre-test surveys
- Establish a system that allows students and their families to review pre-test survey questions
- Explicitly communicate that all pre-test surveys are voluntary and optional to faculty, staff, students and their families;
- Give students and families notice that pre-test surveys contain PPRA-protected topics and they have the option to opt-out under PPRA protections; and
- Require prior written consent from parents or eligible students for the disclosure of PII from the student’s education record to a third party for college recruiting purposes.
Significant Guidance
The technical assistance – designated as “significant guidance” – issued by PTAC demonstrates that the stakes are high for companies offering college admission testing to students and the schools that rely on them. Although financial penalties are rare, USED has other enforcement options if a school acts in a way that is inconsistent with the law, such as imposing a five-year ban on data transfers from an offending ed tech provider to the LEA or SEA where they violated FERPA. Highlighting to LEAs, SEAs, college admission test vendors, and other ed tech companies what is and is not consistent with FERPA, IDEA, and PPRA can not only increase compliance with those laws, but ensure all stakeholders understand how to better protect student data.
