California DOJ Recommendations For Ed Tech Student Data Privacy, November 2016.pdf

Technology has significantly transformed education by introducing various tools that enhance learning experiences. The U.S. market for PreK-12 education technology (Ed Tech) was valued at $8.38 billion in 2015, according to the Software & Information Industry Association. Ed Tech encompasses a range of applications including administrative management systems, instructional support like testing and assessment, and educational content such as curriculum resources.

Adaptive learning methods, powered by data analytics, offer promising improvements in student education outcomes. However, these advancements also introduce privacy risks due to the sensitive nature of the collected student data, which can include medical histories, social assessments, and test results. Additionally, new types of metadata, like location and device information, are being gathered, raising concerns about existing privacy laws' adequacy.

In response to these challenges, California enacted two significant student privacy laws in 2014. One law targets local educational agencies (LEAs) such as school districts and charter schools, mandating specific contract terms for services that handle student data. The other, the Student Online Personal Information Privacy Act (SOPIPA), imposes obligations on Ed Tech companies.

The Attorney General’s Privacy Enforcement and Protection Unit has developed "Ready for School: Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data." This guide aims to establish privacy best practices within the industry, encouraging a focus on educational purposes while minimizing data collection and usage. The recommendations were formulated with input from various stakeholders, including Ed Tech companies, educators, and privacy advocates.

Highlights of Recommendations

1. Data Collection and Retention: Minimization is Key
- Collect only essential student information necessary for the intended educational purpose.
- Retain student data only as long as permitted or required by schools or districts, avoiding indefinite retention periods.
- Disclose any referrals to external sites from your Ed Tech platform in your Privacy Policy. If you operate these external sites, ensure they adhere to the same privacy and security standards.

These recommendations aim to balance technological innovation with robust privacy protections for students, ensuring that educational advancements do not compromise student data security.