Additional UPDATE: According to Hadi Partovi, founder of Code.org, Mark Zuckerberg had nothing to do with starting the organization. Hadi is also in the process of revising the privacy agreement for Code.org.
UPDATE: Turns out NYC DOE intends to work with with Code.org (see below) whose sample contract demands 4-6 years of personal student data.
The huge number of well-funded private interests eager to pirate your child's data or enable others to do so is a many headed hydra which seems to grow new heads every time another is chopped off.
As recently reported in Education Week , the American Legislative Exchange Council (or ALEC), the conservative advocacy group, is jumping on the student privacy bandwagon and has written a “model” bill for state legislators to adopt, based on an Oklahoma privacy bill that was recently passed.
Even at first glance, I realized this bill was inadequate because it doesn’t provide for any parental consent before children’s personal data is handed over to vendors, and noted this to the EdWeek reporter:
Leonie Haimson, a New York City-based parent and public schools advocate, also questioned the wisdom of not providing families more say in whether and how their children’s information is being shared.
“To me, it sounds like [the bill is intended] to assuage the fears of parents who want there to be something done to protect their children’s data, but who aren’t really informed about the issues,” Ms. Haimson said.
Bills that contain more specifics but don’t take as comprehensive an approach have gained some traction in other states. In New York, for example, Ms. Haimson and her nonprofit organization, Class Size Matters, have helped push more-targeted bills crafted to stop the release of sensitive student information without parental consent and to allow parents the opportunity to opt out of data-sharing efforts involving third-party vendors.
Even State Rep. David Brumbaugh, the author of the Oklahoma student privacy bill, admitted as such in the article:
For his part, Mr. Brumbaugh, the Oklahoma lawmaker, said his state’s efforts should be construed as a first step. “We want to shore [students’ privacy] up even more,” he said, pointing to parental-consent provisions as one area where the state could see further action. “This is all new territory.”
Any bill that doesn’t require parental consent before personal student data is shared should not be acceptable to either conservatives or liberals; this is what the federal student privacy protection act known as FERPA required before the US Department of Education rewrote and eviscerated its protections in 2008 and 2011.
Since then I have taken a closer look at the ALEC privacy bill, and see other weaknesses:
- · It wouldn’t prevent states from sharing personal student data with contractors or between agencies without consent;
- · It would enable states to make whatever personal data they please available to researchers;
- · It calls for only such parental notification already required under federal or state law;
- · It would allow for all sorts of involuntary data disclosures for students transferring out of state or “taking a national or multistate assessment”;
- · It would encourage the outsourcing of data to private vendors or organizations, as long as there are unspecified provisions made to “safeguard privacy and security and include penalties for noncompliance”.
Though
the bill also bars disclosure of medical and criminal records, it would NOT bar
the involuntary disclosure of highly sensitive disciplinary or most likely
children’s disabilities and health conditions, as specified in their 504
designations and accommodations.
In
short, nothing in this bill would prevent agencies from doing
everything the NY State Education is currently planning, in sharing extremely
confidential student data with inBloom Inc., without parental consent.
In
short, I suspect that ALEC is merely acting to try to pre-empt stronger bills
that would actually protect student privacy, such as A.6059A and A.7872 passed
by the NY State Assembly last session, and introduced this year in the Senate
as S. 5932 and S. 5930 .This suspicion is reinforced by other
draft education bills being proposed by ALEC this year that would instead
encourage and expand such risky data practices.
See
for example, in this list of draft ALEC bills, the “Student Achievement Backpack Act”: Though
it is promoted as “providing access” to parents of a student’s education
records from K-12, it would provide “a complete learner profile” to
schools and districts, stored on a data cloud and “managed by the State Office
of Education” which would follow “the student from school to school.” Parents
would have no authority over who accessed their children’s data but instead
this would be controlled by the state and district, who could make it available
to anyone they chose “via a web browser.”
The “Student Futures
Program Act” is even more nightmarish -- a “career planning program” that seems
designed to steer students to
appropriate jobs based upon their test scores and other academic data. An
Orwellian “Student Futures Steering Committee"
made up of individuals appointed by the Governor, would “administer and manage Student Futures in collaboration with the
Department of Workforce Services, the State Board of Regents, and the State
Board of Education.”
Then “education providers” and
businesses would be allowed access to an online website that stores the student
data, enabling them to “research and find student users” to whom they can
“promote” their programs” and “market jobs." No mention of any need
for consent, limitations on access to this data, or security or privacy
protections. In fact, the language calls for giving the Student Futures
Committee authority to "control all user data within the system.”
ALEC
is also proposing questionable bills to require states adopt “interactive”
[read: data-mining] software programs, online testing and data collection of
young children starting in Kindergarten, with innocuous titles like “Early
Intervention Program Act” and “Technology-Based Reading Intervention for
English Learners Act.”
Even
though we have up till now focused largely on the dangers represented by the
inBloom mega-data sharing project, it is impossible to ignore that a huge
number of software vendors who are eager to jump into the highly profitable
data-mining arena, with or without inBloom.
For
example, a company called Code.org,
founded by Mark Zuckerberg of Facebook fame as well as other technology
luminaries, is offering free coursework in computer programming and teacher
training to schools in return for four to six years of personal student data:
What
restrictions apply? Few if any:
Use or access to any protected data
obtained as a result of these studies will be limited to representatives with a
legitimate interest in accessing this data, which will include the Entity
Coordinator, school administrators, and other persons who are specifically
authorized by the Entity [Code.org] as having a legitimate interest in
receiving the data.
For
more on Code.org, see ValleyWag, Pando.com and this promotional
video, complete with Bill Gates, the original data pirate
himself. UPDATE: see above, Hadi Partovi is revising the privacy agreement.
Meanwhile, according to Politico, Kris
Amundson, formerly of Education Sector, a Gates-funded think tank, now at the
National Association of State Boards of Education, urged state legislators
last week "to be out in front of that [data privacy] issue before it
comes back to bite you," adding that restricting the collection of
this data is "a proxy to defeat higher standards and better testing"
and "could really have legs.”
It
will be our job as parents and advocates to ensure that the fight against
excessive personal data collection and disclosure does have legs, until the
right of parents to have their children’s information protected from data
predators is secured.
