Stakeholders discuss missteps of state student privacy laws

Three years after the Louisiana Legislature passed a law that severely limited the Louisiana Department of Education’s access to student information, the state is now conducting its day-to-day operations and enforcing data security and privacy with greater ease, according to an education official.

From assessments to school lunch programs, the policy changed Louisiana’s business practices, but it also provided an opportunity to improve its protection of students’ sensitive information, said Kim Nesmith, data governance and privacy director for the LDOE. It was not without its challenges, she said during a session at the 2017 STATS-DC Data conference in Washington.

Since 2013, 49 states and the District of Columbia have introduced at least one student privacy bill, according to Amelia Vance, education privacy policy counsel for the Future of Privacy Forum.

“A lot of the state laws that came about were not out of concern for privacy or actual security and privacy risks that have taken place, but because there is a lot of perception concern of a lack of transparency,” Vance said. “We’ve seen a lot of laws that react to the political zeitgeist more than they respond to concrete concerns.”

The biggest lesson Vance said she’s seen is that “words matter” and loose definitions or vague language in state laws have made implementation difficult.

A good example of this is California’s Student Online Personal Information Protection Act, which was passed in 2014 and served as model legislation for other states, Vance said.

The legislation banned targeted advertising to students, but it didn’t specify what targeted advertising is and it didn’t give regulatory authority to the attorney general’s office to specify what targeted advertising should be, she explained.

From ‘reactive’ to ‘proactive’

Vance said she’s observed “a lot of fear-based policies” too, and Louisiana’s student privacy law was among those. The law, which was enacted in 2014, instituted “some extreme reactions like jailing teachers for accidental misuse of data,” Vance said.

Rather than incentivize good data practices, such hefty penalties incited fear and a limited use of data, Vance said.

Nesmith said she agreed. “We’ve had some interesting things happen,” she said. Most notably, the state law made it unlawful to require a student’s social security number for student records, mandating instead that a unique identifier be issued to students. Anyone violating the law was subject to a $10,000 fine and six months of jail time, she said.

“That put some pretty serious restrictions on us, and it really raised the anxiety level and concern in Louisiana,” she said. But it didn’t negate the fact that educators wanted support in this area, Nesmith said.

“With the upsurge in the use of technology, and a proliferation of student privacy laws, we have educators out there who really want help and want guidance navigating the waters of student privacy,” she added. “School systems, schools, they’re all trying to figure out how to handle this. Louisiana is no different.”

‘Intense change’

After two years of what Nesmith described as “intense change,” the LDOE shifted its focus from “reactive” to “proactive” and developed a comprehensive strategy to assist Louisiana’s school system in protecting student privacy, she said.

In June 2016, the LDOE launched an effort to assist school systems in establishing data governance and privacy plans and created a structure for them to operate under.

They established three methods to communicate this information to schools and districts: Louisiana’s Data Governance and Student Privacy Guidebook, regional training, and monthly webinars.

She said the guidebook serves as a “roadmap” for school systems in developing and executing plans to ensure student privacy. It organizes the process of building a data governance plan into six steps:

  1. Know the laws.
  2. Build a team.
  3. Provide training.
  4. Build strong protocols.
  5. Make security a priority.
  6. Involve parents.

Nesmith said that for each step, tools, templates, and exemplars are provided, enabling districts to customize their plan.

Additionally, the guidebook features an overview of federal and state laws along with annotations as to where Louisiana law is more restrictive. “It requires school systems to take added caution,” she said.

Emily Ann Brown covers education technology and STEM education issues for LRP Publications.

Copyright 2017© LRP Publications, Special Ed Connection®