Where in the world is the Smarter Balanced privacy policy?

A few weeks ago I was in Palos Verdes, a suburb of Los Angeles, where I gave a presentation for Restore PV Education, a parent advocacy group, on the Common Core, testing and data privacy.

I spoke about how the PARCC and Smarter Balanced Common Core consortia are collecting loads of highly sensitive personal student information along with test scores. Yet the PARCC privacy policy is remarkably weak, and the SBAC exam given in California and twenty other states has no privacy policy at all-- or at least one that has been made publicly available.

Subsequently, it was reported that more than half of the Palos Verdes High School students opted out of the Smarter Balanced exam the week following my talk. Another article reported that Larry Vanden Bos, the Palos Verdes School Board President, had called the California Dept. of Education to ask for the SBAC privacy policy and received no response:

Vanden Bos said school officials have contacted the office of the state superintendent of schools, Tom Torlakson, to inquire about the privacy policy regarding the SBAC test, but were unsuccessful in getting answers.“We can’t even find out what their privacy policy is,” Vanden Bos said.

A little background: PARCC, the other major Common Core exam consortium,  approved an extremely porous privacy policy in Dec. 2013. I wrote about that policy here. At the time that PARCC released its policy, Smarter Balanced announced they would negotiate separate privacy policies with each of the SBAC states, according to EdWeek:

Smarter Balanced developed a brief data-privacy principle that guides its handling of student data. But beyond that, the consortium will create separate data-privacy agreements with each of its 25 member states to allow each to customize its practice in light of state law, regulation and practice, according to spokeswoman Jacqueline King. Those agreements are expected to be completed in the first few months of 2014, she said.

Yet to this day no parent in any of the SBAC states that I know of has been able to get their hands on such a policy or agreement.

Through the advocacy of Oregon parents, we have received copies of three relevant SBAC-related documents:

1- An undated SBAC “Data Privacy Agreement Communications Toolkit” that appears to have been created in Feb. 2014.
2- The AIR/Oregon contract, dated April 2014. (AIR is the major contractor for SBAC.)
3- The MOU between Oregon and SBAC/CRESST (the institute at UCLA that appears to be collecting, reporting and analyzing the data), from Aug. 2014.

The SBAC Data Privacy Toolkit contains several documents, including:

a) A set of talking points that states are advised to send out to parents who ask about data privacy;
b) A sample press release that states can release if and when they agree on a privacy policy with SBAC;
c) An FAQ with more information;
d) A sample Stakeholder letter;
e) A “resource” page with links to the Gates-funded Data Quality Campaign and US Department of Education documents.

The talking points include the following statement:

“Protecting the privacy, security, and confidentiality of student data is a responsibility we take seriously. And with Smarter Balanced, our state retains control of student information. That’s why [INSERT STATE] developed a written agreement regarding the collection and use of personally identifiable student information.
• This agreement ensures that any organization working on the Smarter Balanced assessments will adhere to strict guidelines to safeguard student information.
• [INCLUDE ADDITIONAL DETAILS OF AGREEMENT AS APPROPRIATE]” etc.

The sample press release includes the following draft language:

SAMPLE STATE PRESS RELEASE
Contact: [INSERT CONTACT INFO]
[INSERT STATE] Approves Student Data Privacy Agreement for Common Core Assessments
Agreement Will Safeguard Student Information, Ensure [INSERT STATE] Maintains Control of Data

The FAQ part of the package includes this:

What type of information WILL Smarter Balanced collect?

• An identification number (the Consortium recommends that this be different from the state’s official unique student identifier so that only the state can link back to a student’s official education record);
• Race/ethnicity, gender, grade level, school attended;
• Student eligibility for English language development services, or special education services provided to the student;
• Student eligibility for Title I compensatory programs;
• Smarter Balanced test scores, achievement levels, and responses to test questions.

If a state elects to have Smarter Balanced generate reports of student assessment results, the consortium also will collect student name and date of birth. States may choose to manage that function through another organization. In either case, states can impose guidelines to safeguard those data.

What information won’t Smarter Balanced collect?
Smarter Balanced will never collect identifying information (such as student name and date of birth) unless specifically directed to do so by a member state. Further, Smarter Balanced will not collect information unnecessary to the assessment system, such as:
• Names of parents;
• Student or parent email address;
• Telephone numbers;
• Student or parent Social Security numbers;
• Parent or student addresses;
• Parent or student medical information.

It also says the following:

Smarter Balanced will not release personally identifiable information. Under limited circumstances, such as for research studies deemed important by states in the consortium, Smarter Balanced may provide access to student data that have been altered so that students’ identities cannot be recognized. Requests for this type of information will be reviewed by member states and each state must individually approve any release of data.

The states of Washington, Nevada, Illinois and others reproduce many of these same talking points but none of them so far have made their privacy agreement with Smarter Balanced public or available to parents upon request– as far as we know.

If you are from one of the SBAC states, please let us know if you've seen it by emailing us at info@studentprivacymatters.org.

If not, I suggest parents should ask their State Education Departments for it and/or FOIL it.  Here are the SBAC contact names and emails in each of the 21 participating states, plus the Virgin Islands and the Indian Bureau of Affairs.  Here are sample Freedom of Information letters for every state and instructions.

The powerpoint I gave to Palos Verdes parents with one slide added is below.  thanks, Leonie

Palos Verdes Presentation Final Revised

What privacy protections are there when states share data with the testing consortia or with the feds?

This year, the issue of student privacy and data sharing has become a huge issue throughout the nation, partly because of the uproar over inBloom Inc., but also as the US Department of Education has pushed states into adopting the Common Core standards and aligned exams, facilitated the widespread disclosure of children’s personal data to third parties without their parents’ consent through weakening FERPA, and required that states track kids from preK onwards via longitudinal data systems.

(Please check out this important story today – about questions surrounding NY state’s longitudinal data tracking system called P20.)

The danger that the federal government may be interested in collecting this data itself has aroused additional concern among parents and privacy advocates.  We noted in an earlier blog post how the agreement between the US Department of Education and the Common Core testing consortia, PARCC and Smarter Balanced, has the same exact clause: 

The Grantee [the testing consortium] must provide timely and complete access to any and all data collected at the State level to ED [the US Dept. of Ed] or its designated program monitors, technical assistance providers, or researcher partners, and to GAO, and the auditors conducting the audit required by 34 CFR section 60.26.

After Joy Pullman of the Heartland Institute and others drew attention to this clause, many parents became even more opposed to their state’s participation in the Common Core testing programs. In order to allay their fears, the Data Quality Campaign, which is funded primarily by the Gates Foundation, undertook a public campaign to convince parents that the feds have no intention of collecting personal student data. 

More recently, an EWA webinar featured Jim Shelton, among others, Deputy Secretary of the US Department of Education and formerly of the Gates Foundation, who appeared to pooh-pooh parent privacy concerns. In the article noted above about NY’s longitudinal student tracking system, Shelton re-affirmed how “valuable” this data is and implied that the risk to privacy is a “small price to pay for progress.” 

The PARCC consortium also produced a privacy policy for the first time, and last week, the education chiefs of 38 states wrote their own letter to Arne Duncan, pledging not to share personally identifiable student data with the feds.  (Why they would write to Duncan rather than their own stakeholders, can’t say.)

Why do I remain skeptical?  Many of these State Ed heads may be here today and gone tomorrow.  We’ve seen a lot of turnover in these jobs; in part because of their highly controversial policies, and many of them, including NY Commissioner John King, have little credibility with parents because of their refusal to disclose how they intend to use student data and their evident lack of respect for parental rights to have input into these decisions.

What the public should be demanding instead is strict controls in federal and state law and in their state’s agreements with these consortia to restrict the amount and type of personal data that they will collect, as well as controls on the access, disclosure and use of this data.

Instead, a careful look at the new PARCC privacy policy merely arouses more concerns than it allays. It appears to have contradictions in whether the organization will ever share its data with the feds. 

First it says: “PII will never be provided by PARCC to the federal government without written authority from a State, or unless legally required to do so by subpoena or court order.”

This seems to suggest that if the state so chooses, it may allow PARCC to provide personal student data to the feds. 

Yet in another section, it says: “These data shall not be used for commercial purposes, nor shall PARCC or PARCC contractors share personally identifiable information with the federal government, unless legally required to do so by subpoena or court order.

Which is it? The second statement leaves out the possibility of federal access of the data if the state permits. 

The mention of prohibiting “commercial purposes” also provides a convenient loophole.  Sharing personal student data for commercial purposes without consent already violates FERPA, but many districts and schools share this data with for-profit vendors, by simply claiming that this is for “instructional” purposes or for more efficient operation.  Clearly the definition of “commercial purposes” depends on the eye of the beholder.

At the same time that the PARCC policy says the data will not be used for commercial purposes, it does say that personal student data may be shared by states to PARCC and contractors for a variety of reasons, including “to validate, pilot and field test, and improve the assessments.” 

 We know that one of PARCC’s prime contractors is Pearson, which is of course a huge multi-national for-profit company; there are also many unnamed sub-contractors. Wireless Generation, a for-profit subsidiary of News Corporation and the prime subcontractor for inBloom, is one of the contractors of Smarter Balanced, the other testing consortium.

The PARCC privacy policy says personally identifiable information (PII) may be accessed and shared with them and their contractors for many other reasons: 

•   to report assessment results back to states and their local education agencies in a form that is useful to them; 

• to prepare reports on student performance for participating states, their LEAs and the public  (PII may not be included in public reports or in reports to states or local education agencies that were not the source of the PII): 

•  to analyze test results to assist member states and their local education agencies for purposes of accountability, including promotion and graduation decisions for individual students; teacher and school leader evaluations; school accountability determinations; determinations of principal and teacher professional development and support needs; and teaching, learning, and program improvement; and 

•  to carry out studies designed to improve instruction on behalf of participating states and their local education agencies, pursuant to separate agreements with the member states and/or their local education agencies. 

Only the last bullet point even seems to require a separate written agreement with states or districts, and none of them require parental notification or consent.  The clause highlighted is particularly open-ended and could lead to abuses in many ways.  Do we really want Pearson or other private corporations gaining access to personal student data to decide which students should be held back or denied graduation from high school; or to make assessments as to which teachers should be dismissed and which should keep their jobs? 

Smarter Balanced, the other testing consortium, does not even have a privacy policy as of yet, though it seems to have been working on a draft that its members could revise according to their individual preferences.

In short, none of this should provide much comfort to parents. In fact, these consortia may end up acting as surrogate inBloom’s, aggregating a huge amount of personal student data and handing it off to subcontractors and vendors for a variety of unregulated purposes, without notification to the public or parental consent. 

All parents should demand to see their state’s individual agreement with these testing organizations as soon as possible, to find out what additional personal student data is being provided to them and what are the restrictions concerning its further disclosure or use. If there is no agreement pertaining to these issues, there needs to be one before field testing begins this spring.