Thousands of K-12 schools nationwide are putting students’ personal data at risk by failing to adequately disclose to parents and students their right to opt out of legally permitted information sharing, concludes a report released today by the World Privacy Forum.
The organization, a nonprofit that researches privacy issues and provides consumer education on related issues, surveyed more than 5,000 K-12 schools as well as 102 postsecondary institutions. The primary focus of the study is the Family Educational Rights and Privacy Act (FERPA), which gives students a right to access and amend their educational records, and to restrict disclosure of “directory information.”
What is directory information, exactly? The report says schools have adopted broad definitions, including everything from full names, height and weight, and dates and places of birth, to contact information like social media handles, phone numbers, and home addresses, and even photographs of students.
The report says the “directory information” portion of the 1974 law didn’t account for the widespread availability of information that can now be disseminated via the Internet. Now, online information can be scraped into databases and sold to companies, all without the knowledge of the student or the parent. For instance, 49 percent of K-12 schools surveyed in the report include photographs of students among the “directory information” they can share publicly.
FERPA permits students and parents to request that schools refrain from publicly disclosing any directory information, but schools don’t always make that opportunity clear to families, the report says. More than 60 percent of the schools surveyed don’t have a FERPA opt-out form that’s online and available to the public. Only slightly more than half of schools posted an annual FERPA notice online.
Rural schools, many of which are under-resourced, are less likely than urban schools to offer easily accessible opt-out opportunities, according to the report.
The report also identifies additional barriers to opting out. Parents of K-12 students have an average of one to two months per year to opt out, compared to postsecondary colleges, which typically allow opt-outs all year round. Some opt-out forms contain language that subtly hints that parents shouldn’t take privacy steps, the report says.
The COVID-19 pandemic has heightened the urgency of resolving these issues, the report says. With a majority of students learning at home and school buildings closed, paper handouts or in-person office visits to opt out of information disclosure no longer suffice, said Pam Dixon, the organization’s executive director. Schools are facing a wide variety of data privacy concerns, particularly around the challenges with videoconference platforms.
In addition to identifying the problems, the report points to some potential solutions:
- Schools should publish a FERPA notice and an opt-out form on a prominent place on the publicly accessible school website.
- Opt-out opportunities should be available in multiple formats, including paper, electronic, and phone call, and in multiple language as necessary.
- Opt-out forms should list specific examples of information that students and parents can withhold from public disclosure, rather than “all or nothing” as the only options.
- Schools should conduct a safety review of all student information they elect to make public, and make cuts where appropriate.
- Policymakers “should work together to create a do-not-broker procedure, list, or rules that ensure that student directory information does not go to data brokering activities.” They should also revisit FERPA and consider requiring schools to offer opt-out opportunities as laid out in the report.
For more detail about the study, including best practices, check out the full report.
Image: Getty