When we talk about protecting student data, we typically think of apps or student portals holding student data and the challenges of protecting this data. But the reality behind these electronic archiving mediums is that there are many human beings involved in the creation and maintenance of such systems. There are also many individuals and organizations that interact with schools on a daily basis that effectively act on behalf of the school to perform these services such as bus companies or lunch room system administrators. These individuals or organizations are called “school officials”. Under FERPA, a school official can be a teacher, counselor, admissions officer or a contractor, consultant or any organization to which a school has outsourced their services.
Students are increasingly using tech in the classroom and this technology is provided and managed by a third party (Google for example) and thus fall under the “school official” designation. We could hold a debate regarding the many concerns of multiple individuals having access to highly sensitive data. However, outsourcing services is not unusual in other environments, whether it be business, finance, technology or even medicine. And these third party providers and any sub-providers, are bound by the policies of the company they are contracted to. Parents and students have valid concerns on the amount of metadata being collected and how this is used by the school vendors. Companies are not as transparent as they need to be for us to understand their products and how the data is handled. But we also need to build a bridge between third party contractors and parents. We probably didn’t expect that our kids would go to school and have their data captured in such a way, but since this is inevitable, schools should inform parents of who the providers are so that at a minimum parents are not left wondering how their children’s data is captured and secured.
The Future of Privacy Form wrote an article on this particular topic and explains thoroughly what a school official really means and the responsibilities they hold as such.
It is important to note that although many individuals or organizations will be designated “school officials” that does not mean that they have an inherent right to all education records pertaining to students. Schools designate what information each school official receives and should be responsible when making the decision of how much data a particular vendor can have access to. A school official is in a unique position in which they may have access to tremendous amounts of information about students but they should be held accountable and act responsibly towards this data. I would love to see more communication between parents and schools regarding their school’s “school official” in order for us to understand what tasks they are performing and what data is needed. For the most part, we don’t know what apps our kids are using in school and we should have access to that information. Some could argue that providing parents with a list of all the outsource resources they use is a burden on the school, but really, all that is needed is a list of “school officials” on a website so that we can understand who the school is working with. Transparency is key and it will help build the bridge between schools and parents on how and when their children’s data will be used in school and for what purpose.
