Study: Student Data Not Safe in the Cloud

The Citizen's Guide to the Future
Dec. 16 2013 12:03 PM

Study: Student Data Not Safe in the Cloud

A student reads a book in Chinese at a Los Angeles public school.

Photo by ROBYN BECK/AFP/Getty Images

It used to be that failing a math test in the fourth grade wouldn’t haunt you long after you graduated (even if it might get you grounded). No longer.  

American schools are migrating online, providing parents with real-time academic results. The cloud services that remotely host this information about educational achievement are also increasingly being used to store sensitive student details like names, religion, and health status. But according to a new study from the Center on Law and Information Policy at Fordham Law School, schools are failing to read the terms and conditions and providing troves of student data to third-party vendors without sufficient safeguards or adequate parental consent.


The report looked at Web service contracts in small, medium, and large school districts. Of the 54 school districts examined, almost 95 percent used cloud services, but many failed to inform parents of the full breadth of information being outsourced. Furthermore, very few of the schools’ contracts explicitly restricted the marketing of student information. This despite using third parties to store potentially delicate information, such as which students qualify for free lunch.

The school districts also seemed clueless as to the details of the contracts they’d signed. The Fordham researchers had considerable difficultly tracking down school personnel who were familiar with the district’s outsourcing policy, documentation was poorly maintained, and less than half of districts contacted complied with the open public record request in the time period required by law.

In response, the Software and Information Industry Association said in a statement that the report failed to account that the law had created strong business practices to keep students data safe: “School service providers know that if they do not protect student information entrusted to them, they will lose their customers and face legal repercussions.”

But according to the Fordham study, many of the agreements failed to meet a number of Federal privacy benchmarks. One-third of data analytics contracts did not comply with the Family Educational Rights and Privacy Act’s requirement that data be deleted after it is no longer needed for the purposes for which it was provided. Few agreements specified a level of encryption, and even fewer required the vendor to tell the schools if there was a data breach.

Khaliah Barnes of the Electronic Privacy Information Center told me that although FERPA provided a number of privacy protections for students online, subsequent regulations from the U.S. Department of Education in 2008 and 2011 had weakened the act.

Barnes added that Fordham’s findings confirmed what EPIC has been hearing from parents and students—they feel like they’re losing control. “We’ve seen an increase in student information collection and dissemination, but a decrease in privacy protection,” she said.

The report comes amid a parent-led backlash against the use of third-party vendors for storing student information. In November, the Chicago school system, the nation’s third largest, rejected the controversial student data management nonprofit, InBloom, deciding instead to build its own platform. According to Education Week, InBloom began promisingly, with million-dollar grants from the Carnegie Corporation of New York and the Bill and Melinda Gates Foundation. But after parents became concerned by plans to compile students' information into one huge database for school-related businesses, InBloom has been dropped by numerous states. In New York, a law suit has been launched to prevent the New York State Education Department from partnering with the service.

Karen Sprowal, one of the plaintiffs in the New York case, said in a statement: "Ever since I've heard about InBloom Inc. I've been unable to rest easy. … Any information that is let loose on the Internet can never be retrieved, and any breach or misuse of this data could harm [my child's] prospects for life, by impairing his ability to be admitted to college or get a good job."

Future Tense is a partnership of SlateNew America, and Arizona State University.



Scalia’s Liberal Streak

The conservative justice’s most brilliant—and surprisingly progressive—moments on the bench.

Colorado Is Ground Zero for the Fight Over Female Voters

There’s a Way to Keep Ex-Cons Out of Prison That Pays for Itself. Why Don’t More States Use It?

The NFL Explains How It Sees “the Role of the Female”

The Music Industry Is Ignoring Some of the Best Black Women Singing R&B


Theo’s Joint and Vanessa’s Whiskey

No sitcom did the “Very Special Episode” as well as The Cosby Show.


The Other Huxtable Effect

Thirty years ago, The Cosby Show gave us one of TV’s great feminists.

Cliff Huxtable Explains the World: Five Lessons From TV’s Greatest Dad

Why Television Needs a New Cosby Show Right Now

  News & Politics
Sept. 18 2014 8:20 PM A Clever Attempt at Explaining Away a Vote Against the Farm Bill
Sept. 18 2014 6:02 PM A Chinese Company Just Announced the Biggest IPO in U.S. History
The Slate Quiz
Sept. 18 2014 11:44 PM Play the Slate News Quiz With Jeopardy! superchampion Ken Jennings.
  Double X
Sept. 18 2014 8:07 PM Crying Rape False rape accusations exist, and they are a serious problem.
  Slate Plus
Behind the Scenes
Sept. 18 2014 1:23 PM “It’s Not Every Day That You Can Beat the World Champion” An exclusive interview with chess grandmaster Fabiano Caruana.
Brow Beat
Sept. 18 2014 4:33 PM The Top 5 Dadsplaining Moments From The Cosby Show
Future Tense
Sept. 18 2014 6:48 PM By 2100 the World's Population Could Be 11 Billion
  Health & Science
Sept. 18 2014 3:35 PM Do People Still Die of Rabies? And how do you know if an animal is rabid?
Sports Nut
Sept. 18 2014 11:42 AM Grandmaster Clash One of the most amazing feats in chess history just happened, and no one noticed.