Education Week - March 26, 2014 - 23

"
The landscape of
what districts are
facing is changing at
light speed. We have
to come together as
educational entities
and say to vendors
that certain privacy
protections are non-
negotiable."
LENNY SCHAD
Chief Technology Officer, Houston
Independent School District
and districts for how to interpret
and apply the law in the new age
of cloud-based educational services,
massive collection of digital data,
and increased outsourcing to ed-tech
vendors.
One of the scenarios detailed in
the guidance appears to closely describe
the alleged data-mining practices
of Google Apps for Education:
EXAMPLE 4: A district contracts
under the school official exception
with a provider for basic productivity
applications to help educate
students: email, calendaring, websearch,
and document-collaboration
software. The district sets up the user
accounts, using basic enrollment information
(name, grade, etc.) from
student records. Under FERPA, the
provider may not use data about individual
student preferences gleaned
from scanning student content to
target ads to individual students for
lematic for student privacy," Mr. Reidenberg
said. "But the complexity
of these arrangements exceeds what
FERPA is really capable of addressing."
Greater Scrutiny Ahead
Some of Mr. Reidenberg's recent
work has been funded by Microsoft,
the Redmond, Wash.-based computer
and software corporation that
has been competing with Google
for business and challenging the
younger company's privacy policies
and practices for years.
In an interview with Education
Week, Cameron Evans, Microsoft's
chief technology officer for education,
called on Google to be more
transparent.
"If they're not doing anything
Where does the case stand now?
derivative information, or "metadata"-for
"secret user profiling"
that could serve as the basis for
such activities as delivering targeted
ads in Google products other than
Apps for Education, such as Google
Search, Google+, and YouTube.
The plaintiffs allege that Google
has employed such practices since
around 2010, when it began using a
new technology, known as Content
Onebox, that allows the company
to intercept and scan emails before
they reach their intended recipients,
rather than after messages are delivered
to users' inboxes, regardless
of whether ads are turned off.
Mr. Fread and Mr. Carrillo say
that neither they nor any other
users of Google Apps for Education
consented to such practices. They
were seeking financial damages
amounting to $100 per day of each
day of violation for every individual
who sent or received an email message
using Google Apps for Education
during a two-year period beginning
in May 2011.
While the allegations by the plaintiffs
are explosive, it's the sworn declarations
of Google representatives
in response to their claims that have
truly raised the eyebrows of observers
and privacy experts.
Contrary to the company's earlier
public statements, Google representatives
acknowledged in a September
motion to dismiss the plaintiffs'
request for class certification that
the company's consumer-privacy
policy applies to Apps for Education
users. Thus, Google argues, it has
students' (and other Apps for Education
users') consent to scan and
process their emails.
In November, Kyle C. Wong, a law-
yer representing Google, also argued
in a formal declaration submitted to
the court in opposition to the plaintiffs'
motion for class certification
that the company's data-mining
practices are widely known, and
that the plaintiffs' complaints that
the scanning and processing of their
emails was done secretly are thus
invalid. Mr. Wong cited extensive
media coverage about Google's data
mining of Gmail consumer users'
messages, as well as the disclosures
made by numerous universities to
their students about how Google
Apps for Education functions.
Mr. Wong's inclusion of the following
reference to the disclosure provided
to students at the University
of Alaska particularly caught the attention
of privacy advocates:
The University of Alaska ("UA")
has a "Google Mail FAQs," which asks,
"I hear that Google reads my email.
Is this true?" The answer states,
"They do not 'read' your email per
se. For use in targeted advertising
on their other sites, if your email is
not encrypted, software (not a person)
does scan your email and compile
keywords for advertising. For
example, if the software looks at 100
emails and identifies the word 'Doritos'
or 'camping' 50 times, they will
use that data for advertising on their
other sites."
"The fact that Google put this in
their declaration means we take it
as true," said Ms. Barnes of the privacy
watchdog group EPIC. Google's
sworn court statements reveal that
the company has violated student
trust by using students' education
records for profit."
To illustrate the potential harm of
Google's alleged data-mining prac-
Last week, Judge Lucy Koh of the U.S. District Court
for the Northern District of California denied the
plaintiffs' motion to turn the suit into a class action
that could have encompassed millions of Gmail and
Apps for Education users. In September, Judge Koh
had denied a motion from Google to dismiss the
case, rejecting the company's contention it clearly
had users' consent for its data-mining practices.
wrong, they need to step up and say
it and explain to people in unambiguous
terms how they capture and
use [students'] data," he said.
Mr. Bout, of Google, in his statement
to Education Week, said the
company is "committed to protecting
the privacy and security of
our users-and that includes students-to
make sure their information
is safe, secure, and always
available to them."
Of course, the problem extends
tices, Bradley S. Shear, a social-media
and digital-privacy lawyer based
in Bethesda, Md., posed a hypothetical
situation in which a teacher
using Google Apps for Education
emails a parent with information
related to a child's disability status
or mental health.
If the full range of allegations in
the California suit is true, Mr. Shear
said, the contents of such an email
could be used by Google to build a
digital-user profile that might follow
that student indefinitely.
"Who knows what the hell Google
is doing with that information, and
who knows what problems it could
cause for that child in the future,"
he said. "Years ago, it might have
been put in a filing cabinet, but
it wouldn't be tagged to the child
forever."
'Major FERPA Violations'
Mr. Shear said he saw "major
FERPA violations" in Google's activities
and suggested that the Education
Department should investigate
the company. The Federal Trade
Commission, which is responsible for
monitoring deceptive business practices,
should also take note, he said.
The Family Educational Rights
and Privacy Act was enacted in 1974
to protect the privacy of children's
educational records and to prevent
unwarranted disclosure.
Last month, the Education Department
issued guidance to schools
clothing or toys, because using the
data for these purposes was not authorized
by the district and does not
constitute a legitimate educational
interest as specified in the district's
annual notification of FERPA rights.
If a student, parent, or educator
complains about a vendor potentially
violating FERPA or other federal
statutes, the department has
the authority to investigate those
claims and issue written findings
back to the school in question and to
the public.
Education Department spokeswoman
Dorie Nolt said the department
would be concerned if a vendor
were using personally identifiable
information from students' educational
records to target them with
ads, but she would not comment on
whether the department believes
the alleged data-mining practices of
Google Apps for Education violate
federal law.
Joel R. Reidenberg, a law profes-
sor at Fordham University and the
author of a much-discussed recent
study of districts' contracts with
cloud-service providers such as
Google, says that's an open question,
in part because the 40-year-old
FERPA does not adequately define
what constitutes an educational record
in an era in which a previously
unthinkable amount of digital data
about students proliferates.
"The data-mining and data-processing
activities involved in Google
Apps for Education are very prob-
far beyond Google, Mr. Evans said.
A growing number of companies
rely on "freemium" business models
in which they provide technology
services to schools in exchange for
access to an increasingly comprehensive
body of information about
students-including "ambient" data
about where they are located, what
devices they are using, with whom
they are interacting, and more..
As consumers grow savvier, lawsuits
such as the one in California
will become more frequent, Mr.
Evans predicted, and pressure to
modernize state and federal dataprivacy
laws will grow more intense.
The privacy policy for Microsoft's
Office 365, the company's competitor
product for Google Apps for Education,
states "We do not mine your
data for advertising purposes. It is
our policy to not use your data for
purposes other than providing you
productivity services."
That approach was appealing to
Houston school officials, said Mr.
Schad, the district's CTO.
When seeking vendors as part of
its new PowerUp technology initiative,
the Houston district was aware
of the "thousands of other districts
using Google Apps for Education
very successfully," said Mr. Schad,
but ultimately elected to contract
with Microsoft. Google's data-mining
practices were a red flag, he said, as
was the company's lack of responsiveness
to Houston's concerns about how
student data would be handled.
"Four years ago, data privacy was
not on people's radar screens," Mr.
Schad said. "But this issue has legitimate
legs, and big [cloud-based
tool suites] like Google Apps for Education
are going to be under greater
scrutiny."
The Digital Education blog tracks
news and trends on this issue
www.edweek.org/go/digitaleducation
EDUCATION WEEK | March 26, 2014 | www.edweek.org | 23
David Z Einsel/Houston Independent School District-File
http://www.edweek.org/go/digitaleducation http://www.edweek.org
Education Week - March 26, 2014

Table of Contents for the Digital Edition of Education Week - March 26, 2014
