Are student privacy laws hurting students?

In simpler times, school administrators in Louisiana didn’t worry about posting the Student of the Month’s name on a billboard outside, or showing football players’ names, numbers, height and weight on a screen during games.

That was before student privacy concerns swept the state.

Districts have been scrambling to comply with a strict new law that went into effect this school year that prohibits schools from collecting, without parental consent, more than two pieces of personally identifiable information “that separately or when linked together can be used to reasonably ascertain the identity of the person.”

“How are you going to have a yearbook?” asked Wes Watts, superintendent of West Baton Rouge parish schools. “It’s ridiculous. Everybody is kind of on edge.”

The effects of the Louisiana bill, signed into law by Gov. Bobby Jindal last summer, offers a window into a national hot-button issue that has attracted interest from politicians on both sides of the aisle. Since Jan. 1, about 38 states have introduced 129 bills that deal with student privacy, an increase in the number of bills introduced in all of 2014, according to the Data Quality Campaign.

The exploding concerns that private companies could access sensitive student information, and the dizzying number of different bills introduced in state legislatures, has even prompted the federal Department of Education to issue guidance on the matter.

Officials last week released recommendations on how to secure student data and a video that explains which online educational services and companies best protect information from improper disclosure.

Kathleen Styles, the Department of Education’s first chief privacy officer, issued guidance Thursday on how to protect student data.

“Reading and understanding terms of service agreements is tough, even for lawyers. We hope this guidance will help school officials identify privacy-friendly apps and online services and avoid providers that might abuse student information,” Kathleen Styles, the Department of Education’s chief privacy officer, said in a press release.

“This guidance will help schools and districts evaluate potential agreements and offer direction regarding terminology frequently used in these agreements,” she continued. “By understanding commonly used provisions in these agreements, schools and districts will be better able to decide whether to consent to the terms for online educational services and applications.”

A student privacy test case

Louisiana passed two separate privacy bills: one sponsored by Republican Rep. Barry Ivey that mandates school districts to post on their websites contracts with vendors that require student data, and another crafted by Republican Rep. John Schroder that strengthens language around privacy and gives parents more control over who sees their kids’ data.

Schroder said his bill was driven by parents after concerns arose that new, standardized Common Core tests could lead to breaches of their kids’ information in the hands of third-party educational vendors. Parents were also worried about Louisiana’s participation in inBloom, a student information warehouse that has since shuttered.

The bill requires parents to sign annual permission forms to allow their children’s data to be collected to take school photos, given to companies like Scholastic to track reading progress and sent to a state financial aid program that awards scholarships for college.

“If a parent doesn’t send that letter back, or doesn’t give us permission, then their child could lose out on opportunities for financial aid,” Watts said. “Just the thought of that makes me cringe.”

The Schroder bill also requires that the state Department of Education create an anonymous identifier system by May 1 that does not use students’ Social Security numbers, and the new codes must be assigned by June 1. The state will no longer be able to access students’ names, date and place of birth, Social Security number, mother’s maiden name, and other information to use for assessment and accountability purposes.

Louisiana state Rep. John Schroder spearheaded a bill that mandates the creation of a student identifier system and requires parental consent forms to share student data.

If someone violates the law, which Schroder says is the strictest in the country, the offender faces up to a $10,000 fine or three years in prison, or both.

Several school leaders said in interviews with FedScoop that they have devoted countless hours tracking down hundreds of vendors to sign privacy addendums; posting the vendor contracts on their websites; and reaching out to parents to sign and return consent forms.

“I’ve already had teachers make home visits to get signatures,” said Lacey Bueche, supervisor of technology for Pointe Coupee parish schools. “The biggest problem school administrators have had is not parents saying ‘no,’ it’s parent’s not returning the form. That’s an automatic denial.”

District leaders said the amount of time spent on revamping their privacy procedures has come at the expense of students’ educations.

“How about our core business of teaching and learning?” Tresa Webre, assistant superintendent of the 10,000-student St. Charles parish, said when asked where she would rather focus her time.

“It’s taking away from things we really could be doing,” added Watts. “I think it’s hurting kids in the long run.”

Working out the “kinks”

Schroder defended his bill as a “model piece of legislation” – but admitted he’s meeting with stakeholders Monday to “work out any kinks.”

“There are some areas that are causing some concern because of interpretations of the law,” he said last week in an interview with FedScoop. “We have to somehow clarify and give school districts certainty on what they can do with data. If the law is so restrictive that you can’t hang a piece of art on the wall in the hallway with a student’s name on it, or you can’t put a newsletter out with any students’ names, that’s ridiculous. That’s not the intent of the law.”

Paige Kowalski, vice president of policy and advocacy for the Data Quality Campaign, a nonprofit advocacy organization, said lawmakers should listen to local stakeholders to craft bills that will work for their states.

“I don’t think these are easy bills to write,” she said. “It’s a new frontier. There’s going to be some trial and error. If you’re working on language that doesn’t work with your stakeholders, it may backfire.”

Webre said she would welcome changes to make the law less restrictive.

“We are hoping for addendums to the law so it will be more realistic,” she said. “We all agree that we probably need to be more cautious about the information we share with others, and we’re all about protecting data, but the devil is in the details.”

While school districts have been struggling to adjust to the changes, vendors that provide educational services said the new law has presented a headache when it comes to renegotiating contracts.

Lifetouch, a professional photography company, serves about 600 schools in Louisiana – gathering students’ names, graduation years and other information.

Laurie Dechery, associate general counsel for the company, said schools can’t provide a “one-size-fits-all” contract to vendors anymore because they have to include more specific language tailored to the company about data retention policies and security breach protocols.

“We’re going to be seeing more case-by-case contracts in Louisiana,” Dechery told FedScoop. “Some contracts are not made for school photography, but they’re presented as take-it-or-leave-it.”

Still, she added, “I have not heard that it’s preventing us from doing school photography” in Louisiana schools.

Creating a student identifier system

School district leaders say they’re worried about enacting the next piece of the legislation – the student identifier system – and that they are waiting for guidance from the state Department of Education.

State officials said they have selected a vendor to create the new system, and are hoping to finalize details in the next couple of weeks before releasing the name.

They are also focusing on revamping their processes to comply with the law; instead of simply handing over student data to the Office of Student Financial Assistance, they need to make sure students provide signed consent forms to be eligible for scholarships.

“Protecting student privacy and creating a unique student identifier system is a priority for the Department,” a spokesman wrote in an email.

In the meantime, Louisiana’s nearly 100 school districts are left navigating uncharted territory. Watts boiled the policy down to a puzzle he has been trying to solve.

“We have to identify our students without identifying them,” he said.