A report released Friday by Fordham Law School raises questions about the effects on privacy of cloud adoption by American public schools. The report says that over 93 percent of cloud contracts fail to restrict the sale of student information by vendors, and over 75 percent fail to specify the conditions for disclosure of student info.
The report was written by Fordham’s Center on Law and Information Policy (CLIP), and was supported by a gift from Microsoft. It aimed to provide a picture of cloud service use by school districts, to assess how both legal obligations and community standards are met by those services, and to provide recommendations for the protection of student privacy.
“School districts throughout the country are embracing the use of cloud computing services for important educational goals, but have not kept pace with appropriate safeguards for the personal data of school children,” said Joel Reidenberg, a professor at Fordham Law School and the founding director of CLIP.
While cloud adoption is widespread, with 95 percent of districts contracting cloud services, understanding, transparency, and governance of these services is lacking. Only 25 percent of districts informed parents of the use of cloud, while 20 percent do not have online service use policies, and many do not have privacy policies in their contracts.
The Family Educational Rights and Privacy Act and other legal statutes provide minimum standards for data protection and privacy which the school districts are obligated to meet, but the CLIP report shows those standards are frequently not met.
The report recommends increasing transparency by informing parents of the use of cloud services on school district websites, the adoption of privacy protections into service contracts, and the adoption of cloud service policies by school districts.
The report does not explore the incentives built into the market for cloud service companies to protect student data, nor does it provide examples of data being sold or otherwise abused by vendors.
The digital classroom and the concerns it creates pose both a challenge and opportunity for cloud service providers. In late November iomartcloud announced a partnership with Exinda to launch a web filtering solution specifically for enterprise networks and school districts, to address concerns over what comes in.
Cloud providers in the US who can address concerns about what gets out with service contract language will be more able to attract and retain business from school districts if the CLIP report leads districts to follow its recommendations.