When I was a child in school, educational technology (edtech) involved either catching cholera on the Oregon trail or answering geography questions to catch Carmen Sandiego, but technology changes quickly. Today, parents, students, and teachers have access to hundreds of edtech tools that help facilitate communication with parents, provide quicker and more personalized feedback to students, and assist teachers in discovering data-driven insights into what their students really need.
This last point has a dark side: personal data about children and teens are inherently sensitive, and there are privacy risks in collecting, using, and maintaining these records, including misuse by authorized individuals, oversurveillance, commercialization, and data breaches. The challenge is to balance this innovation against ensuring the responsible and safe use of student data. Though many edtech companies are taking this challenge seriously, it does not mean everyone is with the same rigor, and it can be hard for a school to tell the difference.
The fundamental privacy problem schools face is how to effectively vet new edtech tools to ensure they are safe. Several solutions to this problem have been proposed, but the best solution should address the following:
Scalability. There are over 100,000 schools in the United States, and if an edtech tool is safe for one of them, it should be safe for all of them. Without standards and coordination, there will be a lot of duplicate effort. The best solution will minimize not just the number of duplicate reviews, but also the total amount of effort a school must take to vet an edtech vendor while also reducing the costs for vendors to prove that they take privacy and safety seriously.
Accountability. If a vendor violates the terms of their public privacy policy, they can be held accountable by a handful of agencies, such as the Federal Trade Commission, but they are just one agency with limited resources and cannot get to everything. Furthermore, these policies are typically drafted without any input or negotiation from schools, and even good companies are likely to draft terms that limit their liability when a privacy problem occurs. The best solution is one that enables schools and companies to negotiate terms that balance the interests of both parties and provide more options to hold a company accountable than waiting for under resourced government agencies to act.
Evolution. Because threats evolve, edtech tools considered safe a decade ago may no longer meet modern standards. Furthermore, as demonstrated by the FTC finalizing the new rule for the Children’s Online Privacy Protection Act earlier this month, compliance requirements are going to change and expect more from technology providers. The best solution is one that will constantly evolve and improve to reflect current threats, compliance requirements, and the state of technology.
The Student Data Privacy Consortium (SDPC), part of the Access 4 Learning community (A4L), scores highly on all of these criteria. It was originally designed to solve the scalability and accountability problems with a standard set of contractual terms called a Data Privacy Agreement (DPA). The real power in this is how it scales: once an edtech company and school district agree to its terms, other schools may subscribe to it, getting the same favorable terms with less work, but we are still evolving. In the coming months, we will be releasing a new vendor registry, which will make the vetting and negotiation process even easier. We will also be working with partners to increase adoption of our Global Education Security Standard, GESS (for more on this, see this recent call to action from SDPC founder Steve Smith).
The more schools, districts, and vendors get involved with the standard, the lower the costs for everyone involved become. If you are in a school district not currently involved with SDPC, I invite you this Data Privacy Week to learn more about what we have to offer (and if your state is already involved with A4L, then you may immediately leverage benefits from it). Schedule a time to meet with us and see how we can help lower your costs while improving student privacy online.
For edtech vendors that are committed to privacy and have not been involved with SDPC, I also invite you to learn more about the value of membership. We are actively investing in our student privacy program offerings for you, including a soon to be released asynchronous training that you can use to train your staff on privacy requirements (as required in New York’s Ed Law 2-D). Moreover, we want you to have a seat at the table to help ensure that terms are fair as we continue iterating on the National Data Privacy Agreement.
For more information on joining the Community and contributing to our privacy work, please visit A4L or contact staff@a4l.org
David Sallay
Director of Data Privacy, A4L Community
#DataPrivacyWeek