Cloud Computing: A Look at School-Based Practices Today
Increasingly, data we use on a daily basis – including information used by schools to track students and manage resources – are stored in the cloud. Are we doing an adequate job of informing parents and protecting student privacy in this new, cloud-based world? According to a recent study by Fordham University the answer, in many school districts, is NO.
The results of a study conducted at Fordham University were released on December 12, 2013. Cloud Computing and Privacy in Public Schools looked at practices and uses with regards to cloud-based applications in public schools.
The research by the Fordham Center on Law and Information Policy (CLIP) was funded by Microsoft. Researchers looked at school practice, procedures, and policy around cloud computing and the use of school and student data. In addition to providing study results, the Center on Law and Information Policy (CLIP) at Fordham released a set of recommended cloud computing practices for schools.
The schools in the study represent a range of small, medium and large public school systems from many various geographic areas in the United States. School systems were asked to provide the researchers with copies of service agreements, parent communications and technology use policies. This information was then coded to see where practices fell in relation to legal obligations and privacy norms. The study focused on assessing general practices rather than evaluating individual school systems or vendors themselves.
- A significantly large percentage of schools rely on cloud services: 95% of schools used cloud services for a wide range of functions such as student data, classroom activities, financial payment and scheduling.
- Information was loosely governed and poorly understood: Only 25% of school systems inform parents of the use of cloud services. A full 20% of schools lack sufficient policy or documentation regarding the use of online services.
- School systems often surrender control of student information: In fact, 25% of agreements don’t specify disclosure information. Only 7% of contracts ruled out the sale or marketing of student information by vendors. Many agreements allow vendors to change terms. FERPA laws do give schools control over student information when disclosed to vendors.
- Most cloud services contracts do not address parental notice with regards to use of cloud services and student information: When parents are given online access, the terms they agree to can easily differ from the one between the school system and the vendor. FERPA, PPRA and COPPA laws give school systems requirements regarding parent notice and access to information.
As a result of this study, Fordham University’s CLIP offers recommendations for school leaders, vendors and policy makers. These recommendations are made in the interest of student privacy and school district and vendor compliance with existing laws on use of information. (FERPA, COPPA and PPRA)
- Transparency: School districts should post information on the school website about cloud services vendors used and the related privacy and data usage practices. Parents should be provided with notice about services and school systems should facilitate compliance with existing laws.
- Contract Terms: Districts need a way to verify that contracts support them in complying with FERPA and PPRA. A checklist is included in the study to be used by districts in negotiating and finalizing agreements.
- Contract Practices: Districts are clearly advised to request agreements that are complete and specific. By doing so they better preserve legal rights and obligations. Complete documentation is important as schools act as stewards of student information.
- Data Governance: Districts should create policies and plans for staff and teachers in the use of cloud services. Plans should adhere to legal obligations for use of data. Additionally, districts are advised to have ‘chief privacy officers’ who act to implement effective privacy practices in relation to their district data and the use of cloud services.
- Clearinghouse: In addition to the recommendations, CLIP proposes the establishment of a national clearinghouse and research hub geared towards promoting privacy and contracting practices with regards to cloud services.
View the full report: http://ir.lawnet.fordham.edu/cgi/viewcontent.cgi?article=1001&context=clip