Connecticut schools need comprehensive protection of student data privacy

An Act C0ncerning Student Data Privacy  (HB 7017), has been placed on the calendar in Hartford as ready for the House. This means that this bill could come up for a vote soon.

I, along with others,  have advocated for the Student Data Privacy Bill since its inception with the vision of providing the children and students of Connecticut with a comprehensive student data privacy bill akin to what many other states have already enacted, but what Connecticut currently is missing.

I thank profusely the state senators and representatives who proposed the bills at the onset of this legislative session. Further, to the co-chairs and full Education Committee I am further grateful for their support and understanding of the need for this law in our state and for passing unanimously by consent the bill out of committee. A truly bi-partisan effort.

There was always the intent to have this bill cover three main areas:

1) Updating loopholes with the Family Educational Rights and Privacy Act (FERPA).

2) Dealing with online and third party vendors who contract with the state and schools who collect student data, and

3) Regulating our state longitudinal data system known as P20-WIN, with transparency, accessibility and protection for the lives contained within it.

This issue is one of national concern. In 2014, 110 student data privacy bills were put forth by 36 states. This 2015 legislative session 41 states have proposed 160 bills related to this topic. In Washington D.C. this topic is also under great scrutiny through several federal actions including updating FERPA and The Student Digital Privacy and Parental Rights Act.

There is a reason for all of this activity both within the states and on the federal level.

Technology moves faster than laws. In schools, college campuses, state agencies, education technology online programs, state assessments and more, information that is collected on students, stored and accessed by outside parties has grown substantially in recent years without the proper safeguards, notifications or penalties for misuse alongside their creation and implementation, as research has concluded. For one such study you may visit here, conducted by the Fordham University Center on Law and Information Policy.

As a result this leaves children’s information available for disclosure without parental consent, without their knowledge, has the potential for misuse by unauthorized parties , and without a breach response law that is applicable to state agencies in Connecticut. Not so in many other states.

While bill HB 7017 is a step in the right direction, it does not yet reach the scope of the original intent and has mostly focused on the third party vendor and online activity component.

It did also put some regulation around the disclosure of directory information, applied the law to contracts with the State Department of Education and the State Board of Education and requires a statement within 48 hours of any misuse of student data.  All are welcome additions by the committee.

To truly make this bill a comprehensive law within the state of Connecticut and in line with what so many other states have already passed I would like to see an amendment to the bill that adds to and makes some changes to the current language in the following four areas: Data ownership, parental access to the P20-WIN data system with a means to correct errors; additional FERPA language and a more thorough breach requirement. Specific language for each of these four items is available here.

Those who would seek to undermine the passage of student data privacy laws as they feel it necessary in order to create innovation in the education market, or to utilize individual level data to “help” students, simply do not understand the mission behind these laws.

That mission being that the safety and protection of the child behind the data must always and forever come first and before any others desire to innovate or capitalize on its use and return disclosure consent solely to the parent or eligible student.

Is this “burdensome” to those who would like access? Absolutely.

These amendments will further strengthen the proposed legislation of the Education Committee and provide the children and students of Connecticut with a comprehensive law that protects the information being collected on them in our state and is in line with what other states have enacted.

These proposed changes and additions allow third party vendors and state agencies the opportunity to ensure their proper handling of the data they collect with ultimate responsibility to safeguard the students behind the data while still having access to de-identified data for research or product development purposes.

Finally, these recommendations permit parents the access they need to ensure the accuracy of the data collected on their children and assures them that the state has taken every measure possible to protect their children’s information with serious consequences for those who would either intentionally or unintentionally misuse that information.

For another state student data law enacted last year in New Hampshire, as but one of many examples I could provide, you may click here.

Quite simply put there is no reason that the children and students of Connecticut should have any less protection of their educational records and data use than the children and students of other states.

Bill HB 7017 provides our state with the great opportunity to provide that protection and be one on par with other states have enacted and align with the federal initiatives underway.

Let us get out in front of this issue and pass a comprehensive student data privacy bill this session with bi-partisan unanimous support.

We can do it!

Jennifer Jacobsen is a long time educator, mother of three, a founding member of Connecticut Unites for Student Privacy and a member of the Connecticut Parental Rights Coalition.