Safeguarding Data to Ensure Effective Data Use

Paige Kowalski |Director| State Policy & Advocacy

April 2014

Today’s Agenda

• Overview: Privacy Concerns and State Landscape– Paige Kowalski, Director of State Policy and Advocacy

at DQC• Safeguarding Data in Idaho– Senator John Goedde (R-ID), Chairman, Education

Committee• Policy Guidance and Model Legislation

Kate Lipper, Policy and Legal Advisor at EducationCounselReg Leichty, Partner at EducationCounsel

@EdDataCampaign #eddata

The Goal: Deliver Value to Educators

Source: Ms. Bullen’s Data-Rich Year

#eddata@EdDataCampaign

Right Data

Right Time

Right Format

Ensure privacy, security, and confidentiality of student data throughout.

The Task: Support Data Use & Protect Privacy

#eddata@EdDataCampaign

The Family Educational Rights

and Privacy Act (FERPA)

» Protects student privacy by limiting the disclosure of student records by educational agencies and institutions that receive funds from the U.S. Department of Education.

#eddata@EdDataCampaign

#eddata@EdDataCampaign

Image Source: Louisiana State Board of Elementary and Secondary Education

Back in the Day 1990’s Today

An Evolution: Collecting, Storing, & Securing Data

#eddata@EdDataCampaign

• We’ve seen a number of myths and fears arise about• The scope and type of student data collected

and the privacy of those data• Who is collecting and accessing student data• The role of 3rd party service providers

• Emerging concerns reflect a broadening of the conversation• Teachers and schools are using cloud based

and other free tools; • Students are using school-sanctioned social

networking or communication tools

The Next Step: Strengthen Communications & Privacy Policies

#eddata@EdDataCampaign

» Ensure parents and educators find value in the data that is collected and understand the “who, what, where, and when” of data collection and use.

» Communicate with stakeholders, at every opportunity, to dispel myths and clarify the value of data to teaching, learning, and decision making.

» Promote, enact and continuously review and update privacy, security, and confidentiality policies that are proactive and constructive rather than prohibitive.

States Must:

#eddata@EdDataCampaign

State Legislation in 2014» 83 bills from 32 states» More are already being drafted

» 62 bills have taken a prohibitive approach» NY AB 8929: Allows parents to opt-out of having their child's PII shared with any third

party» OK HB 2911: Prevents any cross-agency data links and defunds the SLDS

» 33 bills have taken a governance/transparency/accountability approach» WV HB 4316: Describes state, district, and school privacy responsibilities and

establishes data sharing governance» TN SB 1470: Requires a public data inventory and a comprehensive privacy policy

» The approaches are not mutually exclusive

@EdDataCampaign #eddata

Other State Actions» Executive Orders

» Georgia: Affirmed prohibitions on sending PII to the federal government.» Maine: Affirmed commitment to student privacy rights.» Iowa: Confirmed the state DOE provides only aggregated student-level data to

the federal government.

» State Board Actions» Louisiana: Created a task force to validate data storage, security, and sharing

practices at the district and state levels.» Alabama: Passed a policy to ensure that all state education data are collected,

managed, and used in secure ways.» West Virginia: Submitted an amendment requiring transparency about data

collection, governance, and parent compliant procedures.

@EdDataCampaign #eddata

• Interactive guide to data: a succinct infographic tool explaining what data are, how they help, and what various stakeholders (parents, teachers, etc.) can do with them

• Ms. Bullen's Data-Rich Year: an infographic that follows a teacher and student through the school year to see how data help teachers, parents, and others make sure students are meeting education goals.

• DQC’s Annual Report: information from the Data for Action survey on how states are using data and what they must do to improve

• Communicating Data toolkit: language and tools to help you better talk to peers, press, and the public about data and meeting education goals

• What Every Parent Should Be Asking about Education Data and Privacy: created with the National PTA, offers parents critical questions they should be asking their children's educators about the value of education data and how student privacy is ensured

Why Data Matter

• Myth Busters: Getting the Facts Straight about Education Data: addresses myths related to data and Common Core, vendors and corporations, and what the federal government collects

• Talking about the Facts of Education Data with Policymakers: addresses critical questions for policymakers on myths around the federal role in data, selling data, and what is collected

Debunking Data Myths

• Safeguarding Data: Strategies state policymakers can pursue to support effective data use• Privacy, Security, and Confidentiality: DQC’s action issue page with information on how states can safeguard

data and many additional resources• Supporting Data Use While Protecting the Privacy, Security and Confidentiality of Student Information: a

primer for state policymakers• Complying with FERPA and Other Federal Privacy and Security Laws and Maximizing Appropriate Data Use• EducationCounsel’s

Key Elements for Strengthening State Laws and Policies Pertaining to Student Data Use, Privacy, and Security: Model language and privacy policy guidance from education law experts

Protecting Data

#eddata@EdDataCampaign

• Senator John Goedde (R-ID) Chairman, Education Committee

Safeguarding Data in Idaho

Foundational Elements of a State Data Privacy and Security Policy

Privacy• What personally

identifiable information ("PII") is collected?

• To whom can student PII be disclosed (for what purposes)?

Security• How is student PII

appropriately safeguarded with administrative, physical, and technical protections?

14

Privacy and Security: Related but Different

Foundational Elements of a State Data Privacy and Security Policy

1. Statement of the policy/law's purposes

2. Selection of a state leader and advisory board

3. Establishment of public data inventory and description of data elements

4. Strategies for transparency about data use, storage, retention, destruction, and protection

5. Statewide policies governing personally identifiable information

6. Statewide data security plan15

Key Elements of Statewide Law/Policy

Foundational Elements of a State Data Privacy and Security Policy

1. EducationCounsel, Key Elements for Strengthening State Laws and Policies Pertaining to Student Data Use, Privacy, and Security: Guidance for State Policymakers

a. State Legislation/Policy Checklist

b. Model Legislative Language

2. PTAC, U.S. Department of Education, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices

3. CoSN, Protecting Privacy in Connected Learning Toolkit: Considerations when Choosing an Online Service Provider for Your School System

16

Tools You Can Use

Foundational Elements of a State Data Privacy and Security Policy

17

Tools You Can Use: 1a. State Legislation/Policy Checklist

Questions?

#eddata@EdDataCampaign