NEW YORK—For the second time in six months the New York State Education Department (SED) defended its use of cloud storage to centralize massive amounts of personal data on New York students.
The SED deflected questions from the State Assembly Education Committee on Friday, maintaining that the all the data collected was necessary and that the SED had gone beyond the legal requirements to protect a student’s records.
“As people know, there has been a tremendous amount of concern about that,” stated Catherine Nolan, the chair of the Assembly committee on education. “Not only student privacy, but whether what you do as a high school student follows you through life in [case of] some breach, or some ‘sort and select’.”
Court Case
Last November SED was taken to court by 12 parents who were outraged that their children’s personal information was being shared with a third party, and without their consent. They claimed it was a violation of the Family Educational Rights and Privacy Act (FERPA), a federal law protecting the privacy of student education records.
A federal judge sided with the SED, saying “If it is necessary to the performance, and the duties, and purpose of the agency,” it is acceptable under current legal precedents.
The SED has already been working with a non-profit, inBloom Inc. based in Atlanta, Ga., to encrypt and store student information in its servers. InBloom also allows applications (apps) schools already use to communicate seamlessly with one another, centralizing student records in one “data dashboard.”
The SED said using inBloom would accommodate spikes in use better than local servers could. iBloom could potentially save the state money by contracting with one provider versus many. Both inBloom and the SED maintain that the data is well protected, even from inBloom itself.
“If you were to go into our secure data facility and pull out a hard drive, you would have to do three things. You would have to break two levels of encryption,” said Jat Pannu, Senior Vice President of Services for inBloom. “And then you would only get a fragment of the data.” He described the process as virtually shredding a student’s record twice then throwing the strips into multiple bins that would scramble the data further.
Parent Opt Out
Safe or not, parents say they want the option to opt out of such a service, which the SED has pushed back against.
“If there were a provision for parental opt out, there would be a fundamental interference with a school district’s ability to provide educational services to the students under their purview,” said Ken Wagner, SED’s Deputy Commissioner for Curriculum, Assessment and Educational Technology.
The SED would use the data to develop personalized learning tools and to track student progress, which is a requirement of the “Race to the Top” grant awarded New York in 2010. New York was granted $696.6 million over a four-year period as part of a federal program to fund innovative learning ideas.
Assembly members questioned whether some 400 data points the SED is collecting is really necessary to provide “educational services.” The list of 37 categories includes names, home addresses, race, economic status, disciplinary records, test scores, and special education services.
The SED says it has already started uploading information into inBloom’s servers, minus students’ and parents’ names and addresses, but has delayed the rollout because of public outcry.
When asked what, if any, concerns the SED is taking into account and plans to take action on, Wagner replied, “We’re fully willing to engage in any discussions with the legislature to address those concerns.”
Holly Kellum is a special correspondent in New York.
