Enacts the "K12 student privacy and cloud computing act"

Summary of specific provisions

Section 1 refers to the measure as the "K-12 Student Privacy and Cloud Computing Act."

Section 2 sets forth legislative intent.

Section 3 establishes a new section in the Education Law to address the issue of cloud computing and student privacy.

Subdivision 1 establishes definitions.

Subdivision 2 prohibits any person who provides a cloud computing service to an educational institution from processing student data for any commercial purposes, including but not limited to advertising, marketing products or services, creating or correcting an individual or household profile and sale-of the data. An exception is made for the processing of data necessary to provide the service to the educational institution or maintain the integrity of the system.

Subdivision 3 provides that, upon entering into an agreement with an educational institution, a cloud computing service must certify in writing to the institution that shall comply with this act.

Section 4 is the effective date.

Justification

As more and more schools have adopted advanced information technol- ogy platforms as essential components of their educational program, policy-makers have demonstrated concern about the implications of student privacy in the digital age. To that end, Congress has enacted the "Family Education Rights Privacy Act" (FERPA) and the "Children's Online Privacy Protection Act" (COPPA), to address some of these concerns.

Under FERPA, schools are required to notify parents at the beginning of the school year of the right to "opt out" of school disclosure of a student's personally identifiable information. While the benefits and flaws of FERPA are much debated - it simply does not address the challenges presented by a cloud-computing service provider (CSP) accessing and processing student correspondence, school work product, photographs, social networking and other information.

COPPA, on the other hand, regulates the online collection, use and disclosure of personal information from children under 13 by operators of websites and online services that are directed to children - including, in certain cases, CSPs. COPPA generally applies to websites and online services operated for commercial purposes, but may also apply to schools that offer students access on online services such as email and that are operated for commercial purposes. COPPA does not apply to a CSP's online collection of information from students under the age of 13 as long as the collection of information is for the sole use and benefit of the school. If, however, the CSP uses the collected information for commercial purposes, then COPPA applies.

If COPPA does apply to a CSP who uses the student's data for commercial purposes - the behavior is not barred, but rather the following steps must be taken by the CSP:

1. Notice must be sent to the parent and verifiable consent must be obtained;

2. The CSP must post a clear privacy notice on its website or online service that explains what personal information is collected from children and how it is used;

3. Limits must be placed on the collection of personal information that is necessary to participate in the online activity;

4. Parents are to be provided with an opportunity to review and delete their children's personal information;

5. The confidentiality, integrity and security of the children's personal information must be protected.

Finally, COPPA also requires that an educational institution obtain permission from a parent before using the online service.

While well-intended, in practicality, COPPA falls short of adequately insulating students (and parents) from wide-spread data collection and profiling. In fact, under COPPA, schools are being asked to monitor activities that they may be ill-equipped to oversee; while the few parents who are actually aware of what is at stake, have to choose between their child's privacy and the child's access to the same cloud services that the other students are using. Moreover, COPPA only applies to students under the age of 13.

A recent study by Brunswick Insight* published this year revealed interesting results. In the study more than 1000 American parents with children in grades K-12 were surveyed. Despite the privacy requirements of FERPA and COPPA, there is a significant "awareness problem". As parents were informed of the collection and use of data related to their children:

* 75% of parents disapproved of CSPs tracking online behavior to build profiles;

* 75% of parents objected to CSPs using data collected from in-school email and Internet usage in order to target students with Internet advertising;

* 76% disapproved of CSP's using additional service offerings, such as video sharing or social networking, to get around privacy agreements and collect children's personal information and track their online behavior; and

* After receiving more information about online tracking and data mining, an astounding 64% indicated that they would like to take action against those practices.

Beyond awareness, there is an additional challenge. A recent study by Professor Daniel Solove** concluded that K-12 educational institutions did not have the expertise or personnel to manage privacy issues. For example, his research failed to reveal a single Chief Privacy Officer at any K-12 educational institution anywhere. Yet, in light of what we know about protecting personal privacy, every school should be able to tell you what steps they are taking to protect their children's privacy; every school should be able to tell you about online tracking by any of their cloud or online vendors; every school should be doing online privacy audits; every school should conduct data inventory or have data stewards. Unfortunately, this is not happening.

Unlike FERPA and COPPA, this legislation acknowledges the dual realities that (1) parents are generally uninformed about the data that is being collected on their children and how it is being used, but, once informed, reject that practice; and (2) our schools are not equipped to manage the privacy concerns presented by the sophisticated methods behind data mining and commercial behavioral advertising. As a result, any cloud-computing service provider doing business with educational institutions in New York should be restricted from data mining for commercial purposes and they must certify, in writing, to the same.

Prior legislative history

New Bill

Fiscal implications

None to the State; but will relieve school districts of some financial obligations associated with complying with certain provisions of FERPA and COPPA.

Effective date

The first day of November next after which it has become law, provided that the commissioner of education and the board of regents are authorized to promulgate such rules and regulations as may be necessary for the timely implementation of such act on or before such effective date.

*Brunswick Insight, January 2013 (media/43502/brunswick_edu_data_privacy_report jan_2013.pdf)

**Daniel J. Solove is the John Marshall Harlan Research Professor of Law at George Washington University Law School and the founder of TeachPrivacy (http://teachprivacy.com) and Senior Policy Advisor at Hogan Lovells. Permalink(/2013/1/8/parental-attitudes-about-student-privacy-online).