Privacy law in the United States is a complicated patchwork of state and federal caselaw and statutes. Harvard Law School’s Cyberlaw Clinic, based at the Berkman Center for Internet & Society, prepared this briefing document in advance of the Student Privacy Initiative’s April 2013 workshop, “Student Privacy in the Cloud Computing Ecosystem,” to provide a high-level overview of two of the major federal legal regimes that govern privacy of children’s and students’ data in the United States: the Children’s Online Privacy Protection Act (COPPA) and the Family Educational Rights and Privacy Act (FERPA).

This guide (downloadable from SSRN here) aims to offer schools, parents, and students alike a sense of some of the laws that may apply as schools begin to use cloud computing tools to help educate students. Both of the relevant statutes – and particularly FERPA – are complex and are the subjects of large bodies of caselaw and extensive third-party commentary, research, and scholarship. This document is not intended to provide a comprehensive summary of these statutes, nor privacy law in general, and it is not a substitute for specific legal advice. Rather, this guide highlights key provisions in these statutes and maps the legal and regulatory landscape.

About the Cyberlaw Clinic

The Clinic provides high-quality, pro- bono legal services to appropriate clients on issues relating to the Internet, new technology, and intellectual property. Students enhance their preparation for high- tech practice and earn course credit by working on real-world litigation, client counseling, advocacy, and transactional / licensing projects and cases.

About the Student Privacy Initiative

The Berkman Center for Internet & Society’s Student Privacy Initiative explores the opportunities and challenges that may arise as educational institutions consider adopting cloud computing technologies. In its work across three overlapping clusters – Privacy Expectations & Attitudes, School Practices & Policies, and Law & Policy – this initiative aims to engage diverse stakeholder groups from government, educational institutions, academia, and business, among others, to develop shared good practices that promote positive educational outcomes, harness technological and pedagogical innovations, and protect critical values.

This report (downloadable from SSRN here) draws from ongoing Student Privacy Initiative research as well as participant inputs from an April 2013 exploratory workshop, “Student Privacy in the Cloud Computing Ecosystem,” to begin to map the current landscape and connect the often-siloed perspectives of educational institutions, students, parents, and administrators as well as cloud service providers and policy makers.

Following the workshop, the Berkman Center distilled a number of high-level observations that may be particularly critical in informing and catalyzing both future research and action. Some of the key points include the following:

• Expanding educational and knowledge sharing efforts will be integral to engage parents, students, and teachers alongside representatives from a variety of disciplines. These diverse stakeholders may have vastly different baseline knowledge of relevant issues—from cloud computing to privacy concerns to regulatory considerations—and addressing these differences may require a multi-pronged approach. In particular, it will be important to share up-to-date information about rapidly developing educational technologies so that potential users can better understand what data vendors might access and collect as well as what the vendor might do with this data.
• Developing a shared vocabulary and understanding of privacy and technological termswill be central to future research, outreach, policy, and educational efforts. Taxonomies and guides can help to cultivate a shared language and bolster communication and collaboration across educational, commercial, and regulatory settings.
• Good practices and draft standards, especially around contractual practices and terms of service, represent a fruitful area for attention. Stakeholders should enter this space in close communication with vendors and industry representatives.
• Ongoing normative analysis and discussion will be critical in grappling with the many dimensions of the topic and considering how core technologies, opportunities, and behaviors may evolve. In particular, the rapid emergence of data analytics technologies raise important questions about how existing legal frameworks should be interpreted or evolve. This dialogue should be grounded in real-world examples and data, and address open questions such as whether and how cloud technologies support broader educational values and if so, what specific value trade-offs may be involved.

This report offers many more concrete details regarding research, policymaking, outreach, and engagement around student privacy and cloud computing.

By considering norms and values alongside the opportunities for research, policymaking, outreach, and engagement around student privacy and cloud computing in the working road map, the Berkman Center looks forward to continuing the dialogue around this timely and important topic as part of its evolving privacy research agenda.

Cloud-based ed tech facilitates educational innovation — such as new connected learning frameworks — but also poses privacy challenges as more and more potentially sensitive data about students goes into the cloud. In this talk the Student Privacy Initiative team presents recommendations from their recent report, Framing the Law & Policy Picture: A Snapshot of K-12 Cloud-Based Ed Tech & Student Privacy in Early 2014, to guide policy and decision-makers at the school district, local, state, and federal government levels as they consider cloud-based ed tech.

Click here to watch a video of the talk.

As part of its ongoing Student Privacy Initiative, led by Executive Director Urs Gasser, the Berkman Center is excited to offer a new publication, Framing the Law & Policy Picture: A Snapshot of K-12 Cloud-Based Ed Tech & Student Privacy in Early 2014. This analysis, intended to guide policy and decision-makers at the school district, local, state, and federal government levels, first captures the current state of play and then puts forward pragmatic recommendations that aim to protect student privacy while harnessing the generative potential of cloud-based ed tech.

You may also be interested in our previously published reports and guides, including a synthesis of prioritized open issues and recommended next steps in the K-12 ed tech space, Student Privacy & Cloud Computing at the District Level: Next Steps and Key Issues; a survey of the kinds of cloud computing technologies (categorized by the affordances each offers) that may be adopted in K-12 educational contexts, K-12 Edtech Cloud Service Inventory, and a research brief that presents empirical data on student privacy attitudes drawn from a series of nationwide focus groups, Youth Perspectives on Tech in Schools: From Mobile Devices to Restrictions and Monitoring.

The Student Privacy Initiative team looks forward to continuing to develop additional materials in the months to come, with an eye not only to conducting legal analysis and producing practical resources on existing laws, policies, and practices, but also to considering privacy and ed tech opportunities and challenges that may lie ahead and creating shared good practices that both bolster privacy and preserve space for innovation as the educational sector continues to evolve.

About the Student Privacy Initiative

The Berkman Center for Internet & Society’s Student Privacy Initiative, led by Executive Director Urs Gasser, explores the opportunities and challenges that may arise as educational institutions consider adopting cloud computing technologies. In its work across three overlapping clusters – Privacy Expectations & Attitudes, School Practices & Policies, and Law & Policy – this initiative aims to engage diverse stakeholder groups from government, educational institutions, academia, and business, among others, develop shared good practices that promote positive educational outcomes, harness technological and pedagogical innovations, and protect critical values.Please visit http://cyber.law.harvard.edu/research/studentprivacy for more information about the project.

About the Berkman Center for Internet & Society

The Berkman Center for Internet & Society at Harvard University is a research program founded to explore cyberspace, share in its study, and help pioneer its development. Founded in 1997, through a generous gift from Jack N. and Lillian R. Berkman, the Center is home to an ever-growing community of faculty, fellows, staff, and affiliates working on projects that span the broad range of intersections between cyberspace, technology, and society.

More information can be found at http://cyber.law.harvard.edu.

Contact

Please contact Student Privacy Initiative Team Member Paulina Haduong at phaduong@cyber.law.harvard.edu with questions or media inquiries.

Authored by Leah Plunkett, Alicia Solow-Niederman, Urs Gasser

Download (SSRN)

A growing number of primary and secondary (K-12) school systems nationwide are adopting cloud-based educational technologies (“ed tech”), tools which “enable the transition of computing resources—including information processing, collection, storage, and analysis—away from localized systems (i.e., on an end user’s desktop or laptop computer) to shared, remote systems (i.e., on servers located at a data center away from the end user accessible through a network)” in the course of educational and / or academic administrative work. Cloud-based ed tech possesses unique innovative potential that can best be unlocked when the opportunities it presents are considered alongside the importance of protecting student privacy.

This paper, building upon findings of the ongoing Student Privacy Initiative under the auspices of the Berkman Center for Internet & Society at Harvard University, provides a snapshot of key aspects of a diverse—and heated—law, policy, and implementation debate that is taking place in the rapidly evolving cloud-based ed tech landscape. It aims to provide policy and decision-makers at the school district, local government, state government, and federal government levels with greater information about and clarity around the avenues available to them in evaluating privacy options. This analysis focuses on three overarching questions: who in the educational system should make cloud-based ed tech decisions; when is parental consent needed for the adoption of these technologies; and how can data transferred, stored, and analyzed through these products be kept secure and, as necessary, de-identified?

Though there is often no bright line rule that can strike an ideal balance of these and other imperatives—including normative commitments, innovative educational opportunities, and evolving privacy attitudes and expectations—the authors offer the following pragmatic recommendations based on the cloud ed tech landscape at this moment in time:

1. Employing (temporary) centralization of cloud-based ed tech decision-making at the district level to foster the legal, technical, and other expert oversight necessary in this complex space without stifling capacity for local experimentation;
2. Examining the adoption of user-friendly labeling of cloud-based ed tech products to increase transparency and encourage compliance with parental consent and other legal requirements; and
3. Adopting FIPPs (Fair Information Practice Principles) and other best practice standards by industry providers to increase data security and protection.

Critically, any such recommendations must preserve room for future development as the student privacy and ed tech picture continues to evolve. The authors also recognize that the proposed practices are in flux and have to be read as a supplement rather than a substitute for careful consideration of more fundamental reform of the current student privacy framework.

“With the help of the Cyberlaw Clinic, the Consortium of School Networks (“CoSN”) has released the Protecting Privacy in Connected Learning Toolkit. The toolkit, issued in March as part of CoSN’s new Protecting Privacy in Connected Learning initiative, provides an in-depth, step-by-step privacy guide is to help school system leaders navigate complex federal laws and related issues…”

The original article can be found here.

“On Friday, March 21, 2014, the Consortium of School Networks (“CoSN”), with the help of the Cyberlaw Clinic, released an in-depth, step-by-step privacy guide — the “Protecting Privacy in Connected Learning Toolkit” — to help school system leaders navigate complex federal laws and related issues…”

The original article can be found here.

“At the start of this year, the President Barack Obama administration made a New Year’s resolution for schools nationwide.  It urged them to drop the “zero tolerance” approach to discipline, joining a growing chorus of critics of  policies that dispense serious punishments for small rule violations…”

The original article can be found here.

“Education technology, used wisely, has the potential to transform learning for any child, anywhere. As our nation’s schools embrace the vast potential of educational technology to enhance and personalize learning, they must ensure that students’ personal data is protected. Through online platforms, mobile applications, and cloud computing, schools and edtech providers collect massive amounts of sensitive information about students – information that needs to be kept out of the hands of non-educational, commercial interests and other third parties.”

The original article can be found here.

• Student Privacy & Cloud Computing at the District Level: Next Steps and Key Issues: This report offers recommended next steps and prioritizes open issues in the K-12 edtech space, with a special emphasis on two topics: (1) law and policy and (2) norms, values, attitudes, and practices, as well as an overarching eye to opportunities for collaboration. It builds from and reflects upon a conversation co-organized by the Berkman Center for Internet & Society’s Student Privacy Initiative and the Consortium for School Networking. At this meeting, policymakers and educational technology thought leaders came together to emphasize the view “on the ground” as seen from the district level and identify specific resources for potential inclusion in a toolkit for diverse stakeholders considering the adoption and impact of cloud technologies in K-12 educational contexts.
• K-12 Edtech Cloud Service Inventory: Created for and informed by a co-organized Berkman Center and Consortium for School Networking working meeting, this document aims to provide individuals with a non-technological background with a more concrete survey of the kinds of cloud computing technologies (categorized by the affordances each offers) that may be adopted in K-12 educational contexts.
• Youth and Media Research Brief, Youth Perspectives on Tech in Schools: From Mobile Devices to Restrictions and Monitoring: This research brief, prepared by the Berkman Center’s Youth and Media project for the co-organized Berkman Center and Consortium for School Networking working meeting on student privacy and cloud computing, presents empirical data on student privacy attitudes drawn from a series of focus groups conducted across the country between February and August 2013.

You may also be interested in our previously published reports and guides, including an initial report, Student Privacy in the Cloud Computing Ecosystem: State of Play & Potential Paths Forward, and a legal analysis of COPPA and FERPA, Privacy and Children’s Data: An Overview of the Children’s Online Privacy Protection Act and the Family Educational Rights and Privacy Act.

We look forward to continuing to develop additional materials in the months to come, with an eye to conducting legal analysis and producing resources for the March 2014 CoSN Annual Conference (after which an updated toolkit with materials targeted at district-level stakeholders will be made publicly available), while also engaging in ongoing collaboration, conversation, and research across both the law and policy and norms, values, attitudes, and practices clusters that have emerged from our initial gatherings.

Please contact Student Privacy Initiative Project Manager Alicia Solow-Niederman at aliciasn@cyber.law.harvard.edu with any questions or media inquiries.

About the Student Privacy Initiative

The Berkman Center for Internet & Society’s Student Privacy Initiative, led by Executive Director Urs Gasser, explores the opportunities and challenges that may arise as educational institutions consider adopting cloud computing technologies. In its work across three overlapping clusters – Privacy Expectations & Attitudes, School Practices & Policies, and Law & Policy – this initiative aims to engage diverse stakeholder groups from government, educational institutions, academia, and business, among others, develop shared good practices that promote positive educational outcomes, harness technological and pedagogical innovations, and protect critical values.

Please visit http://cyber.law.harvard.edu/research/studentprivacy for more information about the project.