Parents at a public school district in Maryland have won a major victory for student privacy: tech companies that work with the school district now have to purge the data they have collected on students once a year. Experts say the district’s “Data Deletion Week” may be the first of its kind in the country.
It’s not exactly an accident that schools in Montgomery county, in the suburbs of Washington DC, are leading the way on privacy protections for kids. The large school district is near the headquarters of the National Security Agency and the Central Intelligence Agency. It’s a place where many federal employees, lawyers and security experts send their own kids.
As digital surveillance of American students expands rapidly in schools across the country, sparking new debates over tradeoffs between privacy and safety, Montgomery county is a revealing example of what protections some of the nation’s most well-informed, privacy-savvy parents think their children need.
Like thousands of American public school districts, Montgomery county gives students laptops and has hired tech companies to track students’ activities on those computers, including monitoring what they search for and what websites they visit.
This digital surveillance – a booming industry – is marketed as a way to keep kids safe from school shootings and self-harm. It also generates detailed data on individual children. Montgomery county parents fear that data might someday be used against their kids.
This is not a distant worry. Teenagers are already facing consequences for private behavior online. In 2017, Harvard rescinded the admissions of at least 10 incoming students for sharing racist and obscene jokes in a private Facebook group chat. This year, Harvard rescinded an offer of admission to Kyle Kashuv, a conservative activist from Parkland, Florida, because of racist comments he had made in text messages and a shared Google Doc as a 16-year-old, a decision that sparked a heated national debate.
Parents across the US told the Guardian that they were afraid about having detailed educational data about their children – like how quickly they complete their homework – being fed into the enormous black box of the data mining industry. Companies have long gathered, traded and sold vast quantities of data on individuals’ online behavior and consumer purchases, information that is also combined with public voter data and used to create targeted political advertising. Individuals have little way to know how their data is shared from one company to another, and no power to prevent giant, frequent data breaches.
By requiring tech companies to delete data they collect on schoolchildren once a year, parent activists in Montgomery county said they hope to shield kids from being held accountable in adulthood for youthful mistakes, as well as to guard them from exploitation by what one parent termed “the student data surveillance industrial complex”.
Montgomery county public schools tested Data Deletion Week last year and publicly launched the program this past August.
While not all student data is deleted that week, the district works to clean much of students’ digital slates over the summer, including data collected by Google and by GoGuardian, which tracks students’ web searches, according to Peter Cevenini, the district’s chief technology officer.
The district demands more than a vague assurance from tech companies that the data has been erased: “They send us a certification that officially confirms legally that the information has been deleted from their servers,” Cevenini said.
GoGuardian has already submitted its formal certification; the district is still waiting for formal certification from Google, Cevenini said.
One of the parent leaders of the Data Deletion Week campaign was Bradley Shear, an attorney who specializes in social media and privacy policy. Shear said he was attending a conference for privacy law scholars in Washington a few years ago when he received a phone call from his son’s teacher informing him that the second-grader was in trouble for having Googled the song Fuck You, by CeeLo Green, on his school laptop.
Shear said he was certain that his son had not searched for the song on purpose, and that the auto-complete function in Google search was to blame. But the incident prompted him to try to make sure that GoGuardian, which the school pays to monitor students’ search and website visits, would delete the data it had collected on his son.
The response he eventually got from the tech company in 2017, a pledge to delete or “de-identify” his child’s data, was not enough for Shear. As a policy expert who had worked to pass social media privacy laws in states across the country, Shear said, he knew that “de-identified” data could usually be re-identified again.
He decided to push for district-wide changes in how GoGuardian and other companies retain children’s data, including working to educate and organize other parents to push the school district to change its policies and require tech companies to regularly delete student data.
“You don’t need to keep for ever what these kids are searching for online, or what’s in their Gchats,” Shear said.
“Even when data is supposed to only be used for one purpose, it will be used for other purposes,” he added. “We don’t want any of this stuff hanging out and then being used against kids when they apply to college.”
Shear met with district officials to discuss his concerns, and he soon found allies on the district’s active parent-teacher association, which has an entire committee dedicated to “safe technology” issues.
One parent on the safe tech committee, who asked that her name not be used to protect her son’s privacy, had an experience similar to Shear’s.
She said her then eight-year-old son typed in “save the land” when doing a book report on conservation, “and up came the Ku Klux Klan … ‘Save the land, join the Klan.’ He didn’t know what that was,” she said.
When she talked to the teacher and suggested wiping the search from her son’s browser history, the teacher said that would not be possible, the parent recalled.
If anyone was building a digital footprint of her son’s behavior, the parent said, there would now be a visit to a Klan site in it.
“Kids are curious. They’re just going to plug in some key words thinking that they’re funny, and it just might stick,” she said.
“I want my child to do whatever he wants to do with his career and his life,” said Ellen Zavian, a George Washington University law professor and another of the parent advocates. “If he wants to run for office, something he did in second grade shouldn’t hold him back. If he wants to apply for college, he should have no data that the colleges have bought that would provide a negative data point.
“My goal is to have my son have the smallest [data] footprint to give him the largest opportunity,” she said.
Not a simple process
Even with broad parental support, demanding that companies delete student data was not a simple process, Shear said. Parents had to work with the school district to understand what the district had agreed to in its contracts with different technology companies, and to figure out if the contract language needed to be changed. The parents also wanted tech companies not simply to say they had deleted student data, but to certify that they had done so in an official letter to the district.
“It was a complicated process,” Shear said. “It was not something that was so simple.”
While parent fears over student data and privacy are “newer concerns” for school districts, the pushback that the district heard from a few parent activists also amounted to “kind of universal concerns”, and school officials decided to “get ahead of the game and see how we can address them”, Cevenini, the district’s chief technology officer, said.
Amelia Vance, the director of education privacy at the Future of Privacy Forum, said that, as far as she is aware, Montgomery county is the only American school district to have implemented an annual Data Deletion Week, although parent activists across the country have pushed for other student privacy laws at the state level.
Deleting records of students’ online behavior on a regular basis is a “fabulous” choice, Vance said, but doing it just once a year might not be frequent enough. Video surveillance footage is often deleted once a month, just long enough to be clear if there’s an incident that needs to be reviewed, she said, and a similar 30-day time period might also be appropriate for students’ online behavior.
While there are good reasons for schools to monitor students’ internet usage – like making sure that “students aren’t being radicalized on YouTube” or “viewing totally inappropriate content”, Vance said, that monitoring can also be “incredibly invasive”.
“It’s essentially a reflection of every aspect of kids’ lives today,” she said. “It is every question they ask in their brain and type into Google to see if there’s an answer. It’s every chat message that they type to their friends, every essay they write for English class.”
But school districts also may face some barriers in developing Data Deletion Week policies, she said, including different state data retention laws, and parents’ and students’ desire to be able to save some of their school projects from frequent data purges.
Shear, the attorney who led the push for Data Deletion Week, said he sees the rapid growth of the school surveillance industry as a “huge issue” and one that needed much more attention from students and their families.
“Most parents don’t understand these issues until something happens,” he said. “You don’t really care about something until you’re discriminated against, or until you lose out to another person based on something you might never even have thought of.”
The Montgomery county parent activists acknowledged that their push to change their district’s policies benefited from the expertise of the Washington-area parents involved, which included not only attorneys but people with expertise in security, privacy and politics.
Having that kind of expertise behind a parent privacy campaign “is unusual”, Zavian said. “But it doesn’t mean that other communities can’t pull on those resources. They have them. They just have to find them. It may take a little longer.”
