Data about students, parents and education is a hot commodity, raising privacy questions about how much information is too much.
Tens of thousands of Tarrant County parents, students, teachers, and community members use school district mobile phone apps to find out what is happening in their districts and on their campuses.
In the Fort Worth school district, 51,000 people use the district’s mobile app. Arlington’s app has 32,000 users. About 10,000 people are using the app for the Northwest district.
How much data is gleaned from people using the mobile apps? Experts say the information can fall into the hands of data brokers, marketers and others, despite efforts to keep it private. They also say there is a lack of transparency surrounding how the technology works.
Never miss a local story.
“The average consumer would want to understand exactly what a particular company is doing,” said Sophia Cope, a staff attorney with the Electronic Frontier Foundation (EFF), a national nonprofit organization for digital civil liberties. “The expectations are even greater for parents with children in school.”
“It’s a transparency problem,” Cope said. “The companies are not, we believe, being totally upfront in explaining the technology. Districts don’t know what questions to ask before they sign these contracts, and they’re not informing the parents of what they’re doing.”
But school officials said they are confident the app developers they hired are neither gathering nor sharing information from users.
“They don’t have access to the data …,” said Clint Bond, a spokesman for the Fort Worth school district. “Basically, we can push information out, but there’s not a two-way exchange of information.”
School administrators said app developers they contracted with do not have permission to sell any data gleaned from the apps.
Randy Sumrall, executive director of technology for the Birdville district, said the district’s app contractor, Schoolwires, does not have permission to distribute or sell student information.
“If we found out they were doing it, we would stop using them,” Sumrall said.
Phone apps for the Arlington, Fort Worth, Birdville, Northwest and Mansfield school districts — like most apps — require users to submit to a variety of “permissions,” though just exactly what you’re permitting the app to do is unclear.
The permissions vary by district.
Upon downloading Birdville’s app, for example, permissions are requested for the device identity, the calendar, location, photos, media, files and the camera. Fort Worth’s app requests permissions for modifying or reading the contents of the SD (memory) card. Permissions for the Northwest district app include accessing identity, the calendar, phone call logs, and photos, media and files.
Some of the permissions are required for users to access all features of an app. But it’s not clear what else could be done with the permissions.
“Outside of these generic permissions, it’s hard to tell,” said Grayson Milbourne, director of security intelligence at the Colorado headquarters for Webroot, an international Internet security firm. “You’d have to do an analysis of an app at a code level.”
That requires an advanced knowledge of programming language that most people simply do not have, Milbourne said.
Apps that ask for access to areas such as phone storage or photos are concerning, especially if those permissions have nothing to do with the app’s stated purpose, he added.
“If you don’t need it, don’t put it in there,” Milbourne said.
How private are policies?
App development contracts for the Arlington, Fort Worth, Birdville, Northwest and Mansfield districts, obtained through public information requests, show a lack of stringent privacy policies between developers and the school districts. Often, when privacy is mentioned, the full responsibility for compliance is on the districts.
For example, the contract between the Arlington district and app developer AVAI states that the client (the district) is solely responsible for complying with all laws, including privacy laws.
The Carroll school district requested an opinion from the state attorney general’s office regarding the release of the contract information.
Phone apps are a part of everyday life, and many people willingly give up their privacy in exchange for the convenience and information apps provide.
But when students and school districts are involved, privacy rights are more complicated.
Certain privacy laws apply to electronic student data. For example, the Children’s Online Privacy Protection Act (COPPA) prevents the release of electronic data from students under age 13, unless they have parental permission.
FERPA (the Family Educational Rights and Privacy Act) is a federal law that prohibits schools and their contractors from releasing information about sensitive student education records such as grades.
Certain information about students is fair game for data brokers.
Parents must formally opt out to prevent the release of their child’s “directory” information.
If a parent does not opt out, it is legal for schools to disclose directory information such as a student’s name, address, phone number, date of birth and dates of attendance at school, according to the U.S. Department of Education website.
“Data brokers are very interested in FERPA [Family Educational Rights and Privacy Act] data, and if an app developer has FERPA data all neatly organized, it’s really simple to just pick it up and purchase it,” said Pam Dixon, executive director of World Privacy Forum based in San Diego. Dixon serves on the editorial board of the Technology Science journal at Harvard University and has testified before Congress and government agencies on privacy issues.
Basic directory information is enough to start a detailed, lifelong profile that can be kept on file indefinitely, Dixon said.
Schools often lack the resources to deal with the complexity of all of the privacy laws and technology related to digital data.
“The educational sector just isn’t there yet,” Dixon said. “They’re just not. They’d need a team of security researchers and a privacy attorney, and that kind of information just hasn’t made it into the school districts.”
‘The app has many benefits’
School district officials said they offer apps to give parents, students and community members mobile access to school information. Data on sports, school lunch menus, closings, bad weather and district social media accounts is accessible through the apps. All are intended as a way to engage parents and the community.
“The app has many benefits for our users and provides our parents and students important information on the go,” said Rick Herron of Carroll’s communications office. “News and alerts are immediate and become a valuable way to receive district notifications immediately. With so many parents and students using phones, this vehicle of communication is the trend, and we are seeing great results.”
Today’s mobile lifestyle led local districts to develop apps to offer up-to-the minute information to parents, students, teachers and community members.
“Our community, our parents are mobile,” said Bond, the Fort Worth district spokesman. “They want and need information conveniently in the palm of their hand and at the tap of a button.”
App users can choose what schools to follow, allowing them to receive customized updates and news. A general news feed from the districts is often included as well. Information about sports, lunch menus and bus routes is also popular, officials said.
“Our app can be completely customized,” said Emily Conklin, communications director for the Northwest district. “That’s something we really wanted. We also surveyed the staff and community members during the development process, so we had a lot of feedback.”
Even though the apps are popular and beneficial to students and parents, Dixon said districts must remain vigilant about information mining.
Dixon said she was met with a lot of resistance in the fall when she released a video about FERPA and how data brokers use the information.
“Teachers and school administrators wrote to me saying how schools never release the information and data brokers never get the information,” she said.
But data brokers are ruthless when it comes to getting information they want, Dixon said.
“We’ve seen over and over again how nasty they can be,” she said. “We have to be very passionate about protecting kids.”
Tips for student privacy
Tips for parents who want to learn more about student privacy:
▪ Approach your school or school district and ask who you can talk to about privacy policies.
▪ Talk to other parents you know and see if they share your concerns.
▪ Set up a home meeting with three or four families to discuss why privacy issues are important.
▪ Topics to discuss include why privacy matters and the role schools play in shaping privacy expectations.
▪ Consider opting your child out of the release of directory information. Contact your school to learn how to opt out.
▪ Consider attending a PTA meeting to voice your concerns or start a discussion.
Questions to raise
▪ Why does privacy matter?
▪ What roles do schools play in constructing your students’ expectations of privacy?
▪ What information have other parents received from your school or district?
▪ Which other parents share your concerns and want to work together?
Source: The Electronic Frontier Foundation and the World Privacy Forum
School districts and apps
In an effort to keep pace with how people communicate and receive information, some area school districts are offering apps that parents, students teachers and community members can access on mobile devices. The price may include other communication services in addition to the app.
Arlington school district
Contractor: Avai Mobile Solutions of Austin
First-year cost in 2014 was $49,000, then annual maintenance fee of $8,000.
Birdville school district
Contractor: Schoolwires, Inc., of State College, Pa.
One-year cost: $50,709.96
Carroll school district
Public information request referred to the state attorney general.
Fort Worth school district
Contractor: ParentLink-Blackboard, Washington, D.C.
One-year cost: $247,800
Mansfield school district
Contractor: Reliance Communications, LLC - SchoolMessenger of Omaha, Neb.
One-year cost: $69,300
Northwest school district
Contractor: EST Group of Arlington
First-year cost in 2013 was $75,860, then annual maintenance fee of $9,900.