Study: Student Data Not Safe in the Cloud

The Citizen's Guide to the Future
Dec. 16 2013 12:03 PM

Study: Student Data Not Safe in the Cloud

162649453
A student reads a book in Chinese at a Los Angeles public school.

Photo by ROBYN BECK/AFP/Getty Images

It used to be that failing a math test in the fourth grade wouldn’t haunt you long after you graduated (even if it might get you grounded). No longer.  

American schools are migrating online, providing parents with real-time academic results. The cloud services that remotely host this information about educational achievement are also increasingly being used to store sensitive student details like names, religion, and health status. But according to a new study from the Center on Law and Information Policy at Fordham Law School, schools are failing to read the terms and conditions and providing troves of student data to third-party vendors without sufficient safeguards or adequate parental consent.

Advertisement

The report looked at Web service contracts in small, medium, and large school districts. Of the 54 school districts examined, almost 95 percent used cloud services, but many failed to inform parents of the full breadth of information being outsourced. Furthermore, very few of the schools’ contracts explicitly restricted the marketing of student information. This despite using third parties to store potentially delicate information, such as which students qualify for free lunch.

The school districts also seemed clueless as to the details of the contracts they’d signed. The Fordham researchers had considerable difficultly tracking down school personnel who were familiar with the district’s outsourcing policy, documentation was poorly maintained, and less than half of districts contacted complied with the open public record request in the time period required by law.

In response, the Software and Information Industry Association said in a statement that the report failed to account that the law had created strong business practices to keep students data safe: “School service providers know that if they do not protect student information entrusted to them, they will lose their customers and face legal repercussions.”

But according to the Fordham study, many of the agreements failed to meet a number of Federal privacy benchmarks. One-third of data analytics contracts did not comply with the Family Educational Rights and Privacy Act’s requirement that data be deleted after it is no longer needed for the purposes for which it was provided. Few agreements specified a level of encryption, and even fewer required the vendor to tell the schools if there was a data breach.

Khaliah Barnes of the Electronic Privacy Information Center told me that although FERPA provided a number of privacy protections for students online, subsequent regulations from the U.S. Department of Education in 2008 and 2011 had weakened the act.

Barnes added that Fordham’s findings confirmed what EPIC has been hearing from parents and students—they feel like they’re losing control. “We’ve seen an increase in student information collection and dissemination, but a decrease in privacy protection,” she said.

The report comes amid a parent-led backlash against the use of third-party vendors for storing student information. In November, the Chicago school system, the nation’s third largest, rejected the controversial student data management nonprofit, InBloom, deciding instead to build its own platform. According to Education Week, InBloom began promisingly, with million-dollar grants from the Carnegie Corporation of New York and the Bill and Melinda Gates Foundation. But after parents became concerned by plans to compile students' information into one huge database for school-related businesses, InBloom has been dropped by numerous states. In New York, a law suit has been launched to prevent the New York State Education Department from partnering with the service.

Karen Sprowal, one of the plaintiffs in the New York case, said in a statement: "Ever since I've heard about InBloom Inc. I've been unable to rest easy. … Any information that is let loose on the Internet can never be retrieved, and any breach or misuse of this data could harm [my child's] prospects for life, by impairing his ability to be admitted to college or get a good job."

Future Tense is a partnership of SlateNew America, and Arizona State University.

TODAY IN SLATE

Foreigners

More Than Scottish Pride

Scotland’s referendum isn’t about nationalism. It’s about a system that failed, and a new generation looking to take a chance on itself. 

What Charles Barkley Gets Wrong About Corporal Punishment and Black Culture

Why Greenland’s “Dark Snow” Should Worry You

Three Talented Actresses in Three Terrible New Shows

Why Do Some People See the Virgin Mary in Grilled Cheese?

The science that explains the human need to find meaning in coincidences.

Jurisprudence

Happy Constitution Day!

Too bad it’s almost certainly unconstitutional.

Is It Worth Paying Full Price for the iPhone 6 to Keep Your Unlimited Data Plan? We Crunch the Numbers.

What to Do if You Literally Get a Bug in Your Ear

  News & Politics
Weigel
Sept. 16 2014 7:03 PM Kansas Secretary of State Loses Battle to Protect Senator From Tough Race
  Business
Moneybox
Sept. 16 2014 2:35 PM Germany’s Nationwide Ban on Uber Lasted All of Two Weeks
  Life
The Vault
Sept. 16 2014 12:15 PM “Human Life Is Frightfully Cheap”: A 1900 Petition to Make Lynching a Federal Offense
  Double X
The XX Factor
Sept. 15 2014 3:31 PM My Year As an Abortion Doula
  Slate Plus
Slate Plus Video
Sept. 16 2014 2:06 PM A Farewell From Emily Bazelon The former senior editor talks about her very first Slate pitch and says goodbye to the magazine.
  Arts
Brow Beat
Sept. 16 2014 8:43 PM This 17-Minute Tribute to David Fincher Is the Perfect Preparation for Gone Girl
  Technology
Future Tense
Sept. 16 2014 6:40 PM This iPhone 6 Feature Will Change Weather Forecasting
  Health & Science
Science
Sept. 16 2014 1:39 PM The Case of the Missing Cerebellum How did a Chinese woman live 24 years missing part of her brain?
  Sports
Sports Nut
Sept. 15 2014 8:41 PM You’re Cut, Adrian Peterson Why fantasy football owners should release the Minnesota Vikings star.