Student Privacy Principles for the Age of Big Data: Moving Beyond FERPA and FIPPs

This Article demonstrates that FERPA’s regulatory regime does not address contemporary student privacy concerns raised by the rise of big data analytics and data mining, because its framework is an ineffective tool for imposing specific constraints and creating liability and accountability. Despite default provisions based on the Fair Information Practices Principles (FIPPs), FERPA actually delegates most decision-making of student privacy to educational institutions and entities, without requiring meaningful transparency, oversight, or direct accountability due to numerous exceptions to the statute’s consent requirement — particularly the “School Official Exception” that allows schools to share information with online providers.FIPPs-based privacy protection is both ineffective and theoretically unsound in the education context. Rather than refining a regulatory model not designed to provide the control and oversight sought in today’s educational ecosystem, policymakers should focus on reforms that ensure baseline protection of student information, regulate problematic actors and practices directly, and create appropriate consequences for misuse and mismanagement.FERPA’s efficacy rested on assumptions about information practices that no longer hold true given today’s technological capabilities. The limited portability, permeability, and ability to repurpose paper records restricting disclosure to approved recipients prevented unauthorized actors from accessing student information and, in doing so, presumably limited inappropriate use or repurposing. Today, FERPA’s reliance on educational actors’ approval of data recipients does not account for unauthorized, accidental, and frequently unknowing disclosure of personally identifiable student information to outside parties.Legislators have scrambled to propose reforms to address student privacy concerns. These bills add procedural requirements, increased transparency, and more opportunities for parents and students to exercise consent. The amendments also impose substantive restrictions on certain information practices of educational actors and create direct accountability for educational actors through the creation of a private right of action and fines for non-compliance. Finally, they also regulate data recipients indirectly by creating additional qualifications and requiring contractual stipulations.Many of the proposed changes cannot provide the control over personal data and the reassurance sought by stakeholders because these bills still rely on FIPPs-based privacy protection without considering the distinct characteristics of the education context. Notions of notice and consent are particularly problematic where student participation is compulsory, or frequently coerced. Privacy self-management also poses practical, political, pedagogical, political, and philosophical difficulties distinctive to the education context. Further, federal regulation of non-educational actors indirectly through FERPA’s framework is untenable. Additional reform is necessary to address the upset of information norms that made FERPA’s delegation model framework acceptable for almost forty years. These include increasing transparency of information practices regarding student information, imposing procedural and governance requirements to provide more documentation of data flow, and requiring schools to have a comprehensive inventory of their information ecosystem, in a strong effort to regulate educational actors’ collection, use, storage, and retention of student information.