State Deal To Give Media Organizations Student Data Alarms Privacy Experts

Editor’s Note: This story has been changed to strengthen its focus on student data privacy. The original version, which contained more specifics from an agreement between the state schools office and The Seattle Times, left some of our readers mistakenly believing that their children’s names and Social Security numbers had been released to the Times. While the story did not say that, we want to remove any doubts. The agreement can be viewed below.

KUOW has learned that the Washington state education department has signed agreements to share non-public student data with media organizations including The Seattle Times and The Associated Press.

The state has agreed to release individual staff and student data, but the state schools office and The Seattle Times say that names and Social Security numbers would be stripped out. Still, data security experts say the agreements raise serious privacy concerns for the state’s public school students.

The federal Family Educational Rights and Privacy Act, or FERPA, generally prohibits release of confidential student data without parental consent.

But as schools collect more student and staff data, it’s increasingly being given to outside entities for analysis and storage. That alarms parents and educators, who worry the data could be used to identify their children, fall into the wrong hands or be used for commercial purposes.

Even without names attached to student data, privacy experts say children’s anonymity is not guaranteed.

The Office of the Superintendent of Public Instruction has so far promised the Times individual student and staff data dating from 2009 to this year, including individual students’ test scores on numerous state assessments, grades, school schedules, absences and discipline information. OSPI told KUOW the data would be "de-identified," meaning it would not include names of students or staff.

"Wow," said Seattle Public Schools Superintendent Jose Banda. "I wasn't aware of [this agreement], and I don’t think any of my staff was aware that this was being considered and approved."

"This is really disconcerting for us, because we've been assuring families that we are really mindful about following [data privacy] rules," Banda said.

What do you think about the state sharing individual student data? Share your thoughts on the KUOW Facebook page.

OSPI said the data it planned to give the Times is not available through a public records request, which would not provide data down to the individual student.

"We didn’t ask for any confidential information, and nor do we want any," said Seattle Times investigations editor Jim Neff.

State schools officials said the Times requested the data primarily for its new, grant-funded reporting project called Education Lab.

Seattle Times Deputy Managing Editor Jim Simon said the team requested the student data in an effort to do “deeper, richer analysis of various educational trends in the state” for a range of stories, including looking for schools that are unusually successful.

Simon said he wasn’t sure which stories, if any, would come from the data, or whether the Times would actually look at individual student performance.

But he said access to this level of data is valuable.

“There’s a giant welter of data out there now,” Simon said. “I think it’s really in the public interest to pick that apart a little better and see what trends are actually happening. And I think having that kind of data, and being able to analyze it, is a way to hold the system accountable for the performance of schools.”

Robin Munson, who oversees testing and student information for the state, said the requested data has not yet been given to the Times. She said that by removing the names, the data release would comply with state and federal student privacy laws.

"We still feel there is confidentiality to protect, and that de-identification and the information-sharing agreement that goes along with it helps to protect each student’s privacy," Munson said.

No Assured Anonymity

It takes more than removing students’ names to make them anonymous, said Krish Muralidhar, a professor and data security expert at the University of Kentucky.

It would be "an easy matter" to identify students from the detailed data OSPI plans to release, he said by email, because the more pieces of information you have about people, the easier it is to identify them.

"People often think that once the data is 'de-identified' it automatically assures anonymity. Unfortunately, it does not,” Muralidhar said.

For instance, if there is only one white female special education student in a kindergarten class, removing her name from her educational record does not protect her identity.

The data-sharing agreement "is likely to provide little or no privacy," Muraldihar said. "Like many other data-sharing ideas, this does not sound like one that has been thought through."

Dierk Meierbachtol, an assistant attorney general for the state, acknowledged it may be possible to identify students listed in the data OSPI has agreed to give the Times. That's why the agreement bars the data from being shared outside the reporting team, Meierbachtol said.

"OSPI thinks that’s important, because it does not want this to fall into people’s hands, people who could use the data in an effort to try to [identify] the students using other sources of information that they might have," he said.

State schools officials said that while the student data promised to the Times is not available through a public records request, it is often shared with university researchers and organizations working for a school system.

"In this instance, we consider the Times a research organization," said OSPI spokesman Nathan Olson in an email. "They received a grant, and came to us with a proposal, and established with us their data analysis credentials."

A state education department giving journalists the same kind of access as university researchers is "not common," said Fordham University law professor Joel Reidenberg, who studies technology and privacy and has served as an adviser to the Federal Trade Commission and the European Commission. He reviewed the OSPI/Times agreement for KUOW.

"The federal privacy statute that allows districts to transfer their data for research purposes is really contemplating an education policy research project, the kinds of things that would be conducted by universities or specific research centers," Reidenberg said.

"Here, [the data] is going to a newspaper, which has a variety of commercial interests, and other sorts of interests that you wouldn’t see in the context of a typical researcher," he said.

'Longstanding Consequences'

Reidenberg said the agreement, while unusual, "certainly fits within the national picture, where schools are not properly and fully protecting the privacy of their children."

At the federal level, access to student information has increased in recent years to allow private companies more access to student data. Sen. Edward Markey, D-Mass., wrote a letter to US Secretary of Education Arne Duncan two months ago demanding an explanation for the changes to student privacy law.

"Such loss of parental control over their child’s educational records and performance information could have longstanding consequences for the future prospects of students," Markey wrote.

A study Reidenberg published last week found that school districts now commonly entrust student data to for-profit companies and fail to safeguard children’s privacy.

The OSPI/Times agreement offers little protection, Reidenberg said.

"Suppose the newspaper breaches this agreement," Reidenberg said. "The people who are the victims are the children and their families. They have no recourse. The federal privacy law doesn’t give them a private right of action against the Seattle Times."

Munson of OSPI said that if the Times violated the agreement, her agency would no longer provide the newspaper with individual student data.

Other Agreements

Although OSPI officials did not offer any examples of data-sharing agreements with other news organizations, KUOW confirmed that the agency had a similar agreement in 2011 with The Associated Press. The AP did not end up using the data and the agreement has since expired.

At the Times, Neff said, journalists signed the agreement to expedite the newspaper’s data request.

“As it was explained to me, it got us the records more quickly without tying our hands in any way,” Neff said. He added that the Times’ education journalists believe that student identities should be protected.

Washington State PTA Board President Heather Gillette said her organization doesn’t have a specific concern about student data, but will soon address the subject given parents’ growing interest in data privacy issues.

Rich Wood, spokesman for the Washington Education Association, reacted more strongly. “This is very scary. This could be a tremendous violation of student and teacher privacy,” Wood said.

“A government agency has a secret deal to provide personal and private information about students and teachers to a for-profit organization, a newspaper?” Wood said. "As a parent, that concerns me tremendously, and it also is of concern to teachers and other school employees, as well."

Wood said attorneys for the state teachers union are examining the agreement and considering legal action.

Superintendent Banda said Seattle schools officials are also studying the agreement and want to find out why school districts weren't notified.

Olson said the state has “no formal policy” regarding data-sharing agreements but is revising how it handles such agreements.

In the meantime, he said, OSPI is putting any new requests for data-sharing agreements on hold.