While the protection of private data contained within student records is not a new concern, advances in technology and the accompanying headlines of data breach have caused Congress to reconsider the issue.
The Family Educational Rights and Privacy Act (FERPA) currently protects against the unauthorized disclosure of personally identifiable information (PII) contained within student records. PII includes direct identifying information, such as a student’s name, as well as indirect identifying information, such as date or place of birth.
The role computers and networks play in the operation of schools is profound. Like many industries, the issue of data storage for schools is a significant aspect of the information technology infrastructure. Increasingly, schools (mostly public enterprises) migrate and store data in the Cloud, thus placing PII in the hands of third party (mostly private) business associates. Schools also rely on on-line text books, on-line web applications, and software as a service. Much of this did not exist when President Ford signed FERPA into law in 1974. One survey showed only 25 percent of districts notify parents that its students’ data interfaces with the Cloud.
On July 30, 2014, Congress introduced the Protecting Student Privacy Act of 2014. The proposed legislation would amend FERPA to expressly provide protections for student data in the Cloud. In order to receive federal funding, schools would need to provide access to the names of all third party vendors who have been given possession of PII data and require companies who store PII to provide protection for the data. In addition, schools would be required to implement policies and procedures prohibiting the use of personally identifiable information (PII) for advertising or marketing.
The proposed bill would also require that parents have the right to access PII about their children. While FERPA provides that a school must comply with a student or parent’s request to access a student’s educational record, under the proposed bill, schools receiving federal funding would also be required to implement a process for parents and students to challenge, correct or delete inaccurate or misleading data in a student’s educational record.
Schools would also be required to maintain records of anyone requesting or obtaining access to a student’s educational records. Similarly, the bill would require schools to implement policies for safeguarding student privacy by minimizing the PII released in response to information requests.
The draft legislation also sets forth a time limit on the retention of PII. Thus, schools would be required to destroy a student’s PII when that student ceases to be enrolled at that institution.
Like virtually every other industry, schools must be concerned about protecting PII in the age of mobility, big data and cyber-risk. Because schools are often in the public domain, Congress will be particularly active in enacting privacy protections in the face pressure from its constituency. – See more at: http://www.traublieberman.com/cyber-law/2014/0808/4925/#sthash.iSsraTIS.dpuf
The post Congress Proposes Bill Protecting Student Data appeared first on http://www.cyberinquirer.com/.
