AD

Google's U.S. educational partnerships are possible thanks in part to school districts' reliance on the government's reinterpretation of an obscure 1970s-era student privacy law.

AD

The law, the Family Educational Rights and Privacy Act or FERPA, requires schools to get written consent from parents before sharing personal information about students in many cases or risk federal education dollars. But it has an exception for sharing data with "school officials" who have a "legitimate educational interest" in the data.

When it was first enacted, that meant someone who was actually employed by the school district, according to Joel Reidenberg, a Fordham University law professor who has researched student data privacy. But changes in how the Department of Education interpreted the law in recent years now allow almost any individual or organization that contracts with a school district for some sort of educational function to be termed a "school official," he said.

AD

In 2008, the "school official" exemption was extended to cover contractors because it was "critical" to establish rules for "non-consensual disclosures" as schools outsource more functions, according to an analysis of the changes from the department. To qualify for the designation, companies are supposed to provide a service the district would otherwise do itself and are held to the same general rules for use and restrictions on disclosing student data that govern traditional school officials.

AD

"Student safety - including privacy - is a top priority for the Department," Education Department spokesperson Dorie Nolt said in an emailed statement. "That's why we continue to put out guidance and resources so that district leaders, schools, educators and students can use cutting-edge learning tools in the classroom while also safeguarding student privacy."

Google's standard agreement for providing its education suite defines the company as a "school official" for the purpose of that student privacy law. In Google's case, the company is providing software that districts might otherwise have to develop or support themselves, such as email services or tools that help students digitally collaborate on assignments.

AD

But schools are supposed to have "direct control" of how a company or individual uses and maintains education records to deem them a "school official," according to the department's regulation. Khaliah Barnes, an associate director at the Electronic Privacy Information Center or EPIC, argues that isn't happening with many ed tech providers, including Google.

AD

"The schools don't have access to Google's servers or a lot of the way that it uses the information because [the information is treated as] proprietary," she said. In 2012, EPIC brought a lawsuit against the Education Department in an attempt to stop the government from interpreting the law in ways it argued could allow schools to share more data about students with less explicit consent, but the case was later dismissed on standing grounds.

Today, Google and many other tech companies are increasingly part of students' daily classroom lives under the "school official" designation. And that leaves parents in the dark about who has access to an increasingly large cache of information about their children and may compromise their privacy down the line, experts say. But as previously reported, Google said it has "always been firmly committed to keeping student information private and secure."

AD

Even 20 years ago, parents really didn't expect schools to track more than basic information about their children's school performance — things like attendance and test scores. But the latest generation of educational tech products are cataloging a nearly limitless amount of data on what students do everyday — from emails and chats, to metadata, such as location history, that educators may not even realize is being collected, Barnes said.

AD

"The companies themselves aren't transparent, and often times schools even aren't aware of the extent of data collection," Barnes said.

Thanks in part to things like the "school official" loophole, parents are even less likely than school districts to know where data about their kid is going or be able to object, experts say. In a 2013 study, Reidenberg and colleagues looked at a sample of U.S. public schools and found that the vast majority of them used some sort of online cloud service, but only one in four told parents about the services.

AD

"School districts are just generally not providing notice to parents," said Reidenberg.

The Department of Education itself has urged schools to be cautious when selecting tech for the classrooms — and to think about getting parents' consent even when the law may not explicitly call for it.

AD

"Schools and districts are encouraged to remember that FERPA represents a minimum set of requirements to follow," a 2014 guide released by the Department's Privacy Technical Assistance Center said. "Even in instances where FERPA does not require parental consent, schools and districts should consider whether consent is appropriate."