What are the Student Data Privacy Principles?


On March 10th, the Consortium for School Networking (COSN) and the Data Quality Campaign released 10 privacy principles for student data. So what exactly are these Principles and how are they different from the Student Data Privacy Pledge? The privacy principles are a guide for protecting student data privacy in schools but more importantly, they show that anyone signing on to these principles is serious about student privacy. The guidelines are a great way to support schools and members of the educational community.

Unlike the Student Data Privacy Pledge, these principles are not enforceable by law but I don’t think that lessens the importance of signing on. Anyone signing on to the principles is sending a message that it is ingrained in their culture to integrate these guides into their organization’s thinking. And that is key because it places student data privacy at the forefront. Also worth noting is that these are matching commitments from the “other” side of the table so to speak. These are commitments from the education community to match the Pledge commitments made by vendors which shows the coordination between diverse stakeholder groups, all focused on the same ideas and goals.

Students are the ones that stand to win by the use of technology. They also are the ones that can lose it all if we are not smart when making decisions on student privacy. If we negate students in our thinking, if we do not recognize that our decisions affect kids, we cannot develop effective policies that protect student information in an equitable manner. The Principles are one more piece of the puzzle to help build consensus on best practices.

My favorite Principles? Easy –“Student data should be used to further and support student learning and success” and “student data should be used to inform and not replace the professional judgment of educators.” And this is important because by recognizing that student data matters and that it can and should be used to help students we are moving our conversation into a more comprehensive view of privacy instead of just one of security concerns. It is important we provide educators and educational institutions, with the best training on privacy practices while encouraging them to help students further their learning.

I am encouraged that slowly but surely we are recognizing that this conversation is about students and their future. It is about us helping them get the best education we can provide for them. Because after all, it is about students empowering their education and using the data to make education something they own and not something that just happens to them.

Our conversation shouldn’t stop here. The Principles are a great framework to follow but they certainly are not a cure all. Our conversations on privacy and data need to continue so that we can provide students with the assurance that we will protect their data, we will use it ethically and effectively and will let them take ownership of it so they can use it to their advantage.

If you want to read the principles you can find them here.



Social Media Monitoring, Privacy and Students


“Pearson is spying on kids” was the statement dominating this week. But the reality is that Pearson, like most major corporations, is involved in social media monitoring. Companies do this monitoring so that they can improve their product, provide better service or promote their brand. One could say that we should expect for major corporations to monitor our online activity when we mention their brands on social media. However, in this particular case, Pearson is not just randomly collecting everything anyone says about the test, but in fact monitoring to identify and track anything that appears to be a violation of the test integrity. In this case, the student’s tweet describing a particular test question. Further, testing companies actually have an affirmative duty to do this monitoring imposed by contract or other methods in order to ensure that schools can rely on the validity of the test results.

But for me, what is most important is the fact that we have engaged in the debate whether this practice is or isn’t acceptable while completely ignoring how students feel about this. Have we stopped to think if students care or, dare we say, expect it even? You see, as adults we can express our outrage over a multinational corporation monitoring students but are we speaking for students or for ourselves? Is this our outrage or the students?

I talk with students all the time, from elementary school age kids through college and their responses are vastly different. College students know and expect for their social media activity to be monitored, watched, some even do all they can to be noticed. K-12 students think differently. They expect to be watched by their teachers, parents, peers etc. but certainly do not expect companies monitoring social media to see who mentioned a test. And here is where it gets interesting. I asked some 5th grade students how they would feel if they posted something online and it became public information. They said that everything they do is seen by their parents and their parents are always posting things about them anyway. They expect someone to be looking at what they do all the time. So have we conditioned kids to expect to be monitored and tracked? Have we unconsciously blurred the lines between private and public for kids so much that they expect to be watched all the time? We have created an atmosphere of mistrust because we don’t trust the education and technology sector. How do we teach students to trust the technology in their schools? As many noted on Twitter, there is outrage over Pearson monitoring discussions about a test but deafening silence about constant social media monitoring students of color. There are so many instances of social media used for profiling that it is difficult to understand why it’s ok to monitor a certain group of students but not another. We need to examine online profiling and what we are doing by wanting to protect some students.

But more importantly, we must listen to students so we understand what privacy means to them and what they expect we give them when it comes to privacy protections. Students will still talk about tests. It’s what kids do. They will just do it in true private venues, in person, whispering in the backyard so that adults leave them alone. What opportunities are we missing by not acknowledging students in this debate? The issue about social media monitoring is about much more than one company concerned about one tweet. The issue is how do we come to terms that social media monitoring is persistent even in the education sector, it’s about establishing what is ok to monitor and what is not.



What happens when a group of privacy advocates descends on an Ed-Tech conference???


Last week I attended SXSWedu and it was very interesting. I was fortunate enough to be invited to participate in a panel to discuss the challenges in student data privacy and defining data ownership. And as excited as I was to be able to participate, I looked forward to the other sessions at SXSWedu. This year there were many panels discussing student privacy (about 10), more than any other year. And that is telling, because it means that the conversation around student data privacy is becoming entrenched in the educational landscape.

So what happens when a group of privacy advocates descends on SXSWedu? The conversation changes. The conference showcased how the use of data and technology in education has the power to ensure that every student has the opportunity to maximize their education. But with the increased use of technology in the classroom comes the increased amount of student data available. And that is where the privacy conversations came in. How can we meet the unique needs of every student while ensuring that their data is being used ethically, effectively and safely, but without stifling innovation? I spoke to many different groups of people while I was there and the main concern from tech companies was – how do we get it right so that we can give parents the comfort that we are safeguarding their children’s data while simultaneously improving and enhancing our products to deliver better learning experiences? And it shouldn’t be that hard. Because when you have privacy advocates and Ed-tech companies working together you can make substantial and effective changes as Clever did in updating their privacy policy. I would like to see companies have their privacy policies right from the beginning. Make it part of their culture. When we discussed data ownership in my panel I stressed the importance of recognizing student input and creating their brand image and privacy “philosophy” with students at the center of their decision making process. Because only by recognizing students as active participants in their education will we move the conversation from one of concern about student privacy to one of collaboration.

The commitment I saw this past week does not begin and end at SXSWedu. Everyone with a stake in education has a responsibility to do more. There is an incredible opportunity at hand and it starts with our commitment to safeguard student data.



Guest Post – When talking student privacy, we need to all get on the same page

When we discuss privacy protections we often focus on what we want the industry to provide parents and students, often we do not hear from the industry. I met the founders of Education Framework and was able to take a look at their product.

Education Framework is an Ed-tech company that manages student privacy and consent services for U.S. K-12 schools. Katie was kind enough to write a guest post for us from her perspective as the founder of a company that works on student privacy but also as a parent.

Thanks Katie!


When talking student privacy, we need to all get on the same page

We operate in a digital age where technology has infiltrated our everyday lives – at home, at work, and at school. What we once considered to be private is no longer so, nor will it ever be again.

But the reality is that in education, large amounts of data are being collected on children. While some argue that this data is necessary for improving educational outcomes, others have expressed concerns that it is vulnerable to misinterpretation, misuse, and outright abuse. This holds especially true as schools increasingly explore and adopt new digital learning solutions.

As the co-founder of an Ed tech start-up that specializes in managing student data privacy obligations for schools, and a parent to two school-aged children, I have experienced, first-hand, many of the challenges that school and service providers face today. I sit in a unique position to see both sides of the coin.

On one hand, I am troubled by the amount of data that is collected on my children and the lack of transparency regarding how that information is used and stored. On the other hand, I see the value of using information to simplify processes and improve outcomes.

As a service provider, integrating with the Student Information System (SIS) makes our digital process far more efficient, but without the proper protocols in place to ensure privacy, safety and security, it could be fraught with disaster.

When we consider a student’s data chain of custody, transparency is key. We must have a clear understanding of who has access to the information, for what purpose the information is being used, and for how long it will be stored. Moreover, this information should be readily available to both parents and school administrators. Parents shouldn’t have to jump through hoops to find out what information is being collected on their children, and schools should be able to produce that information, if requested, on a moment’s notice.

But the existing model is quite the contrary. Archaic manual processes, paired with limited guidance and weak oversight, have left the privacy door open to trouble. This is particularly concerning when realizing that there are approximately 50 million students whose information is at risk for exposure. As technology usage increases in schools across the nation, parents, teachers and administrators all need to better understand their privacy obligations. And while third party service providers, like myself, must commit to actively ensuring the protection of any information accessed, we must also maintain that the most basic procedures are, in fact, in place to ensure safety and security.

However, it is confusing whether the responsibility to obtain parental consent rests on the school or the service provider when the app is used in school.  Under COPPA, the Children’s Online Protection Privacy Act, parental consent is required for any app or website that collects personal information for children 13 years and under. But determining who is responsible for actually obtaining that consent is another story.

While the collective shift in attitude indicates a general move in the right direction, much still needs to be done to actually ensure student privacy in our schools. We must critically look at how we are managing the information we have access to in order to protect student’s privacy in schools. We also need to ask ourselves if the current process for managing student information fits with the model in which we are collecting it. We need to ensure that all parties are committed to making student privacy a top priority, and that all who have access to student information clearly understand their roles and responsibilities when it comes to managing the data. We need to determine what steps need to be taken to improve our systems to be more in line with our goals. It is imperative that we all get on the same page.


Katie Onstad, Vice President and Co-Founder, Education Framework Inc.

Katie Onstad is vice-president of Education Framework Inc., an education technology company that manages student privacy and consent services for U.S. K-12 schools. Katie co-founded the business in late 2013 with her husband and business partner, Jim. When she isn’t running the business, or the household, Katie volunteers her time around the community and in the classroom at her kids’ school. Katie received her B.A. in Organizational Communication from the University of Montana and lives in Bend, Oregon with Jim and their two young daughters.