Privacy and the Online Pivot

Most colleges and universities across the country have pivoted to remote learning in an effort to stem the spread of the novel coronavirus sweeping the globe.

While the sudden change is necessary, some privacy experts worry about the unintended consequences.

Ensuring the software colleges are now using doesn't violate the Family Educational Rights and Privacy Act, or FERPA, is one key issue, according to Amelia Vance, director of youth and education privacy at the Future of Privacy Forum. Another issue is the potential for increased surveillance of students as colleges switch from in-person classes to virtual ones.

Data Collection

FERPA is technology neutral, according to Leroy Rooker, a senior fellow at the American Association of Collegiate Registrars and Admissions Officers. Colleges are allowed to use contractors and consultants for services -- including for online instruction -- but the contracts need to include stipulations to protect student privacy under the law.

Most importantly, if the vendor collects any data on its users, the college has to be the owner of that information. This means that the data can only be used or redisclosed at the college's direction.

Colleges should be thinking about whether any FERPA-protected information will be revealed in their pivots to remote learning, said Joanna Lyn Grama, associate vice president at Vantage Technology Consulting Group.

"Is there FERPA-protected information that the online provider is potentially creating or storing that's distinct from the school's?" Grama said.

Metadata could be another area of concern, she said. While that data might not be personal information under FERPA, it could be a tool for someone to get personal information.

If colleges are operating under existing contracts with these companies, Grama said, they're likely safe because they took the time for review before the pandemic hit. If they're creating new contracts, those agreements likely are short term, which will give colleges a chance to go back and review them to ensure they're compliant once things settle down.

Some have concern over Zoom Video Communications Inc., a web-conferencing platform that many faculty members are now using to connect with students virtually.

Zoom does not sell its data to anyone and is compliant with FERPA, according to emailed responses the company sent to Inside Higher Ed.

"We take our users’ privacy incredibly seriously. Zoom only collects user data to the extent it is absolutely necessary to provide technical and operational support, and to improve our services. Zoom must collect technical information like users’ IP address, OS details and device details in order for our service to function properly. When user data is used for service improvement, it is completely anonymized and aggregated immediately upon collection in order to protect users’ identities and privacy," said Jay Clarke, senior privacy program manager at Zoom.

‘Coronavirus Is a Selling Opportunity’

The pandemic also raises broader questions about privacy.

"In some ways, you're inevitably going to have more monitoring of students in order to verify attendance," Vance said. If institutions choose to track how much work students are doing to ensure they're meeting credit hours, or are verifying identification of students for attendance and using tools like facial recognition, it would greatly affect surveillance of students.

But institutions don't have to go that route, according to Bill Fitzgerald, a privacy researcher at Consumer Reports.

"When you don't trust your students, surveillance is what you fall back on," Fitzgerald said.

Instead of testing students in ways that require surveillance to prevent cheating, colleges could instead encourage faculty to use project-based learning and portfolio-based assessments, which require students to truly engage with the work and are more difficult to cheat, he said.

Colleges should be wary of companies that might take advantage of the situation right now to increase surveillance through potentially unnecessary software to monitor students' online work.

"There are people who, right now, are thinking about ways that the coronavirus is a selling opportunity," Fitzgerald said.

Now is not the time to hastily adopt new technology, Fitzgerald said. Rather, it's the time to return to the basics, figure out what works the best for the most people and ensure students are getting the basics they need in order to learn.

"I don't think that anything is etched in stone, but I think we need to embed good practices now," he said.