ED issues guidance on student privacy risks of college admissions exams, surveys

The U.S. Education Department’s Office of the Chief Privacy Officer released on May 23 student privacy technical guidance for states and local educational agencies when administering college admissions examinations and related surveys with the purpose of helping colleges, universities, scholarship services, and recruiters identify students who may be of interest to their programs.

ED officials said the college admissions exams and pre-test surveys administered in connection with these exams raise “potential legal issues” under FERPA, the Protection of Pupil Rights Amendment, and the IDEA, as well as state privacy laws.

Indeed, the college entrance tools raise concerns about privacy best practices generally, they said, and they advised educational institutions to consider the various privacy risks when contracting with testing companies.

The pre-test surveys ask questions about a range of topics, such as academic interests, participation in extracurricular activities, and religious affiliation, according to ED. The surveys are voluntary, and students may opt-out, but that appears to be unclear in some cases.

“We have heard from teachers and students … that the voluntary nature of these pre-test surveys is not well understood, and that each of the questions requires a response, and the student must affirmatively indicate in response to multiple questions that the student does not wish to provide the information,” ED officials wrote in the guidance.

“The survey’s multiple questions are designed to allow targeted recruitment, and students are specifically asked whether they would like to receive materials from different organizations, including colleges and scholarship organizations,” the guidance noted. “For students who consent to being contacted by these organizations, the testing companies then sell this information to colleges, universities, scholarship services, and other organizations for college recruitment and scholarship solicitation.”

Contracts with testing companies

“Contracts between testing companies and [SEAs], LEAs, or schools for testing, including testing required by the ESEA, as amended, should include provisions assuring that before [personally identifiable information] is disclosed non-consensually, the testing companies (when acting on behalf of the SEA, LEA, or school) will comply with the privacy protections required by Federal law, specifically FERPA and IDEA,” the technical guidance said.

The guidance advised SEAs, LEAs, and schools to specify in their contracts with the testing companies prohibitions under FERPA and the IDEA that govern the unauthorized use of PII and re-disclosure of PII from education records, including biographic or demographic information and the students’ test scores or test score ranges, without having written consent of the parent or eligible student.

The guidance also urged SEAs and LEAs to ensure that the contract with testing companies specifies the FERPA exceptions to consent under which PII from a student’s education records can be disclosed to the testing company, and to include specific requirements on how testing companies should safeguard student PII, along with additional mandates by the state.

Educational records

The new guidance could have far-reaching impact, according to Amelia Vance, director of education privacy and policy counsel for the Future of Privacy Forum.

States in recent years have elected to make ACT and/or SAT mandatory for high school students and have begun administering the test directly, oftentimes for free in order to remove any economic barriers for students, she explained.

Additionally, she said the exams are being used by some states as the high school English and math assessment required under Title I of the Every Student Succeeds Act, Pub. L. No. 114-95.

“In states where this shift occurred, information collected in conjunction with the administration of those tests becomes part of the student’s educational record, and therefore subject to legal obligations under FERPA,” she wrote in a blog.

Emily Ann Brown covers education technology and STEM education issues for LRP Publications.

Copyright 2018© LRP Publications, Education Daily®