ED, FTC seek public feedback on schools’ compliance with student privacy laws

The U.S. Department of Education and the Federal Trade Commission will co-host a public workshop in Washington, D.C., on Dec. 1 to explore the “intersection” of the Children’s Online Privacy Protection Rule and the Family Educational Rights and Privacy Act of 1974.

According to a recent announcement, the agencies want to learn about classroom experiences — “both positive and negative” in protecting student privacy — and how the COPPA Rule, which was issued in 2000 under the FTC, applies to schools as they adhere to FERPA, which is under ED’s authority.

“The workshop is intended to gather information to help clarify how the FTC and ED can ensure that student privacy is properly protected without interfering with the promise of Ed Tech,” the notice said.

Mark MacCarthy, vice president of public policy for the Software & Information Industry Association, applauded the agencies’ efforts to aid schools, as he said the “lack of clarity on how to harmonize [the two statutes] has created great confusion on how best to protect student privacy when implementing educational technology in the classroom.”

Parental consent

The announcement suggests parental involvement is at the heart of the matter.

For instance, the COPPA Rule requires operators of websites and online services to obtain a parent’s permission before “collecting, using, or disclosing” the personal information of children age 13 and under.

Some argued that requiring parental consent interferes with classroom activities, so the FTC said that schools “could act as intermediaries between Ed Tech providers and parents in the notice and consent process, or act as the parents’ agent for the purposes of providing consent to providers,” the notice said.

FERPA, meanwhile, generally prohibits educational agencies and related institutions from disclosing student education records without prior written consent from a parent.

ED issued guidance in 2014, however, explaining that this prohibition on disclosure does not preclude the use of ed-tech in the classroom, provided the school follows the requirements of the “School Official Exception” to FERPA’s written consent requirement, officials explained.

“A number of questions have arisen about the application of COPPA and FERPA,” they wrote. “While the FTC and ED, through its Privacy Technical Assistance Center, have been providing guidance on these issues for several years, with the proliferation of new Ed Tech products, new use cases, and new questions about the intersection of COPPA and FERPA, the agencies believe further public discussion of this topic would be beneficial.”

Questions to explore

According to the notice, the agencies seek input on a number of topics, including the following:

  • Are the joint requirements of FERPA and COPPA sufficiently understood when educational technology providers collect personal information from students? Are providers and schools adhering to the requirements in practice?
  • What “practical challenges” do stakeholders face in simultaneously complying with both COPPA and FERPA?
  • Under what circumstances is it appropriate for a school to provide COPPA consent, and what process should the ed-tech provider use to obtain consent? Who has the authority to provide and revoke consent and how?
  • COPPA and FERPA both limit the use of personal information collected from students by ed-tech vendors. What are the appropriate limits on the use of this data?
  • How should requirements concerning notice, deletion, and retention of records be handled and by whom and when?
  • Schools often use the “School Official Exception” to FERPA’s written consent requirement when disclosing personally identifiable information from education records to ed-tech providers. What are some of the ways in which schools maintain “direct control” over ed-ech providers under FERPA’s “School Official Exception”? Should there be alignment between the “School Official Exception” and schools’ ability to provide consent for purposes of COPPA?

Public comments can be filed online using a Web-based form or mailed to Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue, NW, Suite CC-5610 (Annex A), Washington, DC 20580.

Feedback provided online and in print must be entitled “Student Privacy and Ed Tech and P175412” on the comment and on the envelope if the submission is by mail. The public comment period ends Nov. 17.

Emily Ann Brown covers education technology and STEM education issues for LRP Publications.

Copyright 2017© LRP Publications, Education Daily®