Research: Transparency and the Marketplace for Student Data

A new – and important – multi-year study by researchers at Fordham Center on Law and Information Policy has just been released today. 

The research team, consisting of  N. Cameron Russell, Joel R. Reidenberg, Elizabeth Martin, and Thomas B. Norton, assisted by Fordham Law students Samuel Borenzweig and Noelle Park, investigated a number of critical questions related to how data brokers obtain and market student data.

Noting the commercial availability of lists with student data based on factors such as ethnicity, affluence, religion, and/or other factors, one of the key goals of the study was to attempt to identify the sources of information obtained and sold by student data brokers. As part of their methodology, they reviewed publicly available records, made public records requests to school districts, and collected marketing materials that had been sent directly to students. And to mimic what concerned parents might be able to do or find, much of their investigation was conducted by simulating parental inquiries.

Their findings are both significant and concerning.  Of primary concern, there is an overall lack of transparency in the marketplace, resulting in the investigators being generally unable to determine how the brokers obtained the student information. It may surprise some readers to learn that the information compiled and marketed by the relatively few data brokers that could be identified did not appear to be coming from school districts or released as directory information – at least according to the school districts and states that responded to the public records requests.  As the investigators report, however, obtaining information on how districts deal with “directory information” under FERPA and to whom they may provide it was not an easy task:

First, of the six selected school districts, four fully responded to the open public records requests by September 12, 2017, a date beyond the statutory response period imposed by state public record laws. The New York City Department of Education partially responded to Fordham CLIP’s public records request, but as of February 7, 2018, had not fully responded to Fordham CLIP’s May 6, 2016 request for copies of contracts or agreements providing for the release of student “directory information” during the last 12 months, stating that such request required additional time “due to the volume and complexity of requests [it receives and processes], and to determine whether any records or portions thereof will be subject to redactions permitted under Public Officers Law §87(2).” The other large public school districts Fordham CLIP selected did not require over 20 months to respond to the same request. More concerning from the standpoint of public record transparency is that, as of February 7, 2018, the Boston Public Schools failed to respond to any of Fordham CLIP’s requests submitted to the district on May 10, 2016. 

Regular readers may recall that on numerous occasions, opt-out of directory information advocate Sheila L. Kaplan has tweeted about the NYC Department of Education’s failure to have proper parental notification letters about opt-out. Not only do they not provide proper notice, it appears, but then they do not even respond timely to public records requests about what they do with that “directory information.”

With respect to their inability to determine sources of student data, despite their diligent efforts, the investigators write:

Large school districts state that they are not selling directory information except to the military and other educational institutions. If student information is not coming from schools, then where is it coming from? Wearing the hat of a knowledgeable and motivated parent or student, and after years of research, Fordham CLIP was largely unable to discover data sources.

Reading the report, it is clear that not only do we not know how brokers are acquiring student data, but there is very little regulation of data brokers who deal with student data.  One exception that the researchers note is California’s Student Online Personal Information Protection Act (SOPIPA), enacted in 2014.  As CLIP investigators explain:

SOPIPA valuably fills a gap between FERPA-covered educational institutions and private-sector vendors and websites servicing schools and K-12 students. However, data brokers already in possession of student data or who obtain such information from sources outside of SOPIPA’s scope possess student data with few constraints.

The researchers make a number of common-sense recommendations for policymakers and regulators:

• The commercial marketplace for student information should not be a black market. Parents, students, and the general public should be able to reasonably know (i) the identities of student data brokers, (ii) what lists and selects they are selling, and (iii) where the data for student lists and selects derives. A model like the Fair Credit Reporting Act (FCRA) should apply to compilation, sale, and use of student data once outside of schools and FERPA protections. If data brokers are selling information on students based on stereotypes, this should be transparent and subject to parental and public scrutiny.
• Brokers of student data should be required to follow reasonable procedures to assure maximum possible accuracy of student data. Parents and emancipated students should be able to gain access to their student data and correct inaccuracies. Student data brokers should be obligated to notify purchasers and other downstream users when previously-transferred data is proven inaccurate and these data recipients should be required to correct the inaccuracy.
• Parents and emancipated students should be able to opt out of uses of student data for commercial purposes unrelated to education or military recruitment.
• When surveys are administered to students through schools, data practices should be transparent, students and families should be informed as to any commercial purposes of surveys before they are administered, and there should be compliance with other obligations under the Protection of Pupil Rights Amendment (PPRA).

The Fordham CLIP research project is already having a positive impact. Vermont legislators, inspired in part by preliminary findings from the study that had been presented to them, enacted a law that not only requires data brokers to register with the state, but also requires that the registration include certain disclosures about the information data brokers possess about minors. That law appears to be the first of its kind in the country.

>>>  You can read the full press release here or access the full CLIP report on SSRN.

And although the investigators thank her publicly and appropriately, I would be remiss if I did not point out how grateful we should all be to Sheila L. Kaplan, whose generosity helped support the Fordham CLIP research. Sheila’s generosity has also helped fund research by the World Privacy Forum that is expected to be published soon.  Sheila has been a long-time advocate for student privacy, spearheading the original Opt-Out movement for student directory information, and working with privacy experts to draft a model bill, Chief Privacy Officer for Education Act. If you are concerned about student privacy, she is a wonderful role model for student data privacy advocacy.