ESSA’s State accountability systems are highly data-driven drilling down to student subgroups. Thus, ESSA’s data requirements address student data privacy and intersect with other Federal laws, namely, FERPA. This article examines the data sets required by ESSA, regulatory requirements for handling student information, and principles of best practice with regard to educational data.

The upcoming school year, 2017-2018, marks a transition into implementation of the Every Student Succeeds Act (ESSA), the law that replaces No Child Left Behind (NCLB). Most States will submit their completed plans to the USDE for review and approval this fall, and the September 18^th due date for submissions is just around the corner. ESSA gives States significant leeway in planning their accountability systems. ESSA’s flexible grant programs provide State and Local Educational Agencies (SEAs and LEAs) with funding streams that provide schools with comprehensive and targeted support and improvement strategies to make sure that “all children significant opportunity to receive a fair, equitable, and high-quality education, and to close educational achievement gaps.” (SEC. 1001. Title I Statement of Purpose, the Every Student Succeeds Act) Unlike NCLB, ESSA shifts authority over K-12 education to the States, yet States must also comply with rigorous Federal mandates for data collection and usage— from public-facing data dashboards produced by the States to Digital Learning programs that facilitates personalized learning experiences through the collection, analysis and use of student data.

Educational data provides States, districts, school leaders, teachers, parents and school partners with valuable information that can be used as feedback to improve upon the tools, strategies, programs, educational content and instructional practices that support student success. While information systems and data reporting creates a culture of continuous improvement, strong data governance principles are essential to safeguard student privacy and identity. The health of student identity depends on strong data privacy policies and best practices at the State, district and local level as everyone who uses student data is responsible for handling student information in a manner that is effective, legal, ethical and responsible.

Federal laws support the effective and ethical use of data in K-12 education, namely, the data-rich requirements of the Every Student Succeeds Act (ESSA) and the implications of student data usage under the Family Educational Right to Privacy Act (FERPA).

ESSA requires that States and districts produce and use high-quality data to inform decision-making leading to improved educational outcomes for all students at the State and local level. First of all, the USDE maintains that ESSA’s data collection and reporting requirements bring about accountability and transparency. State and district report cards offer to “parents and stakeholders the information they need to understand how schools are held accountable and how students, including each subgroup of students, are performing” (USDE, 2016). Secondly, data sets are useful in identifying students’ needs and persistent problems related to school performance in order to close achievement gaps--which is the primary purpose of ESSA, a civil rights law. The Federal government collects data from SEAs and LEAs; that collect students’ data from schools and school districts. Students’ data may also be shared with other agencies and third parties. Thus the need for compliance with Federal regulations and security practices are paramount.

ESSA requires each State to describe a school’s level of performance “on each accountability indicator, from among three performance levels that are distinct, aligned to a State’s long-term goals, and clear and understandable to the public.” Section 200.18(a)(2)-(3) But the new law mandates deeper data sets than NCLB reporting requirements. For example, school districts must now report their per-pupil spending of federal, state and local funds. This level of transparency enables stakeholders to determine whether the district or State investments are succeeding. States and districts must also cross tabulate academic data, such as test scores and graduation rates, so that those conducting research can disaggregate data to certain student groups (e.g. female English language learner). Additionally, the new law requires data reporting to include three additional student subgroups: homeless students, students in foster care, and students in military families. This level of detail aids in developing interventions that targets groups of students and facilitates a more holistic approach versus oversimplified information that does not adequately supply the facts and statistical data necessary to develop an effective improvement strategy.

Moreover, ESSA incorporates the concept of “evidence-based” into the legislation as a way of validating that the activities for which States, districts and schools seek to be funded by grant programs effectively improve educational outcomes and close achievement gaps. Data sets provide evidence that the program or activity is working, and digital learning programs may provide such metrics by collecting data on student performance throughout the instructional program for research purposes.

evidence-based – the rationale for an activity, strategy, or intervention that is based on high-quality research findings or positive evaluation that demonstrates that the activity, strategy or intervention system is likely to improve student outcomes or other relevant outcomes such as school conditions. (Section 8101(21) (A))

States may use Federal funds to construct data dashboards that report school quality to the public in a manner that is easy for parents and other stakeholders to understand. A data “dashboard” is an example of a way for a State to report performance levels for schools and districts that are accessible online. Online data reporting via public-facing report cards enables parents and other stakeholders to review the performance of their local school or district and to get involved in developing solutions for specific school and student needs. Dashboard software, web applications, work by pulling information from different databases and cloud-based sources.

See also ESSA’s Data Privacy Requirements (below) for more information on the disclosure of student information.

What are your data privacy and security concerns over State data dashboards? #StudentDataPrivacy #ESSA2017

How does your State minimize privacy and security concerns related to data dashboards? #StudentDataPrivacy #ESSA2017

State report cards must include:

• Detailed description of the State accountability system
• Schools in need of support and improvement as identified by State methodology
• Student participation rates in assessments
• Assessment scores disaggregated by subgroup
• The number and percentages of students taking alternative assessments
• English language learner proficiency rates
• Student performance on academic indicators
• High school graduation rates
• College and career readiness (i.e. postsecondary enrollment, SAT/ACT scores, etc.)
• Performance level on statewide non-academic indicators (i.e. social-emotional learning,
• Per-pupil expenditures of federal, state, and local funds, including actual personnel costs
• Teacher qualifications including emergency or provisional credential status
• Results from the National Assessment of Educational Progress
• Data consistent with the Civil Rights Data Collection survey

Adapted from: http://www.ascd.org/ASCD/pdf/siteASCD/policy/ESSA-Accountability-FAQ_May112016.pdf

The examples of State Data Dashboards reflect the components of the State plan. These online report cards must include the data sets required by ESSA.

Note: Information collected, included or disseminated in report cards must be collected and disseminated in a manner that protects individual privacy in consistency with section 444 of the General Education Provisions Act, a.k.a. the Family Education Rights and Privacy Act of 1974 (20 U.S.C. 1232g) as well as Section 1111(h)(1)(i)(1) of ESSA.

Visit www.isafeventures.com to learn more about legal mandates and safeguarding student data.

Ohio State Department Data Dashboard (Sample)

Source: http://reportcard.education.ohio.gov/Pages/District-Report.aspx?DistrictIRN=048934%5C

New York State Department of Education Data Dashboard

Source: https://data.nysed.gov/

Public-facing report cards present large quantities of data by collecting student data from a variety of sources. Thus, ESSA addresses student data privacy, yet to fully protect student information, States must have a process in place to reduce the risk of disclosing students’ PII. According the U.S. Department of Education Privacy Technical Assistance Center (PTAC) the process is referred to as disclosure avoidance—efforts to de-identify data in order to reduce the risk of unauthorized or accidental access to, release, transfer, or other communication of personally identifiable information from educational records (PII). De-identification is a necessary point of consideration when selecting digital learning programs used in the classroom to online assessments and State report cards.

How does your State ensure student data privacy under ESSA requirements? #StudentDataPrivacy #ESSA2017

The purpose of Title I is to ensure that all students have access to an effective and equitable education, and to close achievement gaps. State accountability systems and report cards utilize deeper data sets which allows for informed decision-making and provide transparency. Student data collection and online publication calls for State and local compliance with privacy requirements.

High quality student data presents the potential for increasing student achievement. However, district administrators, school leaders, teachers and other relevant personnel must be trained to handle data effectively and ethically. The purpose of Title II is to provide SEAs and LEAs with funds to enhance the quality and effectiveness of teachers, principals and other school leaders in order to improve educational outcomes.

What is your State doing to ensure that districts and schools are trained to use student data effectively and responsibly? #StudentDataPrivacy #ESSA2017

What is your district or school doing to train educators on #StudentDataPrivacy? #ESSA2017

Title II Part A of ESSA provides funds to support training for districts and schools in data privacy.

ESSA Definition: digital learning – The term ‘digital learning’ means any instructional practice that effectively uses technology to strengthen a student’s learning experience and encompasses a wide spectrum of tools and practices.

Digital Learning tools and practices, as outlined by ESSA include:

• interactive learning resources, digital learning content (which may include openly licensed content), software, or simulations, that engage students in academic content
• access to online databases and other primary source documents
• the use of data and information to personalize learning and provide targeted supplementary instruction
• online and computer-based assessments
• learning environments that allow for rich collaboration and communication (which may include student collaboration with content experts and peers)
• hybrid or blended learning, which occurs under direct instructor supervision at a school or other location away from home and, at least in part, through online delivery of instruction with some element of student control over time, place, path, or pace
• access to online course opportunities for students in rural or remote areas.

Source: (20 USC 7112)

ESSA & E-Rate

The modernization of the Federal Communications Commission’s E-rate program has also significantly increased funding for building a technology infrastructure to support digital learning. However, E-Rate mandates pertain to Children’s Internet Protection Act (CIPA) which includes firewalls to protect students from inappropriate online content and contacts and requires educational agencies to verify implementation of an e-Safety program that addresses specific topics. CIPA does not provide regulations on student data privacy. However, any use of Federal education funds must comply with applicable privacy laws and the specific program requirements of each funding source.

Source: https://tech.ed.gov/files/2017/01/2017.1.18-Tech-Federal-Funds-Final-V4.pdf

See also Regulatory Landscape: The Youth Market and Privacy Regulations

At the school level, educational technology enables principals and teachers to collect and analyze student data inclusive of online services, software and mobile apps, databases, cloud storage, digital curriculum, and more. In fact, every electronic device or software application connected to the Internet is capable of collecting or providing access to student data. Although school leaders and educators can use student data to improve educational outcomes and close achievement gaps, policies and practices must be in place to ensure that student data is secured and only used for legitimate educational purposes.

Privacy Technical Assistance Center defines FERPA as:

“…a federal law that protects the privacy of student education records and gives parents and eligible students certain rights with respect to education records, including under certain circumstances rights of inspection and review and generally, the right to consent to the disclosure of these records.”

(34 CFR Part 99, Subpart B, 34 CFR § 99.30)

According to FERPA law, before a State or local education agency or institution discloses personally identifiable information (PII) from student educational records, a parent or guardian must provide signed and dated Verifiable Parental Consent unless the disclosure meets one of the permissible exceptions to FERPA’s written consent requirement. PII refers to a student’s name or identification number that can be used to distinguish or trace an individual’s identity either directly or indirectly by linking with other information.

20 U.S.C. §§ 1232g (b) (1-3), (b) (5-7), (h), (i), and (j); 34 CFR §§ 99.30(a) and 99.31

The Family Educational Rights and Privacy Act (FERPA) was enacted back in 1974. The law prohibits schools and school districts from disclosing personally identifiable information (PII) in student educational records without Verified Parental Consent (VPC). As educational technology adoption increased, the USDE clarified the definition of “school officials” in 2008 to include third-party vendors such as online services, database management companies, or digital curriculum providers. Third-party vendors offer services that educators view as beneficial in facilitating communication with parent and families, enhancing the quality of educational programs, providing student services and support, and offering secure data storage. As a “school official” third parties have access to sensitive student information jeopardizing its confidentiality and security. Moreover, without regulation, companies might use educational data for commercial purposes or create dossiers using student information. Thus, in 2014, Congress passed a bill to update FERPA, clarifying that third parties are prohibited from using student information for marketing and advertisement. Moreover, States have since strengthened data privacy laws to safeguard student information.

How does your State’s #StudentDataPrivacy laws measure up? #ESSA2017

What evaluation criteria does your district or school use to vet digital learning programs and #edtech? #StudentDataPrivacy #ESSA2017

Operators of websites, online services, web-based applications and mobile applications must comply with State and federal law whether or not they contract with schools. School and school district must have direct control over the ways that student data will be accessed and handled. Districts and contractors that do not ensure that best practices are followed may find themselves in hot water—and not only in violation of FERPA, but for other statutory compliance mandates as well including the Protection of Pupil Rights Amendment (PPRA) that deals with sensitive issues and requires school districts to notify parents if their PII will be used for marketing purposes, and the Children’s Online Privacy Protection Act (COPPA) that requires companies to obtain Verified Parental Consent prior to collecting, using or disclosing PII from children under the age of 13. Note that educators may use websites, apps and other online services for which a contract with the district has not been made. Refer to the best practices below best practices

Transition to ESSA necessitates that States, districts, not only update their technologies to fulfill federal requirements around data reporting, but to also update policies and practices to address such changes. Below are some best practices for States, district and school leaders, and educators.

About i-SAFE Ventures

References:

https://ed.gov/policy/elsec/leg/essa/essaaccountstplans1129.pdf

https://data.nysed.gov/ https://ferpasherpa.org/schneiderman1/

https://isafedirect.com/vpcservices https://nassp.org/who-we-are/board-of-directors/position-statements/student-data-privacy?SSO=true

http://ptac.ed.gov/sites/default/files/LEA%20Transparency%20Best%20Practices%20final.pdf

http://ptac.ed.gov/sites/default/files/Student%20Privacy%20and%20Online%20Educational%20Services%20(February%202014).pdf

http://reportcard.education.ohio.gov/Pages/District-Report.aspx?DistrictIRN=048934%5C

https://studentprivacy.ed.gov/content/disclosure-avoidance

https://tech.ed.gov/files/2017/01/2017.1.18-Tech-Federal-Funds-Final-V4.pdf

http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title20-section1232g&num=0&edition=prelim

http://www.ascd.org/ASCD/pdf/siteASCD/policy/ESSA-Accountability-FAQ_May112016.pdf

http://www.chalkbeat.org/posts/ny/2017/07/17/state-officials-release-early-mock-up-of-data-dashboard-offering-clues-on-how-state-may-report-school-quality-to-the-public/

https://www.fcc.gov/consumers/guides/childrens-internet-protection-act

https://www.gpo.gov/fdsys/pkg/BILLS-114s1177enr/pdf/BILLS-114s1177enr.pdf

http://www.isafeventures.com/2015/08/04/coppa/

http://www.isafeventures.com/2015/08/05/ferpa/

http://www.isafeventures.com/2015/08/05/ppra/

https://www.isafeventures.com/2017/05/05/essa-essentials/

https://www.law.cornell.edu/cfr/text/34/99.31

http://www.ncsl.org/research/education/student-data-privacy.aspx

https://www2.ed.gov/policy/gen/guid/fpco/pdf/ferparegs.pdf