Privacy laws governing data collection for students are fraught with ambiguity. Are student files private? It depends.

Every week, local school officials bombard the U.S. Department of Education with dozens of questions about student privacy. The department responded by recently releasing a 14-page list of common queries.

The answers to two of them: “It depends.”


Privacy laws governing data collection for students are fraught with ambiguity.

The Family Educational Rights and Privacy Act prohibits disclosure of personally identifiable information from student education records to third parties without written parental consent.

( Also on POLITICO: Data mining your children)

That may sound iron-clad. But there federal officials and privacy lawyers point out several loopholes.

First, the U.S. Supreme Court has ruled that FERPA does not protect student homework or classroom assignments — just education records permanently maintained by a central custodian.

Many of the latest digital tools collect vast amounts of “metadata” as students work online; the sites track academic progress and log information about the child’s location, computer equipment and browsing habits. Most of that data never finds its way into official school files and thus is unlikely to be considered an “educational record.” That means private companies are free to do what they want with it.

( Full coverage: Beyond the NSA series)

“I don’t think it’s necessarily an easy decision, what is and what is not the ‘educational record,’ ” said Kathleen Styles, the Education Department’s chief privacy officer. “It’s very contextual. A lot of metadata won’t fit as an educational record.”

Loophole No. 2: Schools can disclose “directory information” without parental consent, including a child’s name, address, phone number, birth date, awards received and student ID number. Schools must notify parents once a year of the general categories of information that might be released and give them a chance to opt out.

And finally, the third big exception: Schools can also release student records, without written consent, to other “school officials with a legitimate educational interest.” In 2008, the Education Department expanded the definition of “school officials” to include for-profit companies.

( Also on POLITICO: Who watches the watchers?)

Companies that receive student records under this provision are not allowed to use them for any purpose other than what the district intended. But companies that just receive directory information — names and ID numbers, for instance, to set up online accounts — face no such prohibitions.

When FERPA violations are suspected, individual families have little recourse. They cannot bring a legal complaint. All they can do is alert the Education Department.

The department’s hands are tied, too. It has no authority to levy fines on companies that violate FERPA. It can withhold federal funding from the district, but that’s considered such a drastic step, it’s never once been taken.

(Also on POLITICO: The feds' push for Big Data)

A White House report on Big Data released earlier this month called for updating FERPA. Sen. Ed Markey (D-Mass.) is working on just that. This week he began circulating a draft bill co-sponsored by Sen. Orrin Hatch (R-Utah). It doesn’t expand the definition of “educational record” but does tighten controls on private companies who get access to those records. Markey says his goal is to make sure personal profiles of children aren’t being “sold as a product to the highest bidder on the open market.”

While FERPA is the heavyweight, two other federal laws offer some additional privacy protections.

Under the Protection of Pupil Rights Amendment, or PPRA, schools must obtain parental consent before requiring students to fill out surveys that ask about sensitive issues such as political affiliation, income or sexual behavior.

And the Children’s Online Privacy Protection Act, or COPPA, requires website operators to obtain parental consent before collecting personal information from children 12 and younger. Parents also have the right to bar the company from sharing that information with third parties. Markey has introduced a bipartisan bill to expand COPPA protections.