A model Google contract that has strong student privacy protections

Slightly modified from Parent Coalition for Student Privacy blog.

We have received many questions from parents and teachers over the last few weeks concerned about the privacy practices and policies of the various ed tech tools and programs being adopted hurriedly by schools and districts in the wake of the coronavirus crisis. One of the most widely used programs, even before many schools were shut down, was Google classroom or G-suite.

We just received a copy of the model G-suite contract that upstate NY administrators negotiated this fall with Google that complies with NY State's student privacy law, Education § 2-d. Because of the relative strength of this law, New York state received a B-, the second highest grade of any state in our state privacy report card, .

Parents in NYC and elsewhere in the state should ask their districts for a copy of their contract with Google Suite to see if it includes the same or similar privacy-protective provisions. If not, ask why, and whether their district can't simply opt into this one.

If your NY district refuses to make available the contract upon request, you should remind them that they are required to post all contracts online that allow for the disclosure of student data, according the regulations promulgated by NY State Education Department in January.

BOCES model contract with Google – G Suite 19-20 

BOCES district Opt-In – Erie1 9.3.19

Serious privacy concerns with the new Summit/Facebook platform, used in 100 schools across the nation

Our concerns about the open-ended data sharing of the Summit/Facebook software platform was featured on the front page of the Washington Post. This software is in 100 schools nationwide, about two thirds of them public schools. The list is here. Two of the schools are in NYC:  the Bronx Writing Academy in District 9; and J.H.S. 088 Peter Rouget in District 15 in Brooklyn.

Summit is sharing the student personal data with Facebook, Google, Clever and whomever else they please – through an open-ended consent form that they have demanded parents sign.  A copy of the consent form is here.   

I have never seen such a wholesale demand from any company for personal student data, and can imagine many ways it could be abused.  Among other things, Summit/Facebook claims they will have the right to use the personal data “to improve their products and services,” to “conduct surveys, studies” and “perform any other activities requested by the school. ”  

 Here is an excerpt:  

 Summit may collect information that you provide or your child provides directly to Summit, such as contact information, coursework, testing, and grades. Summit also may collect information automatically from browsers, computers, and devices (such as information from cookies and browser and device identifiers in order to remember your preferences)..... Summit may use your child’s information to conduct surveys and studies; develop new features, products, and services; and otherwise as requested by your school or consistent with your consent. ... Summit also may disclose information to third-party service providers and partners as directed or authorized by the school. For example, Summit uses Clever, Facebook, and Google to help develop and improve the personalized learning plan software or to provide related educational services on Summit’s behalf. 

They claim they won’t use the child's personal data for targeted ads (as would be banned anyway in the CA law called SOPIPA) but this is among the only restriction. They say they can sell the data "in connection with a corporate transaction, such as the sale of our Services, a merger, consolidation, asset sale." The one-sided Terms of Service is here; the Privacy Policy is here. 

The Summit platform has never been independently vetted for security protections – or shown to yield any educational benefits, and I believe is a very radical way to outsource instruction and student data to private companies. 

Other reasons that teachers as well as parents should be concerned:

The Terms of Service claims the right to use the intellectual property of teachers in these schools,

including course assignments, etc. and even student work without any recompense: “You Grant Us a non--‐exclusive, perpetual, transferable, sub--‐licensable, royalty--‐free, worldwide License to use content that you post on or in connection with the Services in any manner, media, form, and modes of uses, now known or later developed.”

--Though I’m not an attorney, the Terms of Service seems to explicitly and repeatedly waive any liability  that Summit or FB or any of its partners may have for protecting the data against breaches, complying with state or federal law,  or abiding by their own Terms of Service; 

-- As the Washington Post article points out, the TOS would force any school or party to the agreement (including teachers) to give up their right to sue in court if they believe their rights or the law has been violated, and limits the dispute to binding arbitration in San Mateo CA - in the midst of Silicon Valley, where Facebook and Google presumably call the shots.  This is the same sort of abuse of consumer rights that that banks and credit card companies have included in their TOS and that the federal Consumer Financial Protection Bureau is now trying to ban.

--The CEO of Summit charters, Diane Tavenner, is also the head of the board of the California Charter School Association, which has aggressively tried to get pro-privatization allies elected to California school boards and state office, and has lobbied against any real regulations or oversight to curb charter school abuses in that state.  

- -  Summit says they won't sign individual contracts with school districts or schools, for the    following ostensible reasons, and suggests a legal loophole for states and districts that require such contracts:

Summit Public Schools is unable to sign contracts, MOUs, or other legal documents from other districts, CMOs, or individual schools. Straying from our Summit Partnership contracts would add immeasurable risk to our organization as we are unable to acquire third party validation on different contracts in the way that we did for our own participation agreement. It would not be legally sound for us to enter into two legal contracts with two sets of potentially conflicting commitments for one program.

Some districts that have policies where all third party vendors need to sign one designated contract were able to bypass that requirement given the status of Summit Public Schools as an educational organization rather than a vendor and the nature of the partnership as a free exchange of ideas and services rather than a paid service relationship.

And then they add – presumably to assuage the fears of parents or school administrators:

In order to ensure that our legal agreement meets the high quality demanded by school organizations across the U.S., Summit Public Schools has gone the extra mile to work with one of the best legal teams in the country to draft this agreement. We worked with Jules Polonetsky - CEO of the Future of Privacy Forum, a Washington, D.C.-based think tank that seeks to advance responsible data practices - and his team to review our privacy policies and provide his 3rd party stamp of approval. Straying from the language in our participation agreement would add risk as we are unable to also acquire third party validation on different contracts.

        What they don't reveal is that the Future of Privacy Forum is largely funded by the technology industry and the Gates Foundation, and Polonetsky was a big supporter of inBloom.  (Nevertheless, the sample contract they apparently offered to Kentucky schools did not include the binding arbitration clause, though it limits Summit's liability to $10,000.) 

For these and other reasons, I think parents and students should be VERY concerned.  

In my view and that of many other parents, the explosion of ed tech and the outsourcing of student personal data to private corporations without restriction, like this current Summit/Facebook venture, is as risky for students and teachers as the privatization of public education through charter school expansion.  In this case, the risk is multiplied, since the data is going straight into the hands of a powerful charter school CEO - closely linked to Gates, Zuckerberg and Laurene Powell Jobs, among the three wealthiest plutocrats on the planet.   

Gates has praised Summit to the skies, has given the chain $11 million, and has made special efforts to get it ensconced in his state of Washington; Zuckerberg is obviously closely entrenched in this initiative, and Laurene Powell Jobs has just granted the chain $10 million to launch a new charter school in Oakland.  

I sent the following list of questions to Summit at info@summitbasecamp.org nine days ago, but have received no response.  Others -- especially parents at these schools and/or privacy advocates -- might like to send their own questions or resend mine as well.  And if you are a parent or a teacher at one of these schools, please contact me ASAP at leonie@classsizematters.org  Thanks! Leonie

Questions for Summit:

1.      1. What is Summit’s definition of “reasonable and comprehensive data protection and security protocols to protect student data”?  What does that specifically include in terms of encryption, independent audits, security training, etc?  And where is that in writing?

2.     2.   If my child’s data does breach, what rights would I have as a parent to secure damages?

3.     3.  Does Summit claim unlimited rights to share or utilize my child’s homework and intellectual property without notice or compensation that they are claiming with teacher work in the TOS?

4.      4. Can Summit specifically itemize the companies/organizations that they will share my child’s data with, aside from those mentioned below? 

5.      5.  Are each of these third parties barred from making further redisclosures of my child’s data?

6.      6.  Are each of these third parties, and any other organizations or companies or individuals they redisclose to, legally required to abide by the same restrictions as listed under your TOS and PP, including being prevented from using targeted or non-targeted advertising, and/or selling of data, and using the same security protections?

7.       7. Does Summit promise to inform parents over the course of the year all the additional third parties the company plans to disclose my child’s data to?

8.        8. What is the comprehensive list of personal data Summit is collecting and potentially sharing from my child?  You mention a limited list below, but does it also include my child’s homework, grades, test scores, economic status, disability, English proficiency status and/or race as well? 

9.      9.  The TOS mentions survey data.  Is there any personal data from my child that Summit promises NOT to collect via a survey or otherwise?  Will parents have the right to see these surveys before they are given and opt out of them, or does signing this consent form basically mean a parent is giving up all their rights under the PPRA?

      10.  Why can’t Summit simply give the software platform to schools to use if it is beneficial, along with links to instructional materials, rather than demand as “payment” in the form of all the student information as well?

1   11. Do you promise not to use the information gained to market products directly to students and/or their parents, and are all your partners and/or those they disclose the information to barred from doing so as well?

1   12. The PP says you will use my child’s personal data to develop new educational “products” – what does that mean?  Why can’t you use de-identified data for this purpose?

     13. It also says you will use this data to “communicate with students, parents, and other users.”  What does that mean? What kind of communications will you engage in with my child or with me?

     14. The PP states a parent can “review, correct or have deleted certain personal information”.  Which kind of personal information can I delete, how will I be able to do that and will that stop my child from using the platform?

1    15. The PP also says you will share the data with anyone “otherwise directed or authorized by the school.”  What does that mean? Does my signing a consent form mean that the school can authorize to share this information with ANYONE else, without specifying the sort of third party, for what reason, or without limitation, without informing me or asking for my further consent?

1   16. It says it will send notice of proposed changes to the PP ahead of time to the participating schools; why not parents if you have their contact info?  Shouldn’t they hear this directly from you and immediately if you are considering changes?

     17.  Does Summit consider this parent consent form to mean that parents are waiving the privacy rights of their children under all three federal student privacy laws, including FERPA, COPPA and PPRA?

1  18. The PP says that “FERPA permits schools to share students' information in certain circumstances, including where the school has gotten a parent's' consent or where the organization receiving the student data operates as a “school official.” Summit Public Schools operates as a “school official” consistent with the Department of Education's guidance under FERPA.”  If this is true, why does Summit need to ask for parental consent?  What additional rights does my consent afford Summit that you would not have without consent in terms of the collection, use and disclosure of a student’s personal information?

     19. Summit says that “Participating schools and individual teachers own, and are responsible for, student data provided through the Summit Personalized Learning Platform.” Why don’t students own their own data?

      20. This raises another related question: the Summit Privacy Policy and Terms of Service grants schools and teachers some rights (however limited.) What rights do parents and students have under these conditions?

      21. The TOS says that if schools believe Summit has violated its promises or complied with the law, instead of suing they must submit to binding arbitration in San Mateo CA and are barred from filing class action complaints.  This type of provision has been heavily criticized when banks and credit card companies have included in their consumer agreements, and the Consumer Financial Protection Board is considering restricting their use. Why is this clause any more acceptable in your TOS?

      22. What legal recourse do schools, teachers or parents have if Summit violates the law or its TOS, for example if Summit decides to sell or give away or carelessly store the data given that the TOS  says “UNDER NO CIRCUMSTANCES, INCLUDING WITHOUT LIMITATION, NEGLIGENCE, WILL SUMMIT, ITS AFFILIATES, OR ANY PARTY INVOLVED IN CREATING, PRODUCING, OR DELIVERING THE SERVICES BE LIABLE FOR DAMAGES OR LOSSES” in any case?

      23. In yet another clause of the TOS, Summit requires schools to “agree to indemnify, hold harmless, and defend Summit, and its affiliates, licensors, and service providers, and each of their respective officers, directors, contractors, agents…etc.et. against any and all demands, claims, liabilities, judgements, fines, interest, penalties… etc. including attorneys’ fees etc.” Why the need for so many layers of self-protection and disclaimers of liability?

     24.  What rights does a parent have in general if Summit violates the TOS or the PP?  Are they bound to the binding arbitration clause in the TOS that the school must agree to?

     25.  In another FAQ here, Summit says that it will not sign contracts or written agreements with individual school districts, and if the state requires this under law, districts or schools should try to “bypass that requirement" by claiming that a) Summit is not subject to the law because it is not a “vendor” but an “educational organization” and b) that they should not have to sign a contract because of the “nature of the partnership as a free exchange of ideas and services rather than a paid service relationship.”  But if you are gaining potential economic and programmatic benefits from your access to student data, including using it to build new and better “products” as the TOS states, why isn’t this a commercial relationship bound by state law?  And if this relationship is truly a “partnership” with a free exchange of ideas, why is the TOS so one-sided and seems to protect Summit from any possible liability, and not the school?

Zuckerberg unbound: the impact of his new LLC on student privacy and real personalized learning

Zuckerberg's open letter to his daughter

 I'm quoted in Time magazine and Politico about what the Zuckerberg billions portends in terms ofstudent privacy and real personalized learning.  And check out this wonderful spoof of edtech balderdash from the Institute for Disruptive Innovation and Mark Vander Venal of the Parsimony Institute.  

Tuesday was a startling day for parents concerned about children’s data privacy and the outsourcing of instruction to education technology companies. First was the news that the V-tech breach had exposed the personal data of more than 6.3 million children – rather than the 200,000 that was first described.  

The information exposed for children includes names, gender and birthdates. Security experts who have reviewed the data say that it is possible to link children’s information with their parents’ data, thereby revealing the kids’ full addresses and other information.

Stolen data for the parents includes mailing and email addresses, security questions used for password resets, IP addresses, passwords and download histories…Chat logs between parents and children were also inappropriately accessed, as well as photos of children.

Then the Electronic Frontier Federation filed a FTC complaint against Google for violating the student privacy pledge the company signed the year before.  The complaint alleges that Google is collecting and data-mining the information of students while logged into their Google Apps for Education accounts at school:

While Google does not use student data for targeted advertising within a subset of Google sites, EFF found that Google’s “Sync” feature for the Chrome  browser is enabled by default on Chromebooks sold to schools. This allows Google to track, store on its servers, and data mine for non-advertising purposes, records of every Internet site students visit, every search term they use, the results they click on, videos they look for and watch on YouTube, and their saved passwords.

Google, it is alleged, is using children’s browsing history to improve their products, and not for any educational purposes, as the privacy pledge specifies.  A day later EFF added:

Google has promised not to build profiles on students or serve them ads only within Google Apps for Education services. When a student goes to a different Google service, however, and they’re still logged in under their educational account, Google associates their activity on that service with their educational account, and then serves them ads on at least some of those non-GAFE services based on that activity.

Finally, came the most horrifying news of all: Mark Zuckerberg announced that with the birth of his daughter Max, he and his wife Priscilla Chan would invest 99 percent of their stock in Facebook – worth potentially as much as a $45 billion -- in a new LLC to be spent on “personalized learning, curing disease, connecting people and building strong communities.”

Zuckerberg made it clear that he chose not to put his money into something as old-fashioned as a foundation, because that would be too restrictive.  As he wrote in his letter: “We must participate in policy and advocacy to shape debates. Many institutions are unwilling to do this, but progress must be supported by movements to be sustainable.”  See Bloomberg News for more on the differences between the allowable activities of a foundation and an LLC – including how LLCs are less constrained from engaging in advocacy and explicitly partisan and political activities.

Has the Gates Foundation really been prevented from exerting a huge influence over education policy over the last eight years? If that’s the case, I hate to think what Zuckerberg has in mind.  The mainstream media including the NY Times wrongly called Zuckerberg’s new venture a “charity”; but after witnessing the destruction wreaked on public education by fellow billionaires Bloomberg and Gates, some might call it vulture philanthropy instead. 

In the open letter on (where else) Facebook, Zuckerberg and his wife explained that their version of “personalized learning” is really instruction through computers and pre-packaged software:

“We’re starting to build this technology now, and the results are already promising. Not only do students perform better on tests, but they gain the skills and confidence to learn anything they want. And this journey is just beginning. The technology and teaching will rapidly improve every year you’re in school.”

A student at the Alt School

To explore a little further what this means, witness Zuckerberg’s current investments, including in a $100 million fund to create a for-profit chain of private schools called the Alt Schools, located in the Bay Area and NYC.  Here is a description of the Brooklyn school:  

Every pupil gets their own tablet or Chromebook; wall-mounted video cameras called “superpowers” record children’s learning moments and kiddie confessionals for teachers to review...kids sign in via an app on an iPad at the entry. It’s connected to an online platform called My.AltSchool that tracks everything from a child’s Personalized Learning Plan to allergies.

The schedule changes daily, but midmorning on a recent Wednesday, some 6- to 8-year-olds studied Rembrandt’s “The Night Watch” on their Chromebooks in one corner, while others engaged in writing lessons. … AltSchool, which costs $27,500 a year, operates on the traditional school calendar, but parents are encouraged to take family vacations when it’s convenient for them — perfect for a jaunt to Kyota[sic], Japan, in time for cherry-blossom season or a family trip to Austin for South by Southwest.

Yet schools that operate through online or virtual learning have a very controversial track record. The Alt School model most closely resembles the technology-focused Kunskapsskolan charter school, later renamed Innovate Manhattan, that was established with much fanfare in NYC in the fall 2011,by a Swedish for-profit chain.  Rupert Murdoch, Klein’s future boss, was so enthralled by this model of education that he featured it in a speech to the G8 in May 2011, while rhapsodizing on its profit potential:

“In Sweden, I visited an innovative school known as the "IKEA school." Learning is supported by a "knowledge portal" that contains the entire syllabus. In this school, learning fits the individual student's pace and interests - and the teachers give students plenty of individual attention. This school is possible because of a system that encourages competition by letting parents use public money to choose what schools they think work best for their children. That includes schools that are privately-run and for-profit.” 

There was so much positive buzz about this school that Joel Klein, then Chancellor of the NYC public school system, offered it space in the DOE headquarters so his staff could “learn” from it. By September of 2012 Innovate Manhattan had relocated to Delancey Street on the Lower East Side. By March 2015, a decision had been made to close the school, because of mediocre results, financial problems and difficulty recruiting students. 

Indeed, many tech-focused schools initially promoted as having found the “secret sauce” to revolutionize education, have been followed by disappointment. First, the Rocketship charter schools were immensely praised, before the Dreambox software and learning lab model were exposed as ineffective.  Amplify tablets were publicized aggressively by Joel Klein and Rupert Murdoch until they turned out to be a failure; in September, Murdoch sold the company to a group of private investors, at a huge loss. 

Summit charters were highly regarded by Bill Gates and portrayed as transformational; only now these schools are introducing a whole new suite of software products designed with the help of Facebook engineers, because as it turns out, the previous “blended” technology did not work so well. Not to mention the iPAD disaster in Los Angeles, that led to Superintendent John Deasy’s downfall last year.  

A Rocketship charter "learning lab"

More and more teachers are saying, as this one has, “I gave my students iPads — then wished I could take them back.” As this Virginia educator points out, 

“…teachers of young children know that the chatter in a typical elementary classroom is what makes it a good place to learn. …. They need time to learn communication skills — how to hold your own and how to get along with others. They need to talk and listen and talk some more at school, both with peers and with adults who can model conversation skills. The iPads subtly undermined that important work. My lively little kids stopped talking and adopted the bent-neck, plugged-in posture of tap, tap, swipe.”

And the need to converse and discuss is not true merely of young students. Even the US Department of Education, a vigorous supporter of online learning, had to conclude in its meta-analysis that that “Few rigorous research studies of the effectiveness of online learning for K-12 12 students have been published.” A study released in September by the Organization for Economic Cooperation and Development concluded that “Students who use computers very frequently at school do a lot worse in most learning outcomes, even after accounting for social background and student demographics.” 

The truth is there are NO good studies that show that online or blended instruction helps kids learn, and the whole notion of “personalized” learning is a misnomer, as what it usually signifies is depersonalized machine-based learning.  All software can do is ask series of multiple choice questions and then wait for the right or the wrong answer.  It cannot read an essay or give feedback on how to improve an argument, or help extricate a child from a knotty math problem.  It cannot encourage students to confront all the various angles in a controversy, as happens through debate and discussion with teachers and classmates.  In fact, learning through computers reduces contextualization and conceptualization to stale pre-determined ideas, the opposite of the creative and critical thinking that we are supposed to be aiming for in the 21^st century. 

Moreover Zuckerberg makes additional unsupported claims relating online learning to enhanced equity: “Of course it will take more than technology to give everyone a fair start in life, but personalized learning can be one scalable way to give all children a better education and more equal opportunity,” he writes.   

Note the echoing flattery expressed on the Facebook page of Summit charter schools: “Max has been born into a moment of opportunity. In large part, because of Mark and Priscilla's vision and generosity, she and children around the world will have personalized learning experiences in re-imagined schools. Max's generation will create a more just and equitable society. “

Contrary to these statements, a growing number of studies suggest that a shift to more online learning will likely widen rather narrow the achievement gap – and those children without strong support or direction at home or fairly advanced skills will fall further behind.  As the class size research shows, while all kids benefit from lots of feedback from their teachers, disadvantaged students most need this support and interaction to thrive.   

So far, Zuckerberg appears to have learned little from his disastrous $100 million involvement in Newark schools.  Though he recently wrote he realizes that “It's very important to understand the desires of a community, to listen and learn from families, teachers, elected officials and other experts," he added, "We now better understand why it can take years to build the support to durably cement the changes needed to provide every student with a high quality education."  

Listen and learn from the community, or build support so that community members fall in line behind his vision of what is best for children? His conclusion suggests the latter: “In our ongoing focus on personalized learning, our goal is to work with everyone -- district schools, charters, private schools, teachers, parents, unions and other philanthropists. Everyone benefits from personalized learning and we'll serve students best if everyone is behind the effort.”

This doesn’t sound like a man who has humbly learned from his mistakes. In his letter on Tuesday, he comments, reassuringly: “it will take engaging with communities,” but it is not clear which community he means.  

Is he referring to public school parents, who are understandably apprehensive about having their children spend more time in front of screens,  and averse to ceding control of  their most personal information to data-mining companies? Or does he mean the community of other venture philanthropists and technology mavens with whom he usually socializes -- and who see the public education market as a huge opportunity, and public school parents as a mere annoyance, a potential interference to their grandiose plans?  

Zuckerberg ended his earlier letter,  referring to his own privileged education this way: 

“Change in education takes time and requires a long term focus. We are committed to working to improve public education for many years to come, and to improving our approach as we go. Priscilla and I have been fortunate to have great educations and supportive families and communities. We want to help make a real difference for all children, and we'll keep sharing more about what's ahead.”

Personalized Learning at an Exeter Harkness table

Zuckerberg attended high school at Phillips Exeter Academy, an elite boarding school in New Hampshire, where class sizes are eight to twelve students per class to ensure they can all fit around a special oval table called the “Harkness table.”  Harkness was a philanthropist who gave generously to Exeter in the 1930’s to establish small classes, so that that each individual student had ample opportunity to participate in dialogue, discussion and debate.   

As the school still puts it, “The Harkness table places students at the center of the learning process and encourages them to learn from one another.”  

This is opposite to the computerized instruction that Zuckerberg now proselytizes for and intends to disseminate.  Too bad he didn’t take the right lessons from his Exeter education about what enlarging human potential through philanthropy and “personalized” learning really means.