FERPA Complaint to US Dept of Education that DOE violates student privacy by disclosing personal student information to charters without parental consent.

Today's press release is posted here.

See the FERPA complaint below to the US Department of Education, filed on Monday by Johanna Garcia, President of Community Education Council in District 6, challenging the DOE's  right to provide her child's personal information to charter schools without her consent for the purpose of recruiting and marketing their schools. 

In her complaint, Johanna questions whether charter operators are receiving students' test scores, grades, English learner and/or disability status from DOE in addition to their contact information,  based on her personal experience with the selective charter recruitment of her three children. More evidence for this possibility is also implied by an email that I received from the DOE Chief Privacy Officer Joe Baranello, in response to my inquiry about the legal status of these disclosures.

DOE has voluntarily supplied the contact information for students and families without parental consent to Success Academy and other charter schools since at least 2006 and perhaps before, as revealed in emails FOILed by reporter Juan Gonzalez in 2010 and cited below.   

As Eva Moskowitz wrote Klein in December 2007, she needed this information to "mail 10-12 times to elementary and preK families"  so that she could grow her "market share."  Attention has been paid recently to Moskowitz' current goal of expanding to 100 charter schools, and her aggressive expansion plans will be facilitated by SUNY's recent agreement to change their regulations, exempting her from teacher certification rules and allowing her to hire teachers with just a few weeks of training to staff her schools. 

Just as critical to her plans for rapid expansion is her ability to send multiple mailings to families for recruiting purposes. In 2010, it was estimated that Success Academy spent $1.6 million in the 2009-2010 school year alone on recruitment and promotion costs, including mailings and ads, amounting to $1300 for each new enrolled student.  The need to do a massive amount of outreach to fill seats is intensified by the fact that only half of the students who win Success Academy admissions lotteries actually enroll in her schools, according to a new study.

In stark contrast to DOE's voluntary and continuing practice of helping charter schools recruit students by providing them with the personal information of NYC public school students, the Nashville school board has recently refused to provide their students' contact information to charter schools, prompting a lawsuit filed against them by the State Education Commissioner.  The Commissioner cites a Tennessee law passed by the Legislature in August that she claims requires the district to share student contact information with charters.  

In response, Nashville attorneys argue that the release of information to charter operators for the purpose of marketing their schools to families is forbidden by FERPA, as this would be a commercial use of the data.  Last spring, a Nashville charter school agreed to pay parents $2.2 million to settle a class action lawsuit against them for spamming them with text messages urging them to enroll their children in the school.

 

In Memphis, the district made robocalls to parents, informing them of how to opt out of potential data-sharing with charter schools for the purposes of recruitment, and 7,700 did.  Last week, their school board voted to join Nashville anyway in defiance of the state's demand, and to deny this information to charter schools for the purposes of marketing and recruitment. 

There is no state law in NY that would require NYC DOE to provide this information to charter schools, and Johanna's FERPA complaint argues that both state and federal privacy law bar this practice without parental consent. Yet DOE has continued to violate student privacy to help charter schools cannibalize our public schools by allowing them to absorb an increasing amount of resources, space and students.  Last year, the DOE budget allocated more than $1.8 billion of operating funds on charter schools, not counting lease costs or space taken up by co-located charters in our increasingly overcrowded school buildings.  

Let us know if you would like to file a similar FERPA complaint against the DOE's practice of supplying your child's contact information to charter schools, by emailing us at info@studentprivacymatters.org 

--Leonie Haimson, Class Size Matters and co-chair, Parent Coalition for Student Privacy

___

 November 6, 2017

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue, SW

Washington, D.C. 20202-8520

By email: FERPA.Complaints@ed.gov

My name is Johanna Garcia.  I am the mother of two children who currently attend NYC public schools; my third child attended a NYC public school until this year. My daughter is named [removed] and is in the sixth grade at [removed] in Manhattan.

Each year my family receives in the mail a large number of pamphlets and flyers from charter schools, promoting and marketing their schools and urging me to apply for my daughter.  Most of the flyers are from the Success Charter network, and some of them are addressed to me as her parent and some in Alexa's name.  I have received these flyers ever since my daughter was in second grade. 

It has been the practice of DOE to provide mailing labels to charter schools, and to allow them to target specific students by grade and neighborhood since at least 2007 and perhaps before. For evidence of this fact, see the December 2007 communications between former DOE Chancellor Joel Klein, Eva Moskowitz, CEO of Success Academy charter schools, and Michael Duffy on p. 24-25 of the FOILed document here: http://tinyurl.com/yap5bsg8

According to the document above, on December 21, 2007, Ms. Moskowitz emailed Chancellor Klein, asking for the ability to access the mailing addresses of students other than merely first graders attending NYC public schools, which was apparently allowed her at that time, and to send out mailings more than once a year: "As I believe you know, I have tried in the past to get the DOE to fully institutionalize one of your significant innovation, namely allowing charter schools to make school choice a reality by using DOE's mailing labels.  Unfortunately to truly market to families, we need to be able to mail 10-12 times to elementary and preK families."

Ms. Moskowitz requested the ability to access the names and mailing addresses of public school students in many different grades, to target them geographically, and to "mail multiple times from Tweed [the DOE headquarters.]"  Limiting her to one mailing per year and to students in only one grade "makes market share significantly more difficult," she wrote.

In response, on December 26, 2007, Michael Duffy, then Executive Director of the DOE Office of Charter Schools, wrote the following:

In recent years, I had assumed that the DOE had determined that the "hurdles" of privacy law could be overcome through the Directory information exception in FERPA, as charter schools would not fit under any of the other FERPA exceptions for nonconsensual disclosure.

Yet never have I received any notice from DOE of my rights under FERPA, including my right to opt out of the disclosure of this Directory information, as the law requires. Nor have I been told which categories are considered Directory information by DOE, as is mandated if a district utilizes this exception for non-consensual disclosure of personal student information according to FERPA.

More recently, however, I was forwarded an email from the NYC Department of Education Chief Privacy Officer, Joseph Baranello, claiming that instead, DOE allows charter schools to receive this information from DOE without parental consent as a result of the "school official" exception under FERPA.  In an email sent on Nov. 3, 2017, to Leonie Haimson, co-chair of the Parent Coalition for Student Privacy, Mr. Baranello wrote as follows:

" ...with respect to your inquiry concerning mailings related to charter schools, the DOE discloses mailing addresses of DOE families to its contracted vendor under FERPA’s “school officials” exception. As you know, under this exception FERPA permits the DOE to share personally identifiable information with outside parties performing institutional services or functions for which the DOE would otherwise use its own employees.  In addition, this exception requires that there exist legitimate educational interests in the information. The educational interest in this case is the need to inform families, especially those who are hard to reach, of available enrollment options."

Under FERPA, the "school official" exception is defined as an employee of the educational agency or a contractor or vendor to whom the school has outsourced institutional services or functions that it would otherwise perform for itself.

While the mailing house could be designated as a "school official" and receive student personal information, this would be allowed only for the purpose of sending mailings on behalf of the district.  It would be impermissible under FERPA for a "school official" to perform these services on behalf of another vendor or organization, as is occurring in this case.  Under the same specious argument, DOE could rationalize providing students' personal information via a mailing house to a private school, a tutoring company, or a company that produces educational software or sells textbooks for them to use to send marketing or promotional materials to parents, which DOE might argue could have an "educational interest" for this information.  This would be a clear violation of FERPA's intent.

In no manner could charter schools be defined as “school officials” themselves, and be eligible to receive non-consensual disclosure of personal student information from DOE, because they perform no functions or services for the district.  In fact, quite the opposite, as charter schools divert resources and students from the district.

In addition, according to FERPA, whoever is designated as a "school official" by DOE and thus eligible to receive personal student information without parental consent must be under the "direct control" of the district, meaning that there must be a written contract, service agreement or terms of service that explicitly restricts the use of the information for a specified purpose.  Charter schools are decidedly not under the "direct control" of the district, and there are no such contracts or written agreements between DOE and charter schools restricting the use of this information, as far as we know.

Finally, a district that allows third parties to obtain access to personally identifiable student information under the "school official" exception must include in its annual notification to parents of their FERPA rights its criteria for determining who constitutes a “school official” and what constitutes “legitimate educational interests." 

The annual notification of a parent's rights under FERPA to NYC parents is ostensibly provided in a booklet that was sent to principals at the beginning of the year, called “Achieve NYC: A Complete Guide to New York City Public Schools,” though many parents say they never received the booklet nor any notice of it, which in itself represents another violation of FERPA.

This 46-page booklet, found at http://schools.nyc.gov/ParentsFamilies/AchieveNYC/default.htm  says the following on p. 42 about who the district defines "school official" under FERPA, and thus eligible to receive personally identifiable student information without parental consent:

People whom the DOE engages to perform services or functions for which

it would otherwise use its employees. These include (a) contractors, (b)

agents, (c) consultants, (d) employees of other government agencies

providing DOE-related services or functions, (e) parents, students, or

other volunteers assisting another school official in performing his or

her tasks. Such people are required to be under the direct control of

the DOE with respect to the use and maintenance of personally identifiable

information from education records. Direct control is achieved in various

ways, including but not limited to by written agreement.

There is nothing mentioned in the booklet that would specify that charter school operators could be defined as "school official', as they are not DOE contractors, agents, or consultants, nor are they government agencies providing DOE-related services.  Nor is there any mention of DOE's apparent claim that a mailing house designated as a school official could then in turn use that information on behalf of a non-school official, and redisclose it to a charter school for the purpose of sending their recruiting and marketing materials to parents.

What is especially troubling is that according to FERPA, under the "school official" exception, unlike the "Directory information" exception, an education agency is allowed to non-consensually disclose any detail in a student's educational records, including their test scores, grades, or disability status, to a third party presumed to need access to that information.   

In the continuation of the email quoted above from the NYC DOE Chief Privacy Officer to Leonie Haimson, Mr. Baranello wrote the following:

"The educational interest in this case is the need to inform families, especially those who are hard to reach, of available enrollment options.  This is also especially important given the Education Law's emphasis on charter schools recruiting and serving students with disabilities, English Language Learners, and students who are eligible for free and reduced-price lunch, to help ensure that charter schools are not selective in whom they provide their applications to." (emphasis added.)

This implies that the DOE may not only be providing the names, grades and addresses of public school students to charter schools, but also identifying which of them may have disabilities, are English Language Learners, or receive free or reduced-price lunch, which would be an even more serious violation of their right to privacy.  

While I have three children who currently attend NYC public schools, I have received mailings from charter schools only in the name of my daughter, who is the only one of my three children whose test scores qualified her to enroll in a citywide gifted program, though she did not enroll in one. I cannot conceive of how the charter school could distinguish between my three children unless they also received information from DOE about their test scores, including that my daughter scored high enough to qualify for a gifted program, or that my other two children have IEPS, which would essentially allow them to recruit students according to their academic ability.

In any case, the ability of charter schools to access the personal information of public school students without parental consent would be illegal and particularly egregious, given the manner in which charter schools are governed by private corporate boards that resist any efforts to make their practices transparent and accountable to the public.

I also believe that the DOE's nonconsensual provision of students' personally identifiable information for the purpose of allowing charter schools to send promotional pamphlets and marketing materials to their families violates NY state privacy law, § 2-d. Unauthorized release of personally identifiable information.  This law, passed by the Legislature in 2014, bars schools and districts from releasing "a student's personally identifiable information ... for any commercial purposes."  Disclosing a student's name, grade and address to charter schools for the purpose of sending promotional literature to their parents and thereby enabling them to expand their "market share" would be a commercial purpose, and thus barred by state law. 

In addition, the DOE booklet posted online and quoted above does not link to the current list of personal student data elements that the district discloses to the state, as required by state law, but a different list of data elements collected in 2014, shortly after the law was passed.

Thus, I am copying this complaint to the Chief Privacy Officer of the NYS Education Department urging her to take action as well.

Please inform the NYC DOE that they are in violation of federal law, since charter schools cannot be defined as "school officials" eligible under FERPA to receive personally identifiable student information without parental consent, either directly from the district or through a third-party mailing house.  The DOE must immediately cease providing personally student information to charter schools for recruiting and marketing purposes, without first receiving their parents' consent. 

DOE must also inform parents of their FERPA rights, and to be informed of the list of personal data elements that the district currently discloses to the state, as required by state law.

The Chancellor of the NYC Department of Education is Carmen Farina; her address is 52 Chamber St., New York, NY 10007

Yours sincerely,

Johanna Garcia

[address, phone, email removed]

I certify that the information I have provided is true to the best of my knowledge and belief.

Cc: Privacy@nysed.gov

Temitope.Akinyemi@nysed.gov

CPO@mail.nysed.gov  

data‐security@schools.nyc.gov

Info@studentprivacymatters.org

Regent.rosa@nysed.gov

Commissioner@nysed.gov

ddromm@council.nyc.gov