FAQs: The Protection of Pupil Rights Amendment

This blog is the third in a series about how schools can practically apply student privacy laws. Read the first two blogs about FERPA here and here. 

The Protection of Pupil Rights Amendment (PPRA) has been around since the late 1970s and protects students from having to reveal personal information in certain surveys. It is possible you are already familiar with PPRA’s eight protected categories of information and already have the required policies in place to help ensure that the law is followed. However, with recent concerns about students’ overall social and emotional health and school safety, schools are looking more and more to surveys to better understand their students’ attitudes and their needs. PPRA may affect whether schools can give those surveys without parental consent. In addition, schools that administer college admissions exams like the ACT or SAT may also trigger PPRA (which was the subject of May 2018 technical assistance from the US Department of Education). Because of this, it is important for schools to review their obligations under PPRA to ensure that they are compliant.

The following questions address key topics related to PPRA that school administrators may find useful. Before looking over these questions, we recommend that you find your district’s current policy that relates to surveys and PPRA so that you can determine what you already have and what needs improvement. If you do not already have a policy, the US Department of Education provides a model document that can be adapted to provide notice and seek consent as needed in all of these situations.

• When must schools get parental consent?
• When must LEAs provide notice?
• How does PPRA translate to surveys schools actually give?
• What do you mean by college admissions surveys?
• What if the survey is anonymous?
• What policies are LEAs required to have related to these surveys?
• How do LEAs provide notice? How do parents provide consent?
• What are parents allowed to inspect?
• What about state requirements?
• Resources
• State PPRA-like Requirements

When must schools get parental consent?

Schools must get parental consent when 1) a required survey, analysis, or examination is 2) funded in whole or in part by the US Department of Education and 3) is being conducted to find out any of the following:

• Political affiliations of the student or the parent
• Mental or psychological problems of the student or the student’s family
• Sex behaviors or attitudes
• Illegal, anti-social, self-incriminating, or demeaning behavior
• Critical appraisals of other individuals with whom respondents have close family relationships
• Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers
• Religious practices, affiliations, or beliefs of the student or the student’s parent
• Income (except as required to determine eligibility for participating in a program where they’d receive financial assistance)

If student participation isn’t required, then notice and opportunity to opt-out would be sufficient. Parental consent is not required for surveys that don’t cover the above categories, but parents generally may opt-out, as shown in the below chart.

When must LEAs provide notice?

In addition to notifying parents of any survey that covers any of the eight protected topics (regardless of funding source), the law also requires that parents be notified of other types of surveys and examinations, regardless of if they ask questions about the eight categories:

• When information that could be used to identify a student is being collected, shared, or used for marketing purposes (also called marketing surveys)
• The school is conducting a non-emergency, invasive physical examination (where private parts must be exposed or that involve incision, insertion, or injection) that is required as a condition of attendance. This does not include hearing, vision, or scoliosis screenings or other health screenings that may be required by state law.

How does PPRA translate to surveys schools actually give?

There are several types of surveys that schools commonly use that may touch on one or more of the eight protected topics. These include but are not limited to

• College admissions surveys (such as those given before the ACT or SAT),
• Career interest surveys
• Social-emotional learning (SEL) surveys
• School climate surveys
• Mental health screenings
• Threat assessment screenings
• Community health screenings

Before giving any of these surveys or examinations, the school should review the questions to see if any of the eight protected categories are included. For example, if you are planning to use an SEL survey, walk through the questions one by one and see if any fall into one of the categories. There is a good chance that most of them are not covered by PPRA, but note any questions that look like they might touch on one of the eight topics. Then do the following:

• Purpose specification: Ask yourself, what is this question trying to accomplish? If a state or federal law is requiring the survey, the text of the law can often provide some indication of the purpose. Once you understand the purpose, ask yourself if there is a way to rework the question to accomplish that same goal without requiring the student to give as much personal information. For example, there is a big difference between asking in a school climate survey if the student feels like there are adults they can talk to if they were victims of sexual assault and asking if they have been a victim of sexual assault. One is clearly tied to understanding the school climate, whereas the other is causing the student to reveal personal information.
• Data minimization: If there are only one or two questions in the survey that cover the eight protected categories and they do not seem relevant to accomplish the purpose of the survey, you may also decide to omit the questions.
• Consent: If you think the question should stay as-is, you will need to prepare consent forms for parents.

In addition, assuming parents have consented and you have collected the sensitive information from students, consider specifying in policy who will have access to the data in an identifiable format, who will have access to it in aggregate, and the permitted uses for the data (i.e., use limitation). Also consider how long the data will be retained and how it will be destroyed.

What do you mean by college admissions surveys?

Pre-test surveys on the SAT and ACT are an example of where PPRA could be triggered. If your school is using the SAT or ACT as a Title I assessment, or are pre-populating any information on the pre-test survey (like a student grade or ID number), schools must obtain parental consent before students take these surveys. These surveys often directly ask students about PPRA-protected topics like their parents’ income, religion, or citizenship in order to provide that information to higher education institutions, scholarship organizations, and education non-profits. Even if the surveys do not ask about PPRA-protected topics, your school may still need to get parental consent for students to take these surveys under FERPA depending on whom the data are being shared with. Learn more about the requirements of PPRA and FERPA with college admissions surveys in this 2018 guidance from the US Department of Education.

What if the survey is anonymous?

Unless there is absolutely no way for the school or third party to discover which answers on a survey came from which student – and, with the exception of most multiple-choice surveys, this is unlikely – PPRA’s notification and review requirements will also apply to “anonymous” surveys given to students.

What policies are LEAs required to have related to these surveys?

PPRA requires LEAs to work with parents to develop policies related to providing notice of these surveys, allowing parents to inspect and review materials related to the surveys and getting consent when needed. Since PPRA was passed back in the 1970s, there is a good chance this policies are already on the books, so check to see if you already have them. If you do, decide if they need to be updated. If you do not have any policies or if changes are needed to your existing policies, work with parents to develop new ones. Regardless, make sure that staff know about the policy.

How do LEAs provide notice? How do parents provide consent?

PPRA states that parents need to be notified at least annually of PPRA policies in the district along with the approximate dates of when the school has scheduled these surveys or sensitive activities to occur. Whereas the privacy notices required by FERPA can be indirect (e.g., posted on a website or in a student-parent handbook), PPRA notice must be direct (delivered by email, postal mail, or by hand).

Generally, parents will need to have a reasonable amount of time to consider their options and opt out after receiving the notice. If a survey is required as part of a US Department of Education sponsored program, then it will be an opt-in situation, and prior written consent from parents will be required before the student can take the test. If a survey is optional as part of a US Department of Education sponsored program, then notification is all that is required, and the survey would be opt out. The following table shows what the LEA’s obligation is depending on if the survey is part of a US Department of Education sponsored program and if it will require a parental opt in or allow an opt out.

What are parents allowed to inspect?

PPRA originally started as a single line in the 1974 reauthorization of the Elementary and Secondary Education Act (ESEA) about experimental education practices and allowing parents the ability to inspect the materials in advance. This legacy remained in the law when the eight sensitive categories were added in 1978: in addition to providing notice and choice regarding surveys, PPRA requires that LEAs must allow parents to inspect any instructional materials—including teacher’s manuals, films, tapes, or supplemental materials—that will be used in connection with a survey or evaluation from a US Department of Education sponsored program. The definition for the instructional materials parents must be allowed to inspect explicitly excludes student assessments or tests. For all other surveys and evaluations, the LEA should develop a policy that explains the procedure a parent can follow to inspect the instructional materials being presented to the student in conjunction with the survey.

What about state requirements?

Many states have passed laws that add to PPRA’s initial requirements of providing notice and collecting consent when a survey covers any of the eight sensitive categories. These state laws generally add onto PPRA by either requiring parental consent for any survey or examination that cover sensitive information (even if it is not required by a federal program) or by adding sensitive items to the list. For example, several states restrict asking about family gun ownership. We list the additional requirements that we found in each state at the end of this blog.

Conclusion

A new emphasis on school safety and use of college admission surveys has created a greater need for schools to understand PPRA before collecting data on students. As schools apply PPRA by providing notice and allowing parents the ability to inspect instructional materials and consent to certain data collections, schools will be able to balance the goals of keeping students safe and preparing them for college with the goal of respecting their privacy.

David Sallay is the Student Data Privacy Auditor for the Utah State Board of Education and a contractor with FPF. Amelia Vance is the Director of Youth & Education Privacy at FPF. 

Resources

• Model General Notice of Rights from the US Department of Education (which provides an overview of a parent’s right to consent, receive notice, and inspect materials)
• PPRA Model Notice and Consent/Opt-Out for Specific Activities (which provides more detail for notifying parents of specific surveying activities)
• Technical Assistance on Student Privacy for State and Local Educational Agencies When Administering College Admissions Examinations
• FPF Article: Dept of Ed: Parents, Not Minor Students, Must Consent to College Admissions Pre-Test Surveys and Data Sharing

State PPRA-like Requirements

The list below is adapted from this larger list of state privacy laws and is designed as a quick reference to help you determine if you have additional requirements in your state; nevertheless, we recommend that you consult with your legal counsel to determine if you have additional requirements under your state law.

Arizona: Additional requirements are found in 15-117. Written consent is required before administering any survey that is retained for longer than one year by the LEA or SEA and that covers one of the sensitive topics. In addition to the eight topics in PPRA, the following are added to the list:

• gun or ammunition ownership
• medical history or medical information
• pupil biometric information
• the quality of home interpersonal relationship
• self-sufficiency as it pertains to emergency, disaster, and essential services interruption planning
• voting history

The following are exempt from the additional requirements: mental health screenings, class instruction, college entrance exams, surveys collected anonymously, surveys conducted by the Arizona criminal justice commission, or surveys given to students whom school officials have reason to believe have been victims of abuse.

Florida: Chapter 1002, Section 222 specifies that schools may not collect, obtain, or retain information on the political affiliation, voting history, religious affiliation, or biometric information of a student or a student’s parent or sibling. Aside from using palm scanners for school breakfast or lunch, no exceptions are listed.

Idaho: 33-133 prohibits certain data elements from being included in a student’s education record, namely

• juvenile delinquency and criminal records in most cases,
• medical and health records,
• social security numbers,
• biometric information,
• gun ownership records,
• sexual orientation,
• religious affiliation,
• data collected via affective computing (except for special needs and exceptional students)

Kansas: 72-6316 covers prohibited information. No test, questionnaire, or survey may be administered to a K–12 student without parental consent if it covers sex, family life, morality or religion. An exception is made for school counselors.

Louisiana: 17-3914 prohibits requiring collection of any of the information in PPRA plus the following unless voluntarily given by the parent/guardian:

• biometric information
• social security number
• gun ownership
• home IP address
• external digital identity

Missouri: Law 161-096 prohibits schools collecting or reporting juvenile court delinquency records, criminal records, student biometric information, student political affiliation, or student religion.

New Hampshire: 186-11 requires schools to have policies related to nonacademic surveys and questionnaires. With the exception of youth behavior risk surveys, all nonacademic surveys require written parental consent. Parents may opt out of youth behavior risk surveys. On a related note, 189:68 prohibits certain information from being included in the state SLDS, several items of which overlap with the list of sensitive items from PPRA.

North Carolina: 115C 402.5. prohibits biometric information, political affiliation, and student religion from being included in the state data system. Furthermore, 115C 402.15. specifies that schools must provide parents notice of surveys covered by PPRA.

South Dakota: 13-3-51.2 specifies that a student shall not be required to take a survey that covers any of PPRA’s sensitive items without prior consent. The statute adds personal or family gun ownership is added to the list.

Tennessee: 49-2-211 states that the items in PPRA may only be collected with prior consent if the survey is not directly related to academic instruction. If also states that surveys that collect the information or that attempt to affect the student’s beliefs or opinions on the topic are included.

Utah: 53E-9-203 requires LEAs to have a policy requiring parental consent for all surveys or evaluations, regardless of funding source, that have the evident intended effect of having a student reveal any of the sensitive information in PPRA. Parents must be given at least 2-weeks notice to inspect the materials. Exceptions to notice and consent are made in the case of emergencies.

Virginia: 22.1-79.3 provides more detail about providing notice to parents and also prohibits asking questions about sexual information to students in grades kindergarten through sixth grade.

West Virginia: 18-2-5h classifies some information as confidential and generally prohibits its collection:

• Social Security number, or other identification number issued by a state or federal agency, except for the state-assigned student identifier
• religious affiliation,
• whether the person or a member of their household owns or possesses a firearm,
• whether the person or their family are or were recipients of financial assistance from a state or federal agency,
• medical, psychological or behavioral diagnoses,
• criminal history, criminal history of parents, siblings or any members of the person’s household,
• vehicle registration number,
• driver’s license number,
• biometric information,
• handwriting sample,
• credit card numbers,
• consumer credit history,
• credit score, or
• genetic information

(CC BY-SA 4.0)