Privacy and Student Data: An Overview of Federal Laws Impacting Student Information Collected Through Networked Technologies

Abstract

Over the past five years, schools have progressively been integrating the use of technology into the classroom, both to help students achieve their goals, and help teachers and administrators alike organize, categorize and track information about students. Specifically, “Networked Services” can be used in a variety of ways to improve school systems, including increasing efficiency in administrative operations to advancing individualized learning through online resources. Though these networked services may be valuable tools, they also have the ability to collect sensitive information about students. To that end, as educational institutions introduce networked services into schools, they must remain alert to growing privacy concerns for sensitive student information.Harvard Law School’s Cyberlaw Clinic, based at the Berkman Center for Internet & Society, has prepared this guide to provide a high-level overview of two of the major federal legal regimes that govern the privacy of children’s and students’ data in the United States: the Family Educational Rights and Privacy Act and the Children’s Online Privacy Protection Act. In addition, this guide covers how the Protection of Pupil Rights Amendment, which, while not as broadly applicable to the use of technology by schools, does include a few provisions that can apply in certain contexts, particularly when schools use technology to administer surveys of student subjects, or use technology that collects information for marketing purposes. While there are other laws that may also apply to schools in this context (e.g. state privacy laws), these three laws have important implications for schools using networked services.The purpose of this document is to provide schools, parents and students alike with an overview of some of the laws that may apply as schools begin to use networked services to help educate students. All of the relevant statutes – and particularly FERPA – are complex and are the subjects of large bodies of caselaw and extensive third-party commentary, research, and scholarship. This document is not intended to provide a comprehensive summary of these statutes, nor privacy law in general, and it is not a substitute for specific legal advice. Rather, this guide highlights key provisions in these statutes and maps the legal and regulatory landscape.