Issues with Florida SB 878 – Common Core Linked Data Warehouse Bill

Issues with Florida SB 878 – Common Core Linked Data Warehouse Bill

Karen R. Effrem, MD – President, Education Liberty Watch

Executive Summary – SB 878 is a huge danger to the data privacy of Florida’s children and their families for the following reasons:

1)      It is being written to comply with the longitudinal data system requirements of the Stimulus bill in general, the Race to the Top grant program, and the No Child Left Behind waivers so that the state can receive funds, not on behalf of the students of Florida and their families.

2)      According to the US. Department of Education, the Common Core related assessments will be assessing students on various psychological parameters, not just on academic issues, so that the assessment in Florida’s K-20 Warehouse will definitely include psychological assessment data.

3)      According to numerous sources, health and psychological data in education records covered by the Family Education Rights and Privacy Act (FERPA) are not subject to the Health Insurance Privacy and Portability Act (HIPPA) privacy protections.

4)      The bill aligns Florida’s data system with the National Center for Education Statistics National Data Model which contains hundreds of data items on each and every child in the state that include both academic and non-academic data, such as religious and political affiliations, mental health data, medical data, bus stop and bus route description, and even DNA sequence.  The federal and state governments have no legal or constitutional right to this amount and detail of information on innocent American citizens, especially since it is being stored without parental consent.

5)      Although the bill language strives to make it appear that privacy is protected by the various provisions that rely on the Family Educational Rights and Privacy Act (FERPA) passed by Congress to protect student privacy, the Obama administration’s weakening of the law via regulation have created broad exceptions to the requirement to obtain parental consent before releasing individual data that many entities including a “contractor, consultant, volunteer, or other party…”  Therefore, this very sensitive, private data will go to outside parties and many government entities without parental consent.

6)      The bill combines the K-20 Data Warehouse with the Department of Economic Opportunity’s Wage Record Interchange System so that all of your child’s personal and private data will follow them not only throughout their academic careers, but throughout their work lives as well.

7)      The U.S. Department of Education is being sued by the Electronic Privacy Information Center because it has so weakened the FERPA. [1] And parents, the PTA and the ACLU in states that are part of the inBloom database that already holds data on millions of children from nine different states[2], are protesting to education officials and seem poised to bring lawsuits in those states.  Florida will be open to this kind of legal action if this bill becomes law.

Detailed Analysis –

1)      This bill is required for Florida to receive Race to the Top grant funds.

From the Race to the Top regulations:[3]

Priority 4: Invitational Priority–Expansion and Adaptation of Statewide Longitudinal Data Systems.

The Secretary is particularly interested in applications in which the State plans to expand statewide longitudinal data systems to include or integrate data from special education programs, English language learner programs,\1\ early childhood programs, at-risk and dropout prevention programs, and school climate and culture programs, as well as information on student mobility, human resources (i.e., information on teachers, principals, and other staff), school finance, student health, postsecondary education, and other relevant areas, with the purpose of connecting and coordinating all parts of the system to allow important questions related to policy, practice, or overall effectiveness to be asked, answered, and incorporated into effective continuous improvement practices.

From Florida’s Race to the Top application[4]:

The Governor or his/her authorized representative assures that the State will comply with all of

the accountability, transparency, and reporting requirements that apply to the Race to the Top

program, including the following:

For each year of the program, the State will submit a report to the Secretary, at such time and in such manner as the Secretary may require, that describes:

• the State’s progress in reducing inequities in the distribution of highly qualified teachers, implementing a State longitudinal data system, and developing and implementing valid and reliable assessment…

 

2)      The U.S. Department of Education admits that it will be important for the Common Core assessments to measure psychological parameters in what they describe as 21^st  Century Skills:

[A]s new assessment systems are developed to reflect the new standards in English

language arts, mathematics, and science, significant attention will need to be given to

the design of tasks and situations that call on students to apply a range of 21st century

competencies that are relevant to each discipline. A sustained program of research and

development will be required to create assessments that are capable of measuring

cognitive, intrapersonal, and interpersonal skills.[5] (Emphasis added)

 

Conclusion 10: There are important opportunities to leverage new and emerging advances in

technology (e.g., educational data mining, affective computing, online resources, tools for

teachers) to develop unprecedented approaches for a wide range of students.[6]

Recommendation 10: Researchers should work closely with technology developers to continue

to explore how to integrate best practices into new and emerging digital learning environments

that are well positioned to promote grit, tenacity, and perseverance, and key psychological

resources (mindsets, learning strategies, and effortful control) for a range of purposes. (Emphasis added)[7]

 

3)      According to expert clinical school psychologist Dr. Gary Thompson and the FERPA federal regulations and other sources, the HIPPA privacy protections for psychological and medical data do not apply to student records covered by FERPA.

“Protected health information EXCLUDES individually identifiable health information in education records covered by the Family Education Rights & Privacy Act (FERPA), as amended 20 U.S.C. 1232 g.”[8]

4)      SB 878 aligns Florida’s data system with the hundreds of data items including many that are non-academic in the National Center for Education Statistics data elements list:

“To promote adoption of a common set of data elements identified by the National Center for Education Statistics to support the effective exchange of data within and across states. (Lines 115-117)”

 

The Data Elements from the NCES include[9]:

Religious Affiliation

Bus Route, Bus Stop, and Arrival Time

At Risk Status

Disease, Illness, or Health Condition

Religious Affiliation

Voting Status

The U.S. regulations[10] associated with the Federal Educational Rights and Privacy Act (FERPA) say that the definition of biometric data includes:

“Biometric record,” as used in the definition of “personally identifiable information,” means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.” (Emphasis added)

To think that the federal government or a private corporation would have access to this type of sensitive data should make everyone think long and hard about allowing this bill to pass.

 

5)      SB 878 uses the phrase “organizations or authorized representatives” at least twelve times in the body of the bill.  Because of the significant weakening of FERPA regulations[11] that occurred in 2011, there are many people who have access to a student and their family’s sensitive individually identifiable information described above. Here is the definition of authorized representative in the federal regulations:

“Authorized representative means any entity or individual designated by a State or local educational authority or an agency headed by an official listed in § 99.31(a)(3) to conduct—with respect to Federal- or State-supported education programs—any audit or evaluation, or any compliance or enforcement activity in connection with Federal legal requirements that relate to these programs.”

Then, in the list of exceptions under which schools will release you and your family’s sensitive personally identifiable information, it lists all of the parties that act as authorized representatives or school officials

• § 99.31   Under what conditions is prior consent not required to disclose information?[12]

(a) An educational agency or institution may disclose personally identifiable information from an education record of a student without the consent required by § 99.30 if the disclosure meets one or more of the following conditions:

(1)(i)(A) The disclosure is to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests.

(B) A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official under this paragraph provided that the outside party…(Emphasis added)

 

6)      Lines 247-251 say, “The commissioner shall collaborate with the executive director of the Department of Economic Opportunity to develop procedures for the ability to tie student-level data to student and workforce outcome data contained in the Wage Record Interchange System.”  This means that all of your child’s personal and private data will follow them not only throughout their academic careers, but throughout their work lives as well.

 

7)      Although SB 878 does a good job of protecting data for the web portal that is available to the public by requiring the data to be “redacted or aggregated, or the confidentiality otherwise protected by de-identification, anonymization, or any combination thereof (Lines 272-274),” there is nowhere near that type of protection available in the “self-service, restricted access component of the K-20 data warehouse, called the “Research Engine” (Lines 275-6).”   The problems with this include:

 

a)      The system provides individually identifiable data, including all of the very personal data and more described above, without limitation of any kind (lines 295-297)

b)      The data may be accessed at the “department’s headquarters or by other secure means as agreed upon in writing by the parties (Lines 298-299),” which means that your child’s data could be floating on the internet on lots of different servers.  Once it is passed on, security is far from assured.

c)       Even though the bill requires the researchers to make sure that their data request “falls within permissible uses authorized by FERPA and does not further a commercial, trade, or profit interest” (Lines 306-307), as explained above FERPA is so weakened, that any private company or potentially individual “volunteers” who may have an axe to grind, will be able to get hold of that data.

d)      The written agreement requires the data requestor to list the “FERPA exception relied upon to obtain education records of students which may contain students’ personally identifiable information (Lines 316-318).”  However, as we have seen, FERPA has been so weakened that the list of exceptions is alarmingly large.

e)      Even though there is a requirement to limit “the use of education records of students which contain students’ personally identifiable information to meet only the purpose stated in the written agreement (Lines 323-326),” the problem is that there are no limitations about what kind of data and how they may be used in the written agreement.

f)       Even though the bill requires prohibitions on access to this data by people not authorized in the written agreement (Lines 330-334) there are not really any significant limitations about how the agreement is written in the first place and there is no limit to the number of people that may be allowed access in the written agreement.

g)      Lines 398-405 state that entities wanting to do research under the regulations described by FERPA will have access to the data. As we have seen, because the exceptions listed in FERPA are so broad, there is little to no comfort provided to families seeking to prevent their children’s data from falling into the hands of corporations and multiple government entities.

h)      Lines 418-422 of the bill say, “Access to the Research Engine is not conditioned upon or limited to studies, audits, or evaluations that support the research agenda, interests, or priorities of the State Board of Education, the commissioner, or the department”.  This basically means that anyone that makes a request to the Department of Education combined with the broad exceptions now in FERPA will get access to your child’s and family’s private data.

i)        Lines 423-428 list the authorized representatives who have access to the data “include the Executive Office of the Governor, the Florida Legislature, the Florida Auditor General, the Office of Program Policy Analysis and Government Accountability, the Florida district school boards, Florida College System institutions, and Florida state universities or entities approved by the Department of Education.”  As we have seen with the FERPA exception, those entities approved by the Department of Education can include “contractors,” “consultants,” and “volunteers”.