Trump’s Education Department steps up to defend student privacy

Many parents have been disappointed by the lack of meaningful corrective action by the U.S. Department of Education (USED), at least in pre-K-12 education, under Betsy DeVos’s leadership. But give credit where due. USED deserves kudos for a guidance document issued recently by the department’s Privacy Technical Assistance Center (PTAC). Someone there is taking student-privacy threats seriously.

The new guidance advises state education agencies and school districts about their responsibility to protect student privacy when facilitating college-admissions tests such as SAT and ACT.

{mosads}Traditionally, students registered for these tests on their own, so federal privacy law that applies to schools — such as the Family Educational Rights and Privacy Act, or FERPA — didn’t apply. Now, however, many schools register all students for these tests, either as part of general college preparation or, as allowed by the Every Student Succeeds Act (ESSA), as a substitute for state achievement tests.

PTAC warns that schools’ new role in registering students for SAT and ACT triggers the compliance requirements of FERPA, the Individuals with Disabilities Act (IDEA), and the Protection of Pupil Rights Amendment (PPRA).

This is big news. Tests like the SAT and ACT are becoming as much data-churning machines — profiting from sales of student data — as they are college-admission tests. The new guidance taps the brakes on at least some of their activities.

FERPA (and IDEA) require parental consent before a school or other education agency discloses personally identifiable information, except in certain cases. Even under those exceptions, the federal laws require prior written consent before the third party re-discloses the data to another entity, such as a college or scholarship organization. So the testing organizations couldn’t sell personal data without prior written consent.

An especially welcome aspect of the guidance relates to the “voluntary” pre-test surveys that appear on both SAT and ACT. With SAT, for example, the College Board includes 35 questions that explore personal areas such as extracurricular activities, educational aspirations, parental income, and even religion.

As the guidance notes, “We have heard from teachers and students … that the voluntary nature of these pre-test surveys is not well understood.” The confusion results from the College Board’s pressuring students to participate: “While you don’t have to answer these questions, we strongly recommend that you do so.”

Many students are given the impression that if they decline to answer, they’ll miss out on opportunities such as scholarships. (For the arguably deceptive practices related to the College Board’s PSAT, which some states also require, see Cheri Kiesecker’s account.) And as the PTAC notes, the College Board makes it cumbersome to opt out: “Each of the questions requires a response, and the student must affirmatively indicate in response to multiple questions that the student does not wish to provide the information.”

Rachael Stickland and Leonie Haimson of the Parent Coalition for Student Privacy have argued that ACT is as bad or even worse: “ACT even sells an algorithm to colleges based upon a student’s personal data points to help them to decide whom to admit – without informing parents or students how this information may be used.”

So these testing organizations have been pressuring students to reveal personal information, which, as the guidance points out, is then sold to colleges, scholarship services, and other organizations. But when the registrant is the school rather than the student, the federal PPRA comes into play.

PPRA imposes requirements on schools that administer third-party surveys asking questions from any of eight protected areas — including religion and income. So under PPRA, the pre-test surveys couldn’t be administered unless parents are given the right to inspect the questions, and notification that they may opt their children out of the survey.

Applying PPRA, the guidance recommends that schools “be explicit with faculty, staff, parents, and students about the voluntary nature of the pre-test survey.” Further, if the testing companies will provide PII from education records (grades, test scores, etc.) to third parties for recruiting purposes, the schools must obtain prior written consent from parents rather than relying on implied but legally ineffective “consent” from minor children.

This new guidance builds on another recent development indicating that USED may finally be focusing on student privacy. Last November USED ruled that a Pennsylvania charter school couldn’t require parents to accept an online service provider’s terms of service that waive the student’s and parents’ rights under FERPA. Under this ruling, a school cannot make a student use a digital platform that doesn’t comply with FERPA — and many do not.

Parents should be encouraged that their well-founded concerns about student privacy are no longer being ignored. More remains to be done, but USED is taking steps in the right direction.

Jane Robbins is a senior fellow at American Principles Project (APP). Robbins co-authored the APP Foundation/Pioneer Institute report, “Controlling Education From the Top: Why Common Core Is Bad for America.”

Editor’s Note: This article has been updated from a previous version.