Student Data Principles
The Student Data Principles are the values that guide the work of over 40 education organizations representing school officials and other stakeholders in every state.
Schools, school systems, and anyone who has access to students’ personal information must do everything in their power to ensure that student information is protected and used to support students. SEAs should use these principles to build upon, not just comply with federal, state, and local laws. Some signatories include AASA: The School Superintendents Association; the National PTA; the Council of Chief State School Officers; and the National School Boards Association.
Read the Student Data Principles
Learn more about the Student Data Principles
Communicating with Districts and the General Public
Parents want to know how their child’s data is being collected, used, and protected, but may not have more than 10 minutes to search out answers. There are many resources that school attorneys can look to for communication guidance.
Websites
Highlight model websites for your districts, and provide useful links to resources on the SEA website for both districts and parents. The first place many parents will go to find answers is their school or district’s website. It is vital to have accessible information on your website. This doesn’t have to be complex. A great example is the Chesterfield County Public Schools (see screenshot), which is extremely simple. It has links to:
- A list of what apps the district is using and the privacy policies for those apps (do your districts not know what apps your district is using? Advise them to take a survey, or use a product like LearnTrials or Catch On);
- The Privacy Policies & Guidelines for the district;
- Privacy FAQs; and
- A link to a Google form where parents can ask a quick question that gets automatically sent to the person in charge of privacy for that district.
There are many other great website examples!
- Chesterfield County Public Schools Privacy Page
- Fairfax County Privacy Page
- Ventura County e-Safety Committee Task Force
- Houston ISD Privacy Page
- Denver Public Schools Student Data Privacy Page
- Wisconsin SEA Privacy Page
Don’t be afraid to take content from other SEAs and LEAs and link to other great resources!
Other Communications
There are many other great ways to communicate. Some SEAs have open-to-the-public regional meetings, webinars, or an annual data conference for districts. Others put information about student privacy – like a monthly privacy tip – in their monthly newsletter. Check out our favorite communications resource, the Foundation for Excellence in Education Student Data Privacy Communications Toolkit, for ideas and resources you can copy and paste.
Communications Resources
- Transparency Best Practices (PTAC)
- Student Data Privacy Communications Toolkit (ExcelinEd)
- A Parents’ Guide to Student Data Privacy (National PTA, ConnectSafely, FPF)
- Data Quality Campaign
Have other communications suggestions or materials that other districts could use? Email them to us at info@studentprivacycompass.org.
State Laws
Do you know if your state has a student privacy law? Just since 2013, 41 states have passed 126 new student privacy laws. Most of those laws impose new requirements on districts, states, and school service providers.
Prior to student data privacy taking off as an issue in 2014, many states had preexisting privacy laws. Some states have privacy laws that are not specific to education but still affect educational data. For example, 10 state constitutions have recognized a right to privacy,[1] and many more have general privacy protections in place for their citizens. These laws affect students, teachers, schools, and districts. Many states have specific laws regarding the disposal of records that contain personal information.[2] Some states also require government entities to have a written privacy policy in place.[3] And some, such as California, require government agencies to have a specific person responsible for compliance with privacy law.[4]
States can give students additional privacy protections, and many have: at least 35 states have passed laws supplementing FERPA;[5] 45 make their data privacy policies publicly available; 48 state education agencies have established governance bodies charged with managing the collection and use of data, including how that data will be kept secure and confidential; and 45 have established policies that determine what type of data is available to select stakeholders, such as teachers and principals, who will use it to improve instruction.
The number of laws directly regulating student privacy has dramatically increased in the past three years. Since 2014, 49 states have introduced over 500 student privacy bills, with at least 100 bills introduced each year. Thirty-eight states have passed 91 laws since 2013. Generally, these laws either regulate educational agencies and institutions, such as schools, districts, and state education agencies, or regulate third parties.
Thirty-three states as of the end of 2016 have introduced either a version of California’s SOPIPA or a similar piece of legislation that regulates industry known as the SUPER (“student user privacy in education rights”) Act, and 12 states have passed those bills into law.
SOPIPA, SUPER, and other recent student privacy laws impose direct liability on ed tech operators. FERPA, which is enforced by the U.S. Department of Education is only directly enforceable against “educational institutions receiving federal funds” – which equates to most public schools. Even if a third party vendor practice causes the school to be in violation of FERPA, DOE may only hold the school liable. Any liability by the school service provider would simply be through its contract with the school. The entire purpose of states seeking to pass SOPIPA, SUPER, and other student privacy laws is to directly regulate private companies that are now so frequently working directly with students.
[1] “Constitutions in ten states—Alaska, Arizona, California, Florida, Hawaii, Illinois, Louisiana, Montana, South Carolina, and Washington—expressly recognize a right to privacy.” National Conference of State Legislatures, Privacy Protections in State Constitutions, December 11, 2013.
[2] “At least 30 states have enacted laws that require entities to destroy, dispose, or otherwise make personal information unreadable or undecipherable.” National Conference of State Legislatures, Data Disposal Laws, December 26, 2013.
[3] Cf. Alaska Stat. § 45.48.530; Ariz. Rev. Stat. Ann. § 41-4152; Colo. Rev. Stat. § 6-1.713; N.J. Stat. 56:8-162
[4] Cal. Civ. Code § 1798.22: “Each agency shall designate an agency employee to be responsible for ensuring that the agency complies with all of the provisions of this chapter.”
[5] Epic.org, Student Privacy
