Data Privacy and Security for Superintendents: Safeguarding Student Information

As the use of technology in classrooms and online learning become more common in our schools, superintendents and administration officials are increasingly expected to ensure the confidentiality of student information and data.

In today’s educational world, students, educators, and administrators can access personal data from almost anywhere, which means the chance of potential vulnerabilities being exploited has increased. Cyberattacks continue to jeopardize the safety of student data and privacy, with “eighty percent of school IT professionals report[ing] that their schools were hit by ransomware in the last year,” shares EducationWeek.  Administrators and technology professors in school districts around the countries must remain vigilant to avoid costly breaches, which average $50,000 to $1 million per school district, to their computer networks and systems.

By safeguarding students’ personal information, administrative officials can increase confidence in the educational system and guarantee adequate protections are in place to protect students’ data privacy and security in schools.

Data Privacy and Security in Schools

Students have a right to privacy, and collecting, accessing, using, or sharing student data without their (or their parents’) written consent can expose your district to legal liability. How students’ personally identifiable information, or PII, is used, collected, or treated is commonly referred to as student data privacy. PII can include any data about a student’s identity that is particular to an individual student. This type of data may include:

• Names
• Dates of Birth
• Parent/Guardian Names
• Home Addresses
• Home Languages
• Demographic Information
• School and Grade Level
• Educational Records
• Class Schedules
• Special Needs or IEP Status
• Behavioral Records
• School ID Numbers
• Phone Numbers
• Email Addresses

Student data security is the protection of sensitive student information within an education system through proper handling and usage, mainly through technical and organizational measures. That data, or PII, can be digital or physical. To ensure proper student data security, administrators and their districts must adhere to policies and practices that protect information from unauthorized access, misuse, or disclosure, while complying with student data privacy laws and regulations.

Data Privacy Laws

The most prominent U.S. student data privacy laws include:

• FERPA: In 1974, many years before the tech boom, the U.S. Congress enacted the Family Educational Rights and Privacy Act to protect student and family privacy. FERPA grants parents or eligible students (those who have reached the age of 18) certain rights regarding the privacy of student education records. It established meaningful oversight, transparency, and accountability for student data privacy and security in schools.
• CIPA: The Children’s Internet Protection Act was enacted in 2000 and is a federal law that addresses the need for internet safety in schools and libraries. It mandates the use of filtering technology to prevent access to inappropriate or harmful content on computers with internet access. CIPA also requires educational institutions to educate students about internet safety and the responsible use of online resources.
• COPPA: The Children’s Online Privacy Protection Rule was enacted in 1998 and is a federal rule that safeguards the online privacy of children under the age of 13. It imposes certain requirements on operators of websites and online services that collect personal information from children. COPPA aims to provide parents with control over the information collected from their children and ensures their consent is obtained before any data collection occurs.
• PPRA: The Protection of Pupil Rights Amendment was enacted in 1984 and is a federal law that affords certain rights to parents of students who are minors with regards to surveys that ask personal questions. Schools must be able to inform parents of any survey materials used and must obtain written consent from parents for any surveys that deal with sensitive categories.

Best Practices for Data Security in Schools

While no district can eliminate cyber threats and attacks completely from student data breaches, certain steps can be taken to improve student data privacy and data security in schools. A few key recommendations include:

Developing a Comprehensive Policy

Create a clear data privacy policy that outlines how student data is collected, used, stored, and shared. Communicate the rights of students, the purposes for which data is collected, and the measures in place to protect their information.

Obtaining Informed Consent

Obtain appropriate consent from parents or legal guardians before collecting student data and inform parents of their rights regarding data privacy.

Securing Data Storage and Sharing

Vigorous data security measures are critical to protecting student data from unauthorized access. Encrypt data when stationary and during transmission, use secure storage systems, and regularly back up data.

Limiting Data Collection

Collect only the necessary data directly relevant to students’ education. Minimize the collection of unnecessary personal information and regularly review data collection practices to ensure compliance with privacy laws.

Training Staff on Data Privacy and Security

Current and ongoing training is essential for all levels of staff, students, and even parents. Training will help strengthen awareness and improve the ability of your staff members to recognize and prevent cyberattacks and data breaches.

Enabling Multifactor Authentication

Ensure your district software utilizes multifactor authentication (MFA), which requires more than one way for users to identify themselves.

Purchasing Cyber Liability Insurance

If your district hasn’t already done so, consider purchasing cyber liability insurance or data breach insurance, which are specifically designed to address the unique risks and challenges faced by districts amid ongoing cyber threats and attacks.

Districts maintain and use the personal information of students for a variety of educational purposes. Students and their families entrust schools with their personal information with the expectation that this data will be used to serve the needs of the students effectively and efficiently.

Although many federal and state laws and regulations related to student data privacy and security must be followed, school districts may need additional policies and procedures to guide the successful and productive everyday operations of their schools.