Privacy advocates say consent 'isn't enough' when it comes to NY student data regs

The New York Board of Regents is considering a change to how it handles student privacy records, and the change, according to at least one privacy advocacy organization that spoke with Campus Reform, could put students’ personal information in the hands of the wrong people. 

The board, according to the Washington Post, is considering changing its privacy regulations to enable the state to release students’ information to third parties with parents’ consent. 

Such a move could enable companies like the College Board, which oversees the SAT, to sell or share students’ private information. 

Under the proposed regulation, educational agencies such as districts and vendors could give student information to third parties as long as there was “consent” from the parents. This would change a section in New York’s privacy laws that state a student’s “personally identifiable information cannot be sold or released for any commercial purposes.”

[RELATED: University demands student org passwords, then backtracks]

A vote on the proposed regulation, according to the article, will be held during the board’s October meeting.

The proposal was finalized in January 2019 through a press release from the state’s Department of Education, which outlined amendments on how companies and third-parties can share student data between one another. The statement also highlighted that requirements would be established, including written agreements, where information could be provided to a contractor or third party. There was also a 60-day public comment period for parents to voice their concerns. 

A powerpoint from January 2019, provided to Campus Reform by the New York Department of Education, highlights that student data now cannot be released “for any marketing or commercial purposes.” The presentation does highlight that educational agencies, such as districts or vendors, could go into contracts with third parties to ensure they are complying with all applicable laws and regulations.

“The proposed amendments outline requirements for educational agencies and their third-party contractors to ensure the security and privacy of such protected information and were developed in consultation with stakeholders and the public.” the statement read.

The Education Department released a revised amendment in July, which addressed concerns with how the term “Commercial or Marketing Purpose” was being used. The response was that when a parent or student requests services from a third party and provides express consent to disclose personal information, it is not considered a commercial or marketing purpose.

One public commenter expressed concerns about the “Bill of Rights for Data and Security Privacy,” to which the board responded that the educational agencies would develop and publish their own “parent’s bill of rights” on their respective websites.

Another commenter expressed concerns about hackers or breaches occurring if agencies published information about contracts on their websites. Several other commenters pointed out problems with issues regarding the safeguarding of data and acknowledgment of federal privacy laws, in which the respondents do not recommend changes to the amendments to accommodate for the concerns.

[RELATED: Emma Meshell sounds off on alleged student privacy violations (VIDEO)]

“Consent actually isn’t enough here — I think the Ivy League admissions scandal shows that for the college-bound hopeful (parents or kids), it’s like expecting victims heading for the ER to be able to meaningfully consent,” Senior Staff Attorney Lee Tien of the Electronic Frontier Foundation told Campus Reform. “That’s certainly driving the College Board.”

The Electronic Frontier Foundation also provided Campus Reform an analysis from 2017 regarding “school-issued devices and student privacy,” which warned that student privacy was “not receiving the attention it deserves.”

Campus Reform reached out to the New York Civil Liberties Union for additional comment but did not receive a response in time for publication.

Follow the author of this article on Twitter: @JesseStiller3