Privacy of Education Data

I’ve recently received several emails urging me to support House 331, An Act prohibiting service providers who offer cloud computing services to K-12 educational institutions from processing student data for commercial purposes.

House 331 is very straightforward. It reads in full as follows:

Section 1. Notwithstanding any general or special law to the contrary any person who provides a cloud computing service to an educational institution operating within the State shall process data of a student enrolled in kindergarten through twelfth grade for the sole purpose of providing the cloud computing service to the educational institution and shall not process such data for any commercial purpose, including but not limited to advertising purposes that benefit the cloud computing service provider.

The emails I’ve received urge as follows:

I am writing to you in support of Bill H.331, An Act prohibiting service providers who offer cloud computing services to K-12 educational institutions from processing student data for commercial purposes.

I believe that one of the best things about our state is the great quality of our public schools. Recently, I learned that cloud service providers that have contracts with many Massachusetts school districts are able to collect student data, which could then be used for commercial purposes. Students and their parents are typically unaware that it is taking place and it potentially violates their privacy. There should be certain rules prohibiting this type of data collection and targeting that cloud service providers must adhere to when their products are being used in schools.

As an elected leader who cares about quality education and a safe environment for our children, please support the passage of H.331 and protect the students of your district and improve the quality of their technology experience by supporting this legislation.

Of course, I believe in protecting the personal data of students. However, the business model of many successful new internet businesses does involve the provision of services in exchange for limited use of personal data for advertising purposes. Of course, the number one example is Google which provides outstanding search services in return for the right to serve advertising based on personal interests.

I want to make sure that privacy of minors is well protected, but I’m not sure I would support a blanket approach as in House 331. I definitely think this issue needs more study. I welcome the national attention that the issue is getting. The devil is in the details and the state and each school district needs to be giving close attention to privacy protections built in to each tool that they use.