The Student Privacy Protection Act That Doesn’t Protect Student Privacy

The Student Privacy Protection Act (H.R. 3157 in the 114^th Congress) (SPPA) is an attempt to update the 1974 Family Educational Rights and Privacy Act (FERPA) and to repair at least some of the damage caused by the 2012 regulatory changes[1] that gutted many of FERPA’s protections for personally identifiable information (PII), in flagrant disregard of congressional intent.[2] While SPPA contains some positive changes, such as removing the language allowing data for “predictive testing” and improving data-security requirements, many gaps and other issues remain:

SPPA does nothing to stop the invasive expansion of the scope of data collected on children, especially including social emotional learning (SEL) assessments and surveys that were greatly expanded under the Every Student Succeeds Act (ESSA). This is because SPPA allows nonconsensual data use for audits and evaluations of any federal, state or local education program, including those in ESSA.

Releasing PII without consent is an egregious violation of human research ethics.[3]

The list of exceptions to parental-consent requirements for researchers and government entities remains disturbingly large, with no good definition of “legitimate educational interest.” This allows anyone, including corporations and “volunteers” using those magic words, to gain access to the mother lode of student data without the inconvenience of obtaining parental consent.

SPPA grants no private right of action for students and families harmed by misconduct of researchers or corporations that misuse student data or are responsible for data breaches. Penalties for misconduct go to the federal government for “technical assistance” instead of to the aggrieved students and families whose privacy or lives can be and have been seriously harmed by this data free-for-all.[4]

Under the American system of limited government, student privacy and parental consent should always be considered pre-eminent over the research desires of the government or private sector, especially in the realm of psychological profiling.

The federal government should not be using any data — and especially SEL data — to “improve learning,” because the federal government has no constitutional authority whatsoever to be involved in education.

There is no need for continued data collection and invasion of privacy, because the research is already conclusive that federal education programs “protected” by FERPA are utterly ineffective. This is true of ESEA, Race to the Top/Common Core, Investing in Innovation, Head Start, and home visiting, to name just a few.[5] Federal involvement in education has been a disaster, and no amount of data will overcome institutional incompetence.

[1] https://www.gpo.gov/fdsys/pkg/FR-2011-12-02/pdf/2011-30683.pdf

[2] https://epic.org/privacy/student/EPIC_FERPA_Comments.pdf

[3] https://epic.org/apa/ferpa/Public%20Comments%20Pt.%203.pdf – See page 4

[4] https://edworkforce.house.gov/UploadedFiles/Rachael_Stickland_Written_Testimony_-_FINAL.pdf

[5] References for these claims are compiled at: http://edlibertywatch.org/wp-content/uploads/2017/07/Final-Letter-to-Committee-chairs-7-17-.pdf