7 Data Privacy Questions to Ask Vendors

As a growing number of software applications collect and store student information in the cloud, concerns have mounted about what will happen to this information—and how it might be used.
Joining the call for stricter rules governing student data use, President Obama is pushing for legislation known as the Student Digital Privacy Act. The measure would require ed-tech companies to use the data they collect about students only for educational purposes—to “teach our children, not to market to our children,” he has said.

That’s a commendable goal, and it’s one that most people would agree on. But enforcing that goal through legislation is a tricky proposition. Even the most well-meaning laws often come with unintended consequences, and some organizations that are strong advocates for student data privacy—such as the Software and Information Industry Association (SIIA)—are on record as saying they are unsure Obama’s proposal is the best way to accomplish this. What’s more, given the current political climate in Washington, who knows how long it might take for a legislative solution to the problem.

While lawmakers grapple with how best to protect student data privacy, school leaders don’t have to wait. There are several steps you can take right now to protect the privacy of student data, such as carefully vetting your ed-tech vendors and holding them accountable in your contracts with them.
With that in mind, here are seven questions to ask your vendors or potential vendors.

1. If their software is free, how do they make money?
If an app or program is completely free, then you are the product. That’s not necessarily a bad thing, as there are several ways that ed-tech companies can make money from you in legitimate ways.

For instance, at Promethean we offer a free, cloud-based application, called ClassFlow, that helps educators teach in technology-rich classrooms, no matter what devices their students are using. While the app is free for teachers, we also sell an enterprise version for districts, complete with analytics tools that give administrators real-time insight into their students’ progress.We use the free version as a way to let teachers try our software, and we hope that administrators will see the program’s value and invest in the enterprise version. But we have a clear business model for making money beyond the free app in a way that does not market to students. That’s something you’ll want to make sure your other vendors have as well.

2. Have they signed the SIIA Student Privacy Pledge?
Last fall, SIIA and the Future of Privacy Forum unveiled a voluntary pledge intended to safeguard student privacy.Ed-tech companies signing the pledge promise to (1) never sell student information or target ads based on student behavior; (2) use student data only for authorized educational purposes; (3) not change their data privacy policies without giving stakeholders notice and choice; (4) enforce strict limits on the retention of student data; (5) allow parents to access, and correct errors in, their children’s information; (6) maintain comprehensive data security standards; and (7) be transparent about how they collect and use student data, among other things.

As of early March, there were 120 signatories, including Promethean. Although there are no formal penalties for signers who violate the pledge, the ill will and bad press from doing so likely would be enough of a deterrent to hold them to their promise.