The Washington PostDemocracy Dies in Darkness

New student database slammed by privacy experts

January 7, 2016 at 4:34 p.m. EST
(iqoncept/Bigstock)

The U.S. Education Department’s new planned system of records that will collect detailed data on thousands of students — and transfer records to private contractors —  is being slammed by experts who say there are not adequate privacy safeguards embedded in the project.

The non-profit Electronic Privacy Information Center, or EPIC, told the department in a January 2016 formal complaint (see below) that its new system of records for the “Impact Evaluation of Data-Driven Instruction Professional Development for Teachers” violates the Privacy Act by:

(1) collecting irrelevant and unnecessary information and (2) not clearly stating the purpose of the proposed routine use disclosures. EPIC recognizes the need to evaluate educational programs, including professional development of teachers. However, this particular study appears to be one more effort by the agency to transfer sensitive student data to private contractors without any meaningful privacy safeguards.

[The astonishing amount of data being collected about your children]

The Institute of Education Sciences of the Department of Education published a Systems of Records Notice on Dec. 2 (see below) that says the data collection will facilitate “a rigorous study of the effectiveness of providing data-driven instruction professional development to teachers and principals.” It says:

The system will contain personally identifying information on approximately 12,000 students, 500 teachers, and 104 principals from 104 schools in 12 school districts and will include, but will not necessarily be limited to, data on: (1) for students, standardized math and English/Language Arts test scores, age, sex, race/ ethnicity, grade, eligibility for free/reduced-price lunches, English Learner status, individualized education plan status, school enrollment dates, attendance records, and discipline records, and (2) for principals and teachers, individual district identifiers, school assignments, grades and subjects taught, and principal and teacher  background characteristics, including age, sex, race/ethnicity, certifications, degrees, years of teaching experience, scores on licensure or certification tests.

The purpose of collecting the information, it says, is

to conduct a rigorous study of the effectiveness of providing data-driven instruction professional development to teachers and principals.The study will address the following central research question: What are the achievement, teachers’ instructional strategies, and school supports for using data? Secondary research questions for the study are: How are schools implementing data-driven instruction? What challenges do schools face in its implementation?

The Electronic Privacy Information Center, a Washington D.C.-based non-profit public interest research group that focuses on civil liberties issues and the First Amendment, has sent the department a formal objection to the system. It notes that the Education Department’s Inspector General’s Office recently issued a report that says:

“While the Department made progress in strengthening its information security program, many longstanding weaknesses remain and the Department’s information systems continue to be vulnerable to serious security threats.

The complaint says:

The proposed database exposes students to privacy risks by collecting and students’ personally identifiable information, including but not limited to “individualized education plan status” and “discipline records.” Because the Department can still achieve its research goals by collecting aggregate data, the Department should not collect, use, or disclose student personally identifiable information….
It may be appropriate for the Education Department to maintain personally identifiable information on teachers pursuant to this research study. It is unclear, however, why the Education Department could not simply collect this information as aggregate data. Nevertheless, regarding student data, the Department should not maintain student personally identifiable information. The Department has failed to justify why the Department needs a non-exhaustive list of student personally identifiable information to study the “effectiveness of providing data-driven instruction professional development to teaches and principals.” To protect student data, the Department should only collect information at the aggregate level to protect student privacy.
Moreover, the Education Department has recently faced criticism for failing to safeguard student data. In 2014, the Education Department Inspector General found that Education Department “information systems continue to be vulnerable to serious security threats.” The Department currently has 184 information systems, with 120 of those systems being managed by outside contractors. The Education Department’s vulnerable systems coupled with expansive outside parties having access to student records places student personal information at risk. To safeguard against the risk, the Education Department should only collect aggregate student data.

In November, a congressional scorecard on how well federal agencies were implementing four key areas of the Federal Information Technology Acquisition Reform Act, or FITARA, gave the Education Department three Fs and one D. In the same month, Democrats and Republicans legislators at a House oversight hearing slammed the Education Department for the way data is handled for more than 40 million federal student loan borrowers as well as other aid programs that serve millions more students. Inspector General Kathleen Tighe testified that her office had been able to penetrate some department data systems without being detected. “We could have really done anything in there,” she said, saying that “outsiders” could find their way in too. She also said, “I am still concerned about the potential for breaches in the department.”

Here’s the government’s notice:

And here is EPIC’s complaint: