| |
Federal Laws Protecting Student Privacy
The Children's Online Privacy Protection Act of 1999
When partnering with companies that provide online resources to students, schools must understand how they might be affected by the Children's Online Privacy Protection Act (COPPA).
COPPA, effective April 21, 2000, applies to the online collection of personal information by commercial web sites from children under 13 years of age. The new rules spell out what a web site operator must include in a privacy policy, when and how to seek verifiable consent from a parent, and what responsibilities an operator has to protect children's privacy and safety online. COPPA applies to individually identifiable information about a child that is collected online, such as full name, home address, email address, telephone number, or any other information that would allow someone to identify or contact the child. COPPA also covers other types of information--for example, hobbies, interests and information collected through cookies or other types of tracking mechanisms--when they are tied to individually identifiable information. (Willard 2000)
Family Educational Rights & Privacy Act (FERPA)
Designed primarily to protect the privacy of students' educational records, the Family Educational Rights and Privacy Act (FERPA) also regulates "directory-type information" about students. FERPA allows directory information to be disclosed without parental consent, but requires schools to notify parents about such disclosures and give them "reasonable time" to request that such information be withheld. A clear summary is provided in the "FERPA Fact Sheet," published by the U.S. Department of Education's Family Compliance Office:
Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school. (U.S. Department of Education Family Policy Compliance Office 2000)
Willard writes:
In accord with the spirit--but not the actual language--of FERPA, schools should also provide disclosure and obtain parental consent before allowing or encouraging students to provide personally identifiable information on a web site while at school. (Willard 2000)
The actual language of FERPA concerning directory information is as follows:
§ 99.3 What definitions apply to these regulations?
"Directory information" means information contained in an education record of a student which would not generally be considered harmful or an invasion of privacy if disclosed. It includes, but is not limited to the student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended. (Authority: 20 U.S.C. 1232g(a)(5)(A)) (34 CFR Part 99, 99.3)
§ 99.37 What conditions apply to disclosing directory information?
- An educational agency or institution may disclose directory information if it has given public notice to parents of students in attendance and eligible students in attendance at the agency or institution of:
- The types of personally identifiable information that the agency or institution has designated as directory information;
- A parent's or eligible student's right to refuse to let the agency or institution designate any or all of those types of information about the student as directory information; and
- The period of time within which a parent or eligible student has to notify the agency or institution in writing that he or she does not want any or all of those types of information about the student designated as directory information.
- An educational agency or institution may disclose directory information about former students without meeting the conditions in paragraph (a) of this section. (Authority: 20 U.S.C. 1232g(a)(5)(A) and (B)) (34 CFR Part 99, 99.37)
SB 290: Student Privacy Protection Act
Introduced by Senators Dodd and Shelby, the Student Privacy Protection Act would require schools to obtain parental consent before allowing commercial companies to collect market-research data from students. Willard recommends that this legislation require schools to give full and adequate notice to parents, and eliminate the element of coercion:
If parents are being placed in a position of being required to provide consent to the profiling and targeting of advertisements to their child as a condition of their child's participation in an activity that is an important component of their education, there is no choice. This is coercion. (Willard 2001)
|
