As classrooms evolved from giant humming towers in computer labs to tablets and chromebooks on every desk, most states across the country have updated their privacy laws to strengthen protections for students and educators. In Massachusetts, legislators are urging the passage of a bill that would update the state’s statute on student data privacy in K-12 schools, amending a statute that has gone untouched since 2006.
The current version of the bill, which now sits before a joint committee on education, would specifically limit the ways that operators, or vendors that provide online services to schools, could use, share, sell or rent data about students.
“This helps to build greater trust between schools who want to use this technology and students and parents who need to know that this information is going to be protected,” said Amelia Vance, an attorney with the Future of Privacy Forum, a Washington, D.C. think tank and nonprofit specializing in data privacy.
Vance is one of several speakers scheduled to appear at a virtual briefing on the bill today, hosted by Reps. Kate Lipper-Garabedian and Jeffrey N. Roy.
Vance will appear with Cambridge Public Schools CIO Steve Smith, who also founded the Student Data Privacy Consortium. According to Vance, Smith could be considered part of the reason that Massachusetts has not updated its educational privacy laws, for “what is actually a pretty positive reason,” Vance said.
“Districts really stepped up in Massachusetts,” Vance said. “[Massachusetts] has perhaps the most robust and privacy protective infrastructure, largely built by Steve Smith, whose organization provides essentially a model data use agreement that districts can use with companies.”
Smith’s model created a system where companies have to sign a contract agreeing to restrictions around data sharing, Vance said. Smith did not immediately respond to a request for comment.
“It would make the district's lives easier if companies were required to sign it,” Vance said. “But these districts have really been leading here in a way that I think has led to action feeling less necessary from the legislature.”
Felicia Vasudevan, an attorney who negotiates data privacy agreements with vendors in states including Massachusetts, says having a law in the books would help bolster the process of securing student data.
“When I'm negotiating these agreements, a lot of times the vendors will push back and will say, ‘where is the statute that supports this?’ And I can point to a statute, but not necessarily for Massachusetts or Rhode Island,” Vasudevan said. “So the bill is important because it really gives school districts a backing for why they're requesting these data privacy protections.”
Data, as defined in the legislation, includes educational records, schoolwork, personal information including phone numbers and emails, discipline records, criminal records and juvenile dependency records, special education data, photographs, medical records and health information, food purchases, text messages, online search activity, test results and grades, among other categories.
Much of this data is already prohibited from sharing by the Family Educational Rights and Privacy Act (FERPA), a 1974 federal law that protects the privacy of a student's education records. Under FERPA, educational institutions cannot legally share information that identifies a student — but both federal and state laws are vague about that definition, Vasudevan says.
“Negotiating these agreements, it's always a question of like, what is student data? What is personally identifiable? It’s really broad right now under state law,” Vasudevan said. “One of the things that's really important about the bill is that it is very concrete about what is personally identifiable student data, so we don't have this ambiguity.”
The bill includes a private right of action, which gives “an aggrieved student or educational entity” the right to file a civil lawsuit against an operator, or online vendor, for damages up to $10,000 for each violation of the proposed law.
“I think that will be one of the more politically controversial points in this bill,” Vance said. “We've seen a private right of action suggested in other states, but none have passed.”
Vance says she’s skeptical of this provision of the bill, which she says could be seen as too restrictive and deter future business in the state.
“If people are able to bring civil actions, that raises prices and deters companies from being willing to provide their product in the education space,” Vance said. “I know, for example, you had multiple companies that stepped into the education space for the first time because of the pandemic, and it's unlikely they would have been willing to do so if this sort of provision was in place.”
Attorney Felicia Vasudevan says this provision actually gives students and schools the power to hold companies to a higher standard.
“If we're thinking about ways to incentivize and make sure that vendors are adhering to these obligations, it adds teeth,” Vasudevan said.
