Earlier this month at our Capitol Hill briefing entitled, “Failing Grade: Education Records and Student Privacy,” Senator Ed Markey announced plansto introduce new student privacy legislation. Senator Markey set out four principles his bill would cover: (1) student information may never be used to market products to children; (2) parents must have the right to access and amend student information held by private companies; (3) schools and private companies must safeguard student information; and (4) companies must delete student information after it is no longer needed for educational purposes. Following the Senator’s remarks, I had the pleasure of participating in a lively student privacy discussion with the Department of Education’s Chief Privacy Officer Kathleen Styles, Fordham Law School’s Professor Joel Reidenberg, and EPIC Advisory Board members Dr. Deborah Peel and Dr. Pablo Molina. The Senator’s planned legislation is a very good first step. It could, however, go further. For example, it should provide monetary damages to students if companies violate the law. The legislation should also apply to all students, not just minor students.
We here at EPIC have been ramping up our student privacy project. In December 2013, we filed an extensive complaint with the Federal Trade Commission concerning the business practices of Scholarships.com. The company encourages students to divulge sensitive medical, sexual, and religious information to obtain financial aid information. The company claims that it uses this information to locate scholarships and financial aid. Scholarships.com, however, transfers the data to a business affiliate American Student Marketing, which in turn sells the data for general marketing purposes. We alleged that this is an unfair and deceptive trade practice. Our complaint also alleges that Scholarships.com’s failure to use reasonable security practices is an unfair trade practice. We asked the FTC to require the company to change its business practices. Following our complaint, the company has improved security on its website. Last year, we urged Congress to restore privacy protections for student data following recent changes to the Family Educational Rights and Privacy Act. Pursuant to a Freedom of Information Act lawsuit against the Education Department, we obtained documents which reveal that many private debt collection agencies maintain incomplete and insufficient quality control reports. As government contractors, debt collectors are required to follow the Privacy Act, a federal law that protects personal information. The Education Department also requires student debt collectors to submit quality control reports indicating whether the companies maintain accurate student loan information. The documents we obtained reveal that many companies provide small sample sizes to conceal possible violations of the Act. The documents also show that many companies do not submit required information about Privacy Act compliance to the Education Department.
Student privacy is sure to be a key policy issue in 2014. Please check back on our website and Student Privacy webpage for updates!
For more information visit www.EPIC.org. Defend Privacy. Support EPIC.
