社区黑料

A principal names suspended students in a widely circulated newsletter, . A district uploads students鈥� names, grades, and special education status to a public website. An ed tech company鈥檚 bankruptcy puts student records at .

Though the federal law protecting student privacy 鈥� FERPA 鈥� is more than 40 years old, the education world continues to experience large breaches of confidentiality. And as technology increasingly expands ways to collect, store, and retrieve data, the risk of theft or inappropriate access also increases. That鈥檚 why the Center for Democracy & Technology, a Washington, D.C.-based nonprofit, recommends that the education world turn to a resource used by business and other government entities: chief privacy officers.

In education, privacy responsibilities are often distributed across multiple people who have little training, said Elizabeth Laird, a student privacy senior fellow at the center who wrote the report. This results in data being kept far longer than it should and lax rules on the collection of student information by third-party vendors such as education technology companies.

鈥淵our job of protecting data is never finished; policy and technology are constantly changing,鈥� Laird said. 鈥淭hat is why you need a chief privacy officer who is keeping pace with those things.鈥�

A chief privacy officer in the education sector would be responsible for setting privacy policies at the state, district, or school level. For example, the officer would determine who has access to what data, create rules for how long data is kept and when it is deleted, and make sure individual students cannot be identified from publicly reported information.

The officer would also train staffers responsible for collecting and reporting data and make sure security teams follow best practices. Chief privacy officers work closely with chief information security officers: The former implements the policy side 鈥� such as how long student records can be kept 鈥� and the latter is responsible for the technical side 鈥� destroying them.

To make this role a priority, the report recommends legislation creating a chief privacy officer at the state or district level. Providing funding for privacy efforts is also critical for upgrading or replacing data-storage systems, the report said.

Some states, including New York, West Virginia, Utah, and Georgia, have already begun. New York, for example, created the role of chief privacy officer at the state level in 2014 after ending a partnership with a company that promised to store student data in a cloud-based service. The officer, Temitope Akinyemi, was appointed in 2016 and is for protecting student, teacher, and principal data and setting up protocols to deal with data breaches.

The Family Educational Rights and Privacy Act was created in 1974 to protect students, but 听 that its protections have been weakened and provide loopholes that allow third-party vendors to collect and store student data. Last year, the FBI released a memo warning that data collected by education technology companies pose risks to students and can be exploited and used to threaten schools and sell identity information.

鈥淢alicious use of this sensitive data could result in social engineering, bullying, tracking, identity theft or other means for targeting children,鈥�

Not every education institution has the capacity for a chief privacy officer, the center鈥檚 report said. For those that can鈥檛 afford such a position, it recommends sharing an officer with other schools, creating a team specifically responsible for this work, or delegating part-time duties to a current staff member.

鈥淎nytime you鈥檙e talking about students鈥� personally identifiable information, you should also be thinking about how you鈥檙e protecting it,鈥� Laird said.

Did you use this article in your work?

We鈥檇 love to hear how 社区黑料鈥檚 reporting is helping educators, researchers, and policymakers.