Is My Student's Data Safe?

Changes to FERPA and its Implementation



          In the past several years there have been multiple changes to the Family Education Rights and Privacy Act (FERPA).  A really good explanations of the various changes can be found here.  To list all of the changes that have been made would take much more time than I care to devote to this topic.  My focus will be on the changes I have heard most about as I have studied the arguments for and against Common Core.  Before I get into the details, I would like to give a brief summary of what FERPA is and why it is important.
          FERPA is the policy that dictates what data educational agencies may share with whom.  It also gives students (or parents of minor students) the right to review educational records and request amendments to those records.  In general, FERPA states that educational entities may not share educational records without prior written consent from the student or parent of a minor student.  It includes a list of scenarios in which said records may be disclosed without prior written consent.  These exceptions include things like sharing pertinent data among appropriate teachers and administrators, participating in studies, and sharing with third party educational service providers.  It also allows schools to share information with state and federal education officials. 
          The concerns I have heard recently deal with three similar issues: data sharing with third party providers, data sharing with state and federal education officials, and participation in studies.  Parents are concerned that their students' private data will be used for marketing purposes, liberal policy makers' research, and perhaps even more nefarious reasons.  These parents are rightfully concerned with safeguarding their children's privacy.
          In order to determine whether or not our children's privacy is threatened by recent changes to FERPA, I have looked at the regulations in the law itself, the data sharing policies of the Mesa Unified School District, and the data collection and sharing incentivized by Race to the Top.  The remainder of this post will cover the facts I have found and my opinion on whether or not FERPA has been too greatly diminished to protect our children.

The Facts:

• FERPA allows educational records to be released to a third party without prior written consent only if they have a "legitimate educational interest," are contracted by the school to perform some educational service(s), and have contracted not to share the data with any other entities or use the data for anything other than the service(s) they were contracted to perform.  If a private entity is found to have violated this regulation, they will be barred from receiving any student data for a minimum of five years.
• The Department of Education clarifies a "legitimate educational interest" as such: "A school official generally has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility."
• FERPA allows educational records to be shared with those conducting research "if such studies are conducted in such a manner as will not permit the personal identification of students and their parents by persons other than representatives of such organizations and such information will be destroyed when no longer needed for the purpose for which it is conducted."
• While FERPA allows disclosure of student data under the above exceptions, the only place FERPA requires release of educational records is to the student or parent of a minor student to whom the records refer.
• Mesa Public Schools (MPS) submits student identifying information (name, birthdate, etc), attendance information (required to determine state funding), student characteristics (ethnicity, special needs, etc.) to the state Department of Education on a regular basis.  The state also has access to AIMS (state test) data as they are the ones who grade and record that information.
• MPS submits aggregate data to the Federal Department of Education about once a year.  This data includes things like the percent students who graduate from high school in four years.  Breakdowns are often requested along ethnicities, incomes, or special needs.  If students are broken into these types of groups, any group smaller than a certain number is not reported in order to maintain anonymity.
• MPS participates in many studies on teacher effectiveness, curriculum effectiveness, software effectiveness, etc.  When data is released for studies, it is always anonymized.  (The spell checker doesn't think 'anonymized' is a word, but I'm sticking with it.)  This is done by removing things like names, student ids, etc. and replacing them with study ids.
• MPS seldom releases student data to third party contractors.  A few noted exceptions are our data warehouse provider (they store our data on their servers), contracted speech or occupational therapists, etc.  In every case, these individuals and companies are required to sign agreements placing them under the same FERPA restrictions which govern our schools.
• MPS restricts access to records to only those personnel with a legitimate educational need for the data.  So a principal can see the data for the entire school, but a teacher can only view the records of students in his/her class.  Specific data is available only to those that need that data.
• Some data, like Free and Reduced Lunch Status, is not even shared with the school.  Only Food and Nutrition has access to that data.
• The National Student Clearinghouse keeps track of post-secondary (college) students.  We receive information from them on where our former students are enrolled, whether or not they complete post-secondary degrees or certificates, etc.
• Student and parents of minor students can opt out of participation in research studies, the National Student Clearinghouse, directories, college and military disclosure, and other third party vendors (such as those who sell yearbooks, caps and gowns, senior pictures, etc.)

My Opinion:

          One of the things that struck me most as I studied FERPA is that it never tells school officials that they must share data, only that they may.  This, to me, is an important distinction.  It says to me that the regulation is being weakened so that states and local boards can make their own decisions on when data should be shared and with whom.  It allows data to move more freely to those with a "legitimate educational interest" if the states and communities wish to allow said data sharing.  It strikes me as ironic that the same individuals who argue ardently against federal incentives to adopt Common Core also argue for stronger federal regulations on data sharing.  If local school boards and state educational leaders should be making the decisions on which standards are best for our children, why shouldn't they also make decisions about when it is appropriate to share student data?  Isn't it easier and more constitutional to strengthen this decision at the local or state level than to do so at the federal?  Also, FERPA is tied only to those educational institutions receiving some type of federal funding.  If all federal funding for education were to disappear, FERPA regulations would go the way of the dinosaurs.  As such, I find no issue with weakening a federal regulation that is causing extra paperwork and problems for our schools.  That is not to say that I favor haphazard, unregulated sharing of our students' private details - only that I favor regulations made in the communities which they serve.
           As far as my own school district is concerned, I feel like we do an exemplary job of protecting student privacy.  I was impressed with the safeguards that had been put in place and the policies that are followed to ensure that those with access to student data treat that information appropriately.  I do not know that all districts do the same.  I would encourage all those with concerns about data sharing to contact personnel in their own district to learn how their students' data is safeguarded, when it is shared, and with whom. 
          I have two outstanding data-related questions that I hope to have answered this week.  The first deals with disciplinary data.  I know expulsion and suspension information is shared with schools in which a student subsequently enrolled.  I could not find out for sure whether or not that data is included in what goes to the state.  I have someone checking on that for me.  Also, under Race to the Top, state longitudinal databases are supposed to be "interoperable" with post-secondary institutions' systems.  I am not sure exactly how that has been interpreted in Arizona or elsewhere.  Does that mean that transcripts can be sent electronically when a student applies or is admitted to a college program?  Or does it mean colleges would have much wider access to student data?  I am planning to attend a meeting tonight with Superintendent Huppenthal where I hope to get these questions answered.
          Thus far, the information I have found on data sharing is not likely to keep me up at night (especially after dealing with an 11-month-old with an ear infection for a week and a half).  It seems that the data being shared is being done so responsibly and with our students' best interests in mind.  Data is shared only when it will help that student or can be used in research to help future students.  It is not shared with individuals who can then market their goods to students or their parents (aside from things like designated suppliers of caps and gowns, yearbooks, etc.), and it is never released unless local district personnel deem it appropriate and can back up their decision in writing.  If individuals know of specific instances where data has been shared inappropriately and recent changes to FERPA have been given as the excuse for such disclosure, they should contact their local school board members or state representatives to look at ways to regulate such disclosures at the local or state level rather than deferring to the federal law.