Response to Concerns about the Student Privacy Protection Act – S. 1341 (Full Document)

Karen R. Effrem, MD – President of Education Liberty Watch & Executive Director of the Florida Stop Common Core Coalition

Jane Robbins, JD – Senior Fellow, American Principles in Action

The following is a respectful disagreement with and response to a recent critical analysis[1] of Senator David Vitter’s (R-LA) privacy bill, the Student Privacy Protection Act (SPPA), S. 1341[2]. This bill is the culmination of many discussions and the attentive listening of Senator Vitter with constituents, parents, pro-privacy attorneys and physicians, and others who have spent years fighting the data collection[3] associated with the Common Core standards and aligned assessments and the mental screening of children. Clarification of several misunderstandings about current law and policy will show that this legislation is a major step forward in improving student data privacy and protecting students’ freedom of conscience and freedom from psychological profiling.

Claim:

SPPA will increase psychological screening and profiling: “[Vitter] defines in great detail every aspect of psychological testing, treatment, analysis, and evaluation—the affective domain—that requires permission, and then allows the special education teams to implement the entire affective domain list.”

Fact:

One of the most exciting parts of SPPA, especially for analysts and activists like Dr. Effrem, who has been fighting mental screening and the over-diagnosis and drugging of children as young as infancy for more than a decade[4] , is the prohibition on psychological testing and the strengthening of the Protection of Pupil Rights Amendment.  After defining various terms, the bill does not merely require consent for mental screening and assessment or surveying of psychological attitudes with federal funds (a completely inappropriate federal activity), it fully prohibits psychological screening and profiling. The only exception is for special education evaluations, which is already current law. Significantly, the bill extends the prohibition of psychological screening and profiling to assessments, and thus would also ban the more horrific features of the Common Core assessments.

Here is the key language of SPPA:

‘‘(2) IN GENERAL.—Notwithstanding any other provision of law, no funds provided to the Department or Federal funds provided under any applicable program shall be spent to support any survey or academic assessment allowing any of the following types of data collection via assessments or any other means, including digitally[5] (Emphasis added):

This language protects a long list of affectively related surveying and testing parameters,[6] and is much more protective of students in this area than any other legislation, state or federal, introduced anywhere.

Claim:

The exemption in the Vitter bill allowing social, emotional evaluations under the Individuals with Disabilities Education Act (IDEA) will further expand federal mental screening instead of protecting students from it. Current language in the Protection of Pupil Rights Amendment (PPRA) is adequate to protect students against this screening, and Vitter’s bill weakens PPRA instead of strengthening it: “If Senator Vitter were serious—which it appears he is not—about stopping the data tracking and trafficking of our children, he would shut down the National Center of Education Statistics and the Institute for Educational Sciences. But he hasn’t. He has expanded the affective domain record keeping of our children. Conservative groups are collaborating on this legislation, but they have no idea how dangerous these Vitter words are.”

Facts:

This analysis is problematic for at least five reasons that show that far from being attacked, Senator Vitter should be thanked and congratulated for this bill and everything possible should be done to support it:

1)      PPRA, which requires parental consent before surveying or evaluating students on eight categories of sensitive information[7], contains loopholes that render the privacy protections moot in the case of  curriculum and assessments:

(4) Exceptions

(A) Educational products or services

Paragraph (1)(E) [the eight areas of sensitive information requiring parental  consent for surveys] does not apply to the collection, disclosure, or use of personal information collected from students for the exclusive purpose of developing, evaluating, or providing educational products or services for, or to, students or educational institutions, such as the following:

(iii) Curriculum and instructional materials used by elementary schools and secondary schools.

(iv) Tests and assessments used by elementary schools and secondary schools to provide cognitive, evaluative, diagnostic, clinical, aptitude, or achievement information about students (or to generate other statistically useful data for the purpose of securing such tests and assessments) and the subsequent analysis and public release of the aggregate data from such tests and assessments. (Emphasis added)

The Vitter language to include assessments in the prohibition on psychological testing and screening was designed specifically to close this gaping loophole.  This is also especially relevant because the intent of the Common Core standards and aligned assessments is to psychologically manipulate and profile students (see these statements from U.S. Department of Education (USED) and other national education organization documents[8]):

• “[A]s new assessment systems are developed to reflect the new standards in English language arts, mathematics, and science, significant attention will need to be given to the design of tasks and situations that call on students to apply a range of 21st century competencies that are relevant to each discipline. A sustained program of research and development will be required to create assessments that are capable of measuring cognitive, intrapersonal, and interpersonal skills.” (Emphasis added).[9]
• “There are important opportunities to leverage new and emerging advances in technology (e.g., educational data mining, affective computing, online resources, tools for teachers) to develop unprecedented approaches for a wide range of students.”^[10]
• “In national policy, there is increasing attention on 21st-century competencies (which encompass a range of noncognitive factors, including grit), and persistence is now part of the Common Core State Standards for Mathematics.”^[11] (Emphasis added.)
• “National model standards often contain elements of social and emotional learning. For example, 42 states and two territories are in the process of adopting the Common Core Standards in Math and English Language Arts, which contain standards on communication (especially speaking and listening), cooperation skills, and problem solving.”^[12] (Emphasis added.)
• “ASCA [American School Counselors Association] Mindsets & Behaviors align with specific standards from the Common Core State Standards through connections at the competency level.”^[13] (Emphasis added).
• “There are many other Common Core Standards that these social and emotional basic skills can be integrated with.”^[14] (Emphasis added.)

2)      PPRA already contains the same exception for special education evaluations[15] that the analysis objects to in the Vitter bill. This is not a new plot of some sort by Sen. Vitter.

This is the relevant PPRA language:

(5) General provisions

(A) Rules of construction

(i) This section does not supersede section 1232g [FERPA] of this title.

(ii) Paragraph (1)(D) does not apply to a survey administered to a student in accordance with the Individuals with Disabilities Education Act (20 U.S.C. 1400 et seq.).

3)      Current IDEA law requires parental consent for special education evaluations in all areas, including social and emotional:[16]

This is the relevant IDEA language:

(D) Parental consent.–

                “(i) In general.–

 “(I) Consent for initial evaluation.–The agency proposing to conduct an initial evaluation to determine if the child qualifies as a child with a disability as  defined in section 602 shall obtain informed consent from the parent of such child before conducting the evaluation. Parental consent for evaluation shall not be construed as consent for placement for receipt of special education and related services.

Thus, the IDEA exception in the Vitter bill applies only to consensual data-collection.

There are justifiable concerns regarding Multi-Tiered System of Supports (MTSS), Positive Behavior Intervention and Supports (PBIS), Response to Interventions (RTI), Specialized Student Instructional Support, and Early Intervening Supports. But except for PBIS which is specifically listed in IDEA[17] and is therefore exempted from consent requirements by both PPRA and SPPA, these programs would likely be reined in by SPPA.   This is true because SPPA prohibits any “survey or academic assessment allowing any of the following types of data collection via assessments or any other means, including digitally.” [18] If IDEA allows PBIS and similar programs,    that problem must be fixed when IDEA is reauthorized. No one bill, including SPPA, can solve all the problems with federal education law. Any bill that tries to do so is doomed to defeat.

4)      SPPA actually preemptively prohibits social and emotional research on school children to prevent that expansion in S. 227, the Strengthening Research Through Education Act (SETRA) by Senator Lamar Alexander, about which the organizations of both authors have warned.[19]

Here is the problematic language in SETRA:

”and which may include research on social and emotional learning, and the acquisition of competencies and skills, including the ability to think critically, solve complex problems, evaluate evidence, and communicate effectively. . . ”[20] (Emphasis added).

USED is already in flagrant violation of the Tenth Amendment and probably the Fourth Amendment with the amount of data collected and disclosed on individual children, families, and teachers. The Vitter language stops the federal government from researching the thoughts, feelings, attitudes, and behaviors of free American citizens, especially innocent children:

‘‘(4) NO NATIONAL ASSESSMENT USING PSYCHOLOGICAL DATA

.—No funds provided to the Department or to an applicable program may be used to pilot test, field test, implement, administer, or distribute in any way any federally sponsored national assessment collecting any psychological data or any federally sponsored research on social-emotional data in education. (Emphasis added).

While this does not shut down NCES and IES, it does halt the egregious expansion of those agencies into the realm of affective research in their SETRA reauthorization. .  Efforts to stop SETRA altogether are ongoing.

5)      The Vitter bill contains all of the same important protective elements as the current PPRA statute, and adds “Personal or family gun ownership,” to prevent nosy bureaucrats from snooping into if and how students and their families are exercising their Second Amendment rights.

Claim:

By changing terminology from FERPA’s “student record” to SPPA’s ”student data,” “Sen. Vitter carefully crafts his legislation to ignore the national data tracking and trafficking of student education records collected by the National Center of Education Statistics (NCES) and the Institute for Educational Sciences (IES) for which grants were given to each state to develop State Longitudinal Data Systems (SLDS).”

Fact:

Rather than being an underhanded attempt to allow the collection of more data, the intent is to protect more of the myriad types of data outside of “educational records” that is already being collected without parental consent, especially by third-party vendors. A Politico investigation[21] showed that private corporations have access to up to “ten million” data points on every child and described one company’s efforts:

“Interactive Health Technologies stores multi-year fitness records on students, based on data from heart monitors they wear in P.E., and integrates them with “unlimited data points” from the classroom, including behavioral and nutrition records.”

The term “student record” originated in 1974, when the Family Educational Rights and Privacy Act (FERPA) was first written, and when records were on paper and kept in filing cabinets.  There were no online/digital data gathering, no cloud computing, and no student longitudinal databases.

The idea for the change in terminology came from testimony by Professor Joel Reidenberg, a law professor and privacy expert from Fordham University Law School (to be distinguished from the decidedly pro-Common Core Thomas B. Fordham Institute), who has been one of the few pro-privacy experts to be allowed to testify in Congress, amongst the corporate shills and bureaucrats who want to grab as much student data as possible.  Here is an excerpt from his testimony[22]:

Update the definition of “Educational Record”

FERPA covers “educational records” in a very narrow sense and contemplated only those records that were originally kept in central administration files such as transcripts. The statute also specifically carves out an exemption for “directory information” including a student’s name, address, date of birth, telephone number, age, sex, and weight.

The 1974 definition and the directory information exclusion no longer make sense in 2015. Much of the data gathered and used in the context of online services will be outside the scope of the existing definition. For example, metadata gathered from a learning app used by a child in school that was then compiled to create a profile of the child for content delivery would not be an “educational record” and would fall outside the bounds of FERPA. Similarly, information developed by a school’s transportation company identifying the street corners where 6^th graders wait to take the school bus would fall outside FERPA and could be disclosed for advertising purposes and even possibly disclosed to non-custodial parents. Likewise, a child’s homework assignment saved or shared with a teacher on a third party service would not be an “educational record” and would not be protected by FERPA.

For meaningful protection of student privacy in this environment, FERPA needs to encompass any information gathered about children for educational and school related uses. This would include profiles, whether or not identified to specific students, if those profiles will have an effect on the child’s education or school related services.

This, and not an ulterior intent to expand data-collection, is the reason for the change in terminology.

Claim:

The Obama executive order expanding data-collection and increasing access to sensitive student data will remain in effect in SPPA, and the bill will exacerbate the many problems in the FERPA regulations:

“When referring to Personally Identifiable Information (PII), Sen. Vitter appears to create protections for ‘student data’ and then aligns to the definition already listed in FERPA for PII that allows directory information to be cross matched and is used to identify the individual. Third party contractors and the defined ‘school officials’ still have access to data because of written agreements in the original version of FERPA. Pres. Obama’s Executive Order 12866 still exists, allowing third party contractors to access data by cross-referencing directory information and unique IDs to identify individuals.”

Fact:

When a new law is passed, conflicting regulations under the old law lose their statutory authority and must give way to new regulations under the new. It is true that the Obama Administration may ignore the law and do what it pleases, as it has in many other areas, but that is a fundamental problem that can’t be fixed by the Vitter bill. While there is always more work to do, SPPA goes a long way to rein in third-party contractors and actually imposes financial penalties and allows private lawsuits for data breaches and disclosure of data.  In addition, SPPA requires parental consent for ALL personally identifiable information accessed by third-party vendors, including directory information and student ID numbers[23]:

“(8) LIMITATIONS ON THIRD PARTY USE.—Notwithstanding paragraph (1) or any other provision of this section (not including paragraph (6)), no funds provided to the Department or under any applicable program may be provided to an educational agency (including a State educational agency) or institution that allows any third party (including any contractor or other person acting under direct control of the agency or institution) to access student data of students, including personally identifiable information and directory information, unless—

“(A) the agency or institution receives consent from the parents of the student for the student data to be made available to the third party;

“(B) prior to receiving the consent described in subparagraph (A), the agency or institution provides the parents with notice, not less than 30 days before the records would be provided to such outside party if consent is obtained, that informs the parent—

“(i) of the student data that would be accessed;

“(ii) that the student data will only be made available if the parent consents;

“(iii) that the parent have the ability, under subsection (a), to access the student data of their students held by the agency or institution or outside party, and a description of the process to make corrections for inaccurate data; and

“(iv) that the agency or institution and the outside party are liable for any violation of this section and that the remedies described in subsection (k) are available;   (Emphasis added)

Claim:

SPPA will increase data cross matching: “Cross matching is completely simplified by collecting directory information on your child.  Computer experts will agree, data is flowing.” (Emphasis in original).

Facts:

SPPA requires any data outside the district to be “aggregated, anonymized, and de-identified.”  It also prohibits federal data cross matching, longitudinal tracking, and career tracking.[24]

Claim:

The exemption of teacher-generated individual ancillary data (data that is in the teacher’s sole possession and not accessible or disclosed to any other person)“will further expand data collection, especially the affective data collection associated with special education like PBIS and RTI.”

Fact:

This exemption, which is currently present in FERPA, was designed to allow teachers to write their own private notes about students. PBIS, RTI, and other socioemotional and behavioral data are not covered by this language, because that data is “accessible” and “revealed” to others and therefore not subject to the exception.  Again, any issues of PBIS and RTI that need to be fixed can be addressed in the next reauthorization of IDEA. In the meantime, SPPA actually closes a very large loophole that currently allows that dangerous profiling of the emotions, thoughts, and beliefs of our children.

Look at Who Is Supporting and Opposing SPPA

Perhaps the best indicator of the value of SPPA is the enemies it has drawn. The Data Quality Campaign, which is heavily funded[25] by pro-Common Core groups and anti-privacy corporations that stand to profit from access to our children’s sensitive data, has attacked SPPA and lamented that Sen. Vitter’s “intent is to respond to parents’ concerns” (DQC meant this as a criticism!)[26]. In addition, the American Education Research Association, another group that makes its living on our children’s data, is opposed.[27] AERA’s president said in an email, “This legislation, if it were to pass, would have a devastating impact on the quality of education research.” If this bill were such a boon to third-party data collection, would these major data-collecting organizations be so vigorously opposing the bill?

In contrast, several important conservative organizations (such as Home School Legal Defense Association, Eagle Forum, and Concerned Women for America[28]), in addition to the organizations represented by the authors of this paper, are supporting this bill. None of these groups would participate in writing or supporting legislation that harms the privacy rights of children and families.

One privacy expert (unaffiliated with any of the supportive organizations) said of this legislation, “The Vitter bill is not perfect, but it is the strongest and most authentic educational privacy bill out there. Attacking it the way [this critical analysis] does strikes me as a disservice to our collective effort to restore privacy rights. We can be much more effective in constructively working with Vitter to address any real issues as the bill moves through the process.” We would all do well to heed his advice.

---