Education Data and the Law

Welcome to #BeyondTheMean! Check out this post to see what this blog is all about.

When working with educational data, it is important that you are up-to-speed on the various legal requirements related to student’s privacy. Educational data is extremely sensitive information and its protection and proper use should be the first priority of any data analyst. In this post, I will provide an overview of some of the key student privacy laws. I am not a lawyer, this post should not be interpreted as legal advice.

Family Educational Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) is the primary law that governs the privacy of student educational records. Generally, an educational record is any part of the students record generated by their school, district, or state. The primary foundation of FERPA is that only the parent (which is defined as a natural parent, guardian, or an individual acting as a parent in the absence of a parent or a guardian) can access students private records.

There are a few exceptions to this rule as the records exist to support the functioning of the school itself. For example, school officials, such as teachers or administrators, have broad access to the records of students under their care but do not have access to student records for students in whom they do not have a “legitimate educational interest”. FERPA also allows a school to share student records with another school upon the enrollment of the student in their new school.

The “directory information” exception to FERPA often catches people by surprise. Schools may publish directory information, such as names, addresses, phone numbers, or enrollment status. Parents may opt out of being included in directory information releases.

As an educator, FERPA’s expectation is that you keep personally identifiable information about a student private. Student records should not be shared with those outside of the student’s scope of services. You must also take steps to protect from undue access to student data. For example, you should never leave student data sheets open on your computer while you are away and you should never email student information or store information in tools that may be accessible by those outside of your organization.

You can learn more details about FERPA here.

Protection of Pupil Rights Amendment (PPRA)

The Protection of Pupil Rights Amendment (PPRA) deals with the collection and use of certain kinds of information from students. In short, parents and students have the right to consent, be notified, opt out of, and inspect most surveys, certain physical exams, and other specialized data collections.

The PPRA lists eight protected survey areas under which parents/students must give consent before participating in:

1. Political affiliations or beliefs of the student or students’ parent;

2. Mental or psychological problems of the student or student’s family;

3. Sex behavior or attitudes;

4. Illegal, anti-social, self-incriminating, or demanding behavior;

5. Critical appraisals of others with whom respondents have close family relationships;

6. Legally recognize privilege or analogous relationships, such as with lawyers, doctors, or ministries;

7. Religious practices, affiliations, or beliefs of the student or student’s parent; and

8. Income, other than as required by law to determine program eligibility.

Additionally, parents and students have the right to receive notice and opt out of participation in survey administration, non-emergency invasive physical examinations or screenings, or other data collections that may be for the purpose of marketing or sales.

Finally, parents and students have the right to inspect information surveys and instructional materials (excluding tests) before they are administered.

When seeking to collect student data for research or continuous improvement purposes, it is very important that you consider these three clauses and always ensure that you have collected consent, given an opportunity to opt out, and allowed for prior inspection of instruments upon request.

You can learn more about the PPRA here.

Children’s Online Privacy Protection Rule (COPPA)

The Children’s Online Privacy Protection Rule (COPPA) is overseen by the Federal Trade Commission and outlines various protections for student data when interacting in an online space. COPPA is primarily focused on what companies can do with student data, but it comes into play in the school environment because schools are able to give consent for students to use online tools in lieu of parental consent.

COPPA allows schools to grant “parental consent” to students to use online tools as long as they are for a specific educational purpose. School technology should not be used to access sites that are not educational and companies are expected to obtain parental consent from the child’s parent if their tools are not educational.

Just as with FERPA and PPRA, parents must be given access to their child’s data from the vendor if requested.

You can learn more about the COPPA here.

State Laws

Every state has their own combination of laws, regulations, and procedures that govern data use. Before diving deeply into the world of educational data analysis, you should take time to make sure that you understand the responsibilities granted to you when you have access to educational data.

One rule that you will find in every state is the “suppression rule”. This is a rule that determines the threshold at which student information is suppressed, or left out of a data set, in order to protect the anonymity of the child. Suppression rules vary by state and it is important to understand what those rules are in your state – especially when preparing reports to your local board of education.

Additionally, states and localities also have varying rules related to the acquisition of student data. You can generally find these rules outlined in your Acceptable Use policies. You probably skimmed this and signed it when you got hired into your job. Its time to pull that document out and read it again in its entirety.

If you are unsure about the local data access rules in your district, contact your supervisor or your district data steward and ask. They will be glad you did – it is easy to prevent a mistake than to pay for one.

I hope this brief summary of the education data legal landscape has proven helpful. Take time to explore the pages linked in this post and get to know these three laws in detail. Good luck on your journey friends and let me know how I can help.