Hatch bill regulates students' data in the cloud

Friday , August 01, 2014 - 5:56 PM

Standard-Examiner staff

Student privacy, and modernizing the law to keep up with the age of big data, is the focus of new federal legislation introduced by Utah Sen. Orrin Hatch.

Hatch and Sen. Edward J. Markey, D-Massachusetts, introduced the “Protecting Student Privacy Act” on Thursday.

With the increased use of cloud services, and changes to the Family Educational Rights and Privacy Act, more private companies have access to student data. According to a press release sent by Hatch’s press office, nearly all school districts use cloud services, but only a quarter of those districts inform parents about its use. Furthermore, 20 percent of districts don’t have policies in place regarding the use of online services.

“Students may well have more of their personal data stored by third parties than anyone, and the widespread storage of this information puts students at risk that this data could fall into the wrong hands,” Hatch said in the press release. “This legislation establishes security safeguards to ensure greater transparency and access to stored information for students and parents. Further, it includes a provision banning data mining for marketing or advertising purposes and other common sense protections for students’ personally identifiable student data.”

The act requires transparency about outside parities who have access to student data; minimizes the amount of information schools share that is personally identifiable; gives parents access personal information about their children that is held by private companies, and provides for corrections if in error; and says that private companies must delete personally identifiable information when it’s no longer needed for a specific purpose.

Zach Williams, director of communications for Ogden School District, said his understanding of the new act is that it enhances FERPA, taking it from the age of paper documents to modern technology.

“Technology advances so quickly that it’s hard to write legislation that keeps up with advances,” he said. “I think this act appears to be reiterating that even if it’s a third party that has information, they still need to follow FERPA guidelines, which is something that we take very seriously already.”

According to Williams, vendors allowed access to Ogden student information, for purposes such as generating reports or aggregating test scores, are required to sign documents stating that they will follow FERPA rules.

There is another piece of the new act that appeals to Williams on a personal level.

“The part I really like, as a parent, are the restrictions on advertising or marketing using student data,” he said. “That’s something that really is important.”

This discussion plays into a bigger question of how to keep data private anytime students log online, Williams said.

“The metadata captured from student computers when they’re just, say, at the library in high school or at the university and writing a report — you’re researching, and all that metadata is still being sent out, as far as ads,” he said.

Jeff Stephens, superintendent of Weber School District, declined to comment on the specifics of the proposed legislation. He did say that protecting student data is a top priority for his district.

“We’ve got our tech department constantly working to protect student data, because there are continual efforts to compromise that data,” he said.

Cheryl Phipps, region director for Davis County PTA, says she’s not aware of any recent conversations on this specific topic at the state level.

“I know there were some concerns about some information dealing with Utah core standards, making sure information being accessed was being taken care of, and who had access,” she said. Student privacy will always be an issue, she said, as technology changes.

“I do believe they do best to protect that, and there’s always room for increased care, but I think we would feel pretty good about what’s happening now,” said Phipps.

A copy of the Protecting Student Privacy Act of 2014 can be read on Markey’s website.

Contact reporter Becky Wright at 801-625-4274 or bwright@standard.net. Follow her on Twitter at @ReporterBWright.

Sign up for e-mail news updates.