These answers to frequently asked questions are general guidelines only and do not constitute legal advice. Please consult directly with an attorney for advice that applies to you.
PHYSICAL CLASSROOM
The early years of the Internet were heady times, but the experts of the day could not imagine the eventual global impact on the youngest users, even toddlers. With a vast array of options, educators have had difficulty identifying the best technology to support students of all abilities while protecting their privacy. It is important to illustrate for students how to respect the privacy rights of other students, teachers, content providers and vendors, while understanding that their own privacy is important and that their use of technology should be well-informed. Technology is permeating classrooms in positive ways, increasing teacher accountability and tracking academic trends, but constant monitoring and interconnected networks of information pose threats to student privacy. Educators should be familiar with laws that govern privacy for K-12 schools and their impact on technology that sounds futuristic but is already in use in classrooms in the U.S. and around the world. Educators, parents and students should be on high alert, and questioning a privacy policy should be standard practice. Student privacy should always be front and center when making difficult administrative and educational decisions.
A. The Family Educational Rights and Privacy Act (FERPA) prohibits access to student education records in schools that receive federal funding, and the Children’s Online Privacy Protection Act (COPPA) requires websites to get parental consent before collecting personal information from children under 13. A more comprehensive description of both laws can be found here. The Protection of Pupils’ Rights Amendment (PPRA) has also expanded the protections of FERPA by requiring schools to obtain written parental consent before requiring students to participate in surveys or evaluations and to develop explicit policies regarding student privacy.
A. Yes. These devices collect Personally Identifiable Information (“PII”) like voices, biometrics and images, even while they may seem inactive.
A. No. Educators are considered users of these devices, not the content creators. Moreover, the manufacturers of these devices do not have to comply with with the Family Educational Rights and Privacy Act (FERPA) standards because they built them for commercial use.
A. The short answer: If you do not need it, do not use it. The risk of disclosing confidential student information is too high. If the virtual assistant is absolutely necessary, get written parental consent and keep the written forms up to date with the law, the technology and classroom applications. Establish a way to prevent students from “waking up” the virtual assistant, which may be difficult with an attractive nuisance in the room. In physical and remote classrooms, unplug the machine during class time, parent-teacher conferences and any discussions involving student information.
A. Yes. Although schools in the U.S. have primarily used facial recognition technology for building security when classes are conducted in person, it is currently being used to proctor online exams. This has garnered substantial criticism regarding invasions of privacy and assumptions of cheating leading to unwarranted discipline. A more comprehensive analysis of these issues can be found here. Once this Pandora’s box has been opened, the idea of a college counselor referring to an applicant’s third-grade daydreaming episode requires little stretch of the imagination.
In China, some in-person classrooms are even using “intelligent behavior management systems,” which collect, store and respond to students’ facial expressions during lessons. Some of this software has misdiagnosed children by mischaracterizing stand-alone facial expressions as evidence of social disorders or lack of attention.
BrainCo, a startup in Somerville, Massachusetts and funded by Harvard, has even developed technology that monitors brain waves, primarily for autonomous driving cars and adults. However, it has already tested its products on students in China, so mind-reading technology may follow closely behind school-based facial recognition technology in the U.S.
Educators should also consider the demographic makeup of their classroom. Many facial recognition programs are tested on white men, and the end result may create racial and gender bias. For example, Oprah Winfrey, Michelle Obama and Serena Williams have been misgendered and incorrectly identified based on their skin color. If the use of facial recognition software increases significantly in U.S classrooms, it may perpetuate significant discriminatory systems in behavior management, academic data analysis and psychological assessment.
A. Digital bathroom trackers, which allow students to request bathroom breaks through software apps, are already in use in U.S. K-12 schools. Such programs track breaks to determine if students are leaving the classroom too frequently. While students and parents are critical of its invasion of privacy, there are other programs that track even more data. One company has even proposed uniforms with location-tracking microchips, and several colleges are already tracking student locations and class attendance using their cell phones.
A. There are some technologies used to track every activity in which students participate online, primarily to monitor schools for suspicious content or images, which can be helpful in detecting potentially harmful activities. Although it may be advantageous in certain situations, such as a student requiring mental health intervention or posing a threat to a classmate, this type of technology is a good example of potentially excessive surveillance.
For example, some programs flag any activity that mentions words like “hurt me,” “drunk” or even “gay.” While an innocuous phrase like “drunk with power” in an essay or a search for Culture Club’s 1982 hit “Do You Really Want to Hurt Me” might be dismissed by a school official, surveillance of LGBTQ-related words may constitute an egregious breach of privacy. More importantly, some safety representative hiring processes and training programs result in most issues being handled by employees with no relevant training or skills.
A. Metadata is any information that explains or gives context to other data. For example, the amount of time it takes for a student to perform an online task is more meaningful if you know (1) the date and time when the student completed the activity, (2) how many attempts the student made and (3) how long the student’s cursor hovered over an item (potentially indicating indecision).
A. Metadata should not be used in a vacuum. Rely on teachers’ expertise and experience, not just technology, before making these critical assessments. Limit the collection and use of data to what is necessary for educational goals.
As mentioned previously, most commercial products may not be compliant with the Family Educational Rights and Privacy Act (FERPA) and/or governed by the Children’s Online Privacy Protection Act (COPPA) if they market only to adults. To ensure student privacy, educators should avoid aggregating enough Personally Identifiable Information (PII) to create identifiable profiles of students on third-party platforms. If planning to collect metadata for any reason, provide a transparent privacy policy.
A. As always, parents should sign waivers to use photos for publicity, promotional or educational purposes. School policies should unambiguously define such purposes so that parents and students are fully informed. Again, the best course of action is to avoid sharing more information than is necessary to benefit the student.
A. The long-term and perhaps greater concern is that students may become too accepting of sweeping forms of surveillance, so it is important to first give students the opportunity to opt out and make sure they are not penalized for doing so. Moreover, you must thoroughly vet providers, remain wary of programs that involve facial recognition, and ensure that all involved parties know how and why you are collecting any data. Getting written consent from parents, per the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupils’ Rights Amendment (PPRA), is an essential starting point.
A. Yes, to a certain degree and in specific circumstances. Student health records maintained by K-12 public schools are considered education records under the Family Educational Rights and Privacy Act (FERPA), rather than health records under the Health Insurance Portability and Accountability Act (HIPAA). Otherwise, schools using independent healthcare providers would be subject to the consent requirement of HIPAA, which gives the healthcare providers the authority to release information in the event of a health or safety emergency.
Although FERPA’s “health or safety emergency” exception gives schools the ability to disseminate Personally Identifiable Information (PII) if there is a cognizable threat to the student body, a school must limit identifiable information to an amount required to address the potential harm. For example, if a student contracts COVID-19, a school should first assess which students and faculty members would be at a legitimate risk of infection, then communicate the concern. It is unnecessary to single out a student by name, location or other identifying features.
Furthermore, teachers are not subject to FERPA. If there is a concern that any employees contracted COVID-19, the same non-identifying protocol may be followed without violating privacy rights. However, employment law in certain states may protect the confidentiality of faculty members, so it is most advisable to contact the state public health authority or employment law specialists prior to disclosing any information.
If a student in the community is suspected of having an unconfirmed case of COVID-19, FERPA permits schools to contact the student’s primary care physician, but HIPAA may prevent a doctor from disclosing such information. Accordingly, it would be imprudent to share information based on mere suspicion.
From a practical standpoint, schools should consider whether disclosing any of this information is necessary and assess these situations on a case-by-case basis.
REMOTE CLASSROOM
As the law slowly adapts to meet the needs of schools during the COVID-19 pandemic, school administrators and teachers often have complex questions regarding privacy and copyright. While the top priority is protecting students from breaches of privacy and unsecure online activity, schools are also concerned with limiting their liability and protecting their faculty in the process.
The remote classroom has posed issues that most teachers have never faced before. Live feeds get disabled by moderators for suspected copyright infringement. Parents of students with disabilities, who require certain ratios of teachers to students on their Individualized Education Plans (“IEPs”), are concerned that they are not legally receiving the services they need. Personally Identifiable Information (“PII”) is disseminated through videoconferencing tools without a thorough understanding of the inherent risks of disclosure.
Learning to adapt in the middle of a school semester was difficult for teachers, students and parents during the spring of 2020. Given that at least some portion of instruction will be remote for many students in the 2020-2021 school year and beyond, the expectations will be much higher for the caliber of instruction. Although legislative change may eventually help educators, now is the time to consider the current legal landscape.
A. Express permission from the owner of a film copyright to license their work for educational uses will circumvent infringement liability. This is possible via individual negotiation or, more practically, a blanket licensing organization like the Motion Picture Licensing Corporation or Swank Motion Pictures, Inc. When there is no documented agreement in place, it is possible that a school’s use is an infringement depending on the specific facts.
While a copyright owner may be inclined to bring suit against a private institution, it is unlikely that a public school would be threatened with litigation because of the doctrine of sovereign immunity. Moreover, the odds of such a case going to trial is slim because of the general acceptance of educational fair use, and the negative fallout of enforcement. Regardless, defending a claim of copyright infringement drains administrative resources that could otherwise be allocated more appropriately.
While teachers may be accustomed to showing an entire film in a physical classroom, the TEACH Act provides a different approach for the remote classroom. In a purely online environment, the Act allows for use of clips of a film in “reasonable limited portions.” For instance, a teacher could lawfully show an entire movie in 30-minute increments over the course of five consecutive remote class periods. Nevertheless, there are additional limitations under the fair use section of the Copyright Act, so explicit permission from the source remains the recommended approach.
Practically speaking, showing incremental portions may trigger the removal of video feeds by platforms like Zoom, due to automated procedures that cannot detect whether the transmitted film is protected by fair use standards. Some programs that extract the digital contents of DVDs for playback (“ripping”) will decrypt the digital signal with a key, which violates copyright law. However, if teachers use licensed DVD player programs that simply read CD drives, sharing a screen would not constitute encryption circumvention under the Copyright Act. Copyright owners have been less hostile to this practice by classroom teachers, especially when the film content relates directly to the class, as it should.
Regardless, these technological companies may detect a token and disable the feed, so researching the privacy and acceptable use policies of such programs may provide clearer guidance on sharing copyrighted files in remote classrooms and which programs best suit certain needs.
Unfortunately, many streaming services like Netflix and Hulu have not granted licenses to educational institutions, which could provide a much-needed solution to this issue in remote classrooms. Although there is no straightforward answer, the circumstances of a pandemic and the requirements of remote classrooms may change their approach. For example, the Congressional Research Service has opined that an entire film could constitute a “reasonable limited portion” in relation to a class, but that is not the current law. See U.S. Copyright Office, Section 1201 Roundtable, at 224 (Apr. 11, 2018).
A. Many teachers have been required to post their original material online for easier access. While the “work made for hire” doctrine from the Copyright Act provides that employers own the copyright in works created by their employees, most universities have intellectual property policies that expressly give copyright ownership to professors. Although this is common in higher education, it is generally not the case in K-12 schools.
In fact, some schools will take advantage of works made for hire by selling curricula to other school districts and students in other jurisdictions. Teachers quitting their jobs to sell their class material online or to supplement their annual salaries is nothing new. Art and music teachers may be particularly attracted to this alternative to benefit from their original creative works, which may appear to go beyond the scope of their original employment agreement. This reluctance to sharing one’s unique creative content on the Internet without compensation is especially relevant when teaching remotely is a necessity.
As a result, educators should thoroughly read and understand the intellectual property policies of their individual institutions to ensure their work is both protected and treated in the way all parties intended. If not, educators who are concerned with protecting their material are advised to consult their respective institutions to negotiate more ironclad, short-term, intellectual property-focused contracts with their institutions and third-party technology providers.
A. The Family Educational Rights and Privacy Act (FERPA) requires that parents or eligible students provide their written consent before their school releases Personally Identifiable Information (PII) from their education records, with few exceptions. One of these exceptions is in a “health or safety emergency.” While it may sound like a worldwide pandemic fits that category, it is the information itself that is more important. The two key factors to consider are 1) the parties to whom information is disclosed and 2) the type of information. Before using certain technological platforms, the most advisable action is to get that written consent, particularly at the beginning of the school year.
The shift to remote classrooms has fundamentally changed the way in which all meetings operate, including parent-teacher conferences, online discussions between teachers and administrators, professional development sessions and student-teacher conversations. There is a substantial likelihood that sensitive information will be disclosed in any of these situations, such as student disabilities, behavioral logs or advisory messages from a school counselor.
It is crucial to be abundantly transparent about this. The best way to keep parents apprised is much like any organization’s privacy policy – tell them what information will be shared, how it will be used, all security measures in place, and what happens in the worst-case scenario of a privacy breach.
While a “health or safety emergency” may seem ubiquitous, the purpose of this exception within FERPA is for divulging information without consent in connection with the emergency. If a teacher discusses confidential information over Skype, COVID-19 does not necessarily pose an emergency under what the Department of Education calls “a blanket release of PII from student education records.” Therefore, only the authorized teachers and individuals should participate in phone calls that disclose such information.
When choosing online communications services, it is crucial to find a trusted provider and communicate all partnerships to students and their families. We discuss tech company partnerships in more detail here.
A. Although an entire semester-long class could be taught on First Amendment rights in education, it is worth mentioning in the context of the remote classroom. Public schools may regulate student speech that disrupts the learning environment or infringes on other students’ rights, and private schools have greater latitude in terms of what they may censor.
Before allowing students to participate in an online forum for discussions, it is always best to obtain written consent from students and/or parents. It is particularly important that students are first aware of the district or school rules and regulations surrounding computers. Most schools already have students sign a statement at the beginning of the school year, promising to use technology appropriately. However, it is worth reexamining these agreements and any related privacy policies to consider the possibility of an entire year away from the physical classroom.
When facilitating class discussions and forums, continue to monitor student language and posts with respect to those regulations. If a rule is clearly defined at the beginning of the academic year, both students and parents will have an opportunity to ask questions. Although school regulation of student activity on social media outside of the classroom must relate to school safety, an internal forum should be an even safer space, so make sure students keep it that way. Now it is more important than ever to be sensitive to student discussions. This goes beyond legal concerns.