Student Privacy Policies and Career Information Web Sites
Career information web sites are getting increasingly sophisticated in response to the expectations of users. For example, state departments of education and school districts are requiring individual career plans or portfolios for every student. Or students and parents are searching for services that provide free access to a very specific list of scholarships. In response, web-based systems are providing electronic portfolios and comprehensive financial aid searches.
A by-product of these sophisticated electronic responses is the collection of personal student information in databases. Therefore it is important that educators and parents are aware of and understand the laws that protect students' personal information, In addition, it is helpful to know how to access and review the privacy policies for each of the websites.
Two federal laws define the access to student information. The first is the Family Educational Rights and Privacy Act (FERPA) of 1996 and the second is the Children's On-line Privacy Protection Act (COPPA) of 1998. FERPA protects the privacy of student records. Under FERPA, a school cannot release a student's personal information without consent of the parents. Student records are "defined as records, files, documents, and other materials that contain information directly related to a student and that are maintained by an educational agency or institution or by a person acting for the agency or institution."
Provisions of COPPA require parent consent to collect personal information on children under the age of thirteen. (See the notes at the end of the article for more detailed information about each of the Acts.)
The Nebraska Career Information System (NCIS) adheres to the requirements of FERPA and COPPA. Personal student information is not disclosed to any other group or agency for any purpose. Individual information is not looked at by any NCIS staff member except as necessary to correct system problems. Logs of site usage are collected in aggregate and do not identify individual users. Site coordinators are directed to require written parental consent before a student under the age of 13 creates a portfolio.
Websites that collect personal information are required to post privacy policies in places where they can be easily located, such as the bottom of the site's homepage. The content of most privacy policies is clear and concise; however, it is helpful to be alert to some ambiguous or misleading statements. As you are reviewing a site's policies, ask yourself the following questions. With each question, look for statements like those that have been taken from actual policies.
1. Who is the information being shared with? Does this information sharing comply with FERPA guidelines?
"…does not share your personal information outside our related companies."
"… sometimes share customer information with outside companies that perform services for us or provide products that we don’t."
"…to provide the information to the particular schools contracting for its collection."
2. Why is the personal information being shared?
"…in order to personalize and improve upon your experience with us."
"…let you know by email about other products and services and product enhancements that may be of interest to you."
"…to identify, develop, and offer products and services that help in the transition from high school to college, may make your college experience more enjoyable and cost efficient, or to obtain such products and services from suppliers and selected vendors."
3. Can a person opt out of the sharing of personal information? How easy is the opt-out process? Does any opt-in or opt-out process for students under the age of 18 really meet the FERPA and COPPA guidelines? Are parents asked to reply for children under 18?
"You will have the opportunity to tell us you don’t want to receive future messages with each message you receive."
"If you choose not to provide information, we may not be able to permit access to such areas, provide those special services, or complete such transactions."
4. Does the site place cookies on your computer? How long are the cookies active and what is their purpose?
"… may place both temporary and non-expiring cookies on your computer when you visit."
"…use cookies to keep track of your shopping cart or to deliver content specific to your interests.
Schools and educators are responsible for student information and awareness is an important tool in protecting children's privacy.
Notes:
Family Educational Rights and Privacy Act (FERPA)
The Family Educational Rights and Privacy Act (FERPA) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students.
Under FERPA, an educational agency or institution may not have policy or practice of permitting the release of education records, or personally identifiable information from education records, without the parent's written consent. FERPA applies to any "educational agency or institution" to which funds have been made available under any program administered by the Secretary if the "educational agency is authorized to direct and control public elementary or secondary, or postsecondary educational institutions." The term "education records" is defined as records, files, documents, and other materials that contain information directly related to a student and that are maintained by an educational agency or institution or by a person acting for the agency or institution. (Letter to Michigan Department of Education re: Open Meetings August 13, 2003.)
"Disclosure" is defined to mean "to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records to any party, by any means, including oral, written, or electronic means." The term "education records" is defined in FERPA as those records that are directly related to a student; and maintained by an educational agency or institution, or by a party acting for the agency or institution. "Record," in turn, means "any information recorded in any way, including, but not limited to, hand writing, print, computer media, video or audio tape, film, microfilm, and microfiche."
Based on the provisions described above, this Office would consider a record management system that allows unauthorized individuals to have access to education records to constitute a policy or practice of violating FERPA. In the context of paper records, for example, this means that a school district may not place the report cards of all students in a box on a teacher's or principal's desk and allow parents or students to look through the box to find the student's own record. Similarly, with respect to electronic record keeping, a school district may not maintain a system that provides for access to education records by parties that are not parents, students, authorized "school officials," or otherwise permitted to have access as specified in § 99.31 of the regulations. (Letter to Tazewell County, VA, School Board re: Unauthorized Access to Education Record Systems, October 7, 2005.)
For more information go to http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html
Children's On-line Privacy Protection Act of 1998
The act requires the operator of any website or on-line service directed to children (individuals under the age of 13) that collects personal information from children
1. to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator's disclosure practices for such information; and
2. to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children.
For more information go to http://www.coppa.org/