8 Guidelines On How To Handle Students’ Personal Information

Your school district is an ocean of data. For every student, teacher, and staff member, a treasure trove of sensitive information may be floating beneath the surface.

The problem? You never know when someone might be fishing for it right under your nose. With a wide enough net, they just might get away with a swarm of personal data.

Unfortunately, that’s a reality many schools face on a daily basis, though they might not even realize it. The truth is that student data privacy is constantly being pushed to the limit by a variety of threat vectors. All the while, it’s up to you to prevent sensitive information from escaping your school district.

The good news is we’re here to help. In this guide, we’ll walk you through what’s raising the stakes for student data privacy across the country. Then, we’ll give you eight tips on how to better handle your students’ personal information, especially when it comes to cloud data security.

A deep dive into student data

Whether it be for operational or educational purposes, schools are always looking for new ways to streamline and enhance their processes. Thus, it’s no surprise that information technology is present in nearly every corner of the K-12 ecosystem. From top to bottom, school districts of all shapes and sizes are using cutting-edge tools to create a more collaborative and accessible student learning experience.

The best example of this? Cloud technology. Whether it be Google Workspace, Microsoft 365, or any other edtech tool, cloud service providers are sweeping the education sector. As a matter of fact, virtually all K-12 school districts operate in the cloud using one of these domains.

When remote learning became necessary during the pandemic, districts flocked to the cloud at lightning speed. But just as quickly as they did, student data privacy concerns popped up in (almost) equal measure. Let’s take a look at why the world has taken a renewed interest in protecting student privacy in recent years.

Why is student privacy at risk?

Schools are adopting cloud services and other edtech tools at a nearly record pace. As they do, they’re generating new types of sensitive data that may have never existed before. Between all of the personal computers, mobile devices, school-provided tablets, apps, and cloud services throughout your school district, there’s surely an abundance of student information up for grabs, including:

• Personally identifiable information: Personal information that can be used to identify a student, staff member, or parent, such as names or Social Security numbers.
• Student education records: Grades, class schedules, rosters, attendance, and more.
• Financial information: Credit card numbers, bank accounts, and other payment details.
• Sensitive personal information: A student’s sexual orientation, gender identity, migrant status, etc.
• Login credentials: Usernames, passwords, and email addresses.
• Metadata: Behavioral data such as time spent online, keystroke information, etc.

What’s important to remember is that this is a non-exhaustive list. In all likelihood, there’s exponentially more personal data being generated each and every school day. And to make things more complicated, your third-party service providers are accessing, processing, and collecting these broad categories all the time. It begs the question: What are they doing with all this sensitive information?

If you ask Common Sense Education, they’ll tell you that edtech providers have a history of using student information without the consent of a parent or guardian. In 2018, the organization revealed a startling lack of transparency in the edtech ecosystem.

According to its report, 10% of service providers met the bare minimum for transparency and data privacy. Even worse, the organization found that:

• 38% of edtech providers said they use children’s personal information for third-party marketing.
• 37% allowed collected information to be used by tracking technologies and third-party advertisers.
• 30% indicated they ignore “do not track” requests or other opt-out mechanisms.
• 10% indicated they may create and target profiles of their users.
• 50% said they may allow children’s information to be made publicly visible.

To their credit, 92% of the researched service providers indicated that they used reasonable security measures to protect student information. Nonetheless, this was a revealing peek behind the scenes of what really goes on with your students’ personal data when it’s handed to a third-party vendor.

Okay — but that was in 2018. Surely, things have changed, right?

Not necessarily. A more recent report from Common Sense Education shows that the majority of edtech apps have been selling sensitive data all along. In fact, the report’s findings suggest that somewhere between 58-72% of the industry is actively selling data.

Obviously, this is an issue that demands a resolution. Not only is it a violation of student privacy, but it’s also a major data security and personal safety concern. If a service provider’s security measures are breached or student education records are exposed, it could lead to a number of consequential outcomes, including identity theft or online harassment.

8 tips for handling student data

As a school technology leader, you have an obligation to keep student information safe from unauthorized access. That means you need to integrate data protection and privacy policies into your school’s everyday workflow. But where do you begin?

To help you get started, let’s explore eight tips on handling personal data and protecting student privacy in your school district.

1. Classify your data

Your cloud domain is stuffed to the gills with sensitive data. How do you decide which categories of information need the most protection? This, in a nutshell, is what classifying your data is all about.

Data classification is simply a process of categorizing information based on sensitivity. For example, educational records are a type of sensitive information that needs to be kept private, but personally identifiable information (PII) is so sensitive that it could endanger your students. Therefore, it’s best to apply your most stringent security measures to PII rather than categories that don’t need them.

This helps you optimize your data protection strategy while also making sensitive data easier to protect and retrieve in a hurry.

2. Delete old records regularly (and according to the law)

It’s important to keep the amount of data you need to manage to a minimum. Deleting old, unnecessary files on a regular basis is a good way to reduce your attack surface and minimize data privacy risks.

For example, educational records may no longer be necessary as time moves on. If a student graduates, eventually you won’t need to keep their education record on file. However, student information is subject to standardized record retention policies that vary from state to state.

In Massachusetts, for instance, it’s state law to keep student education records for at least five years after graduation. Permanent records are to be kept for at least sixty years. Elsewhere, other states have stricter retention laws that require a school to retain information for a much longer period — sometimes even 100 years.

Additionally, you’ll want to make sure you’re only keeping employment records and financial information for as long as you need it. Or as long as you’re required to retain it. Social Security Numbers and other personally identifiable information of former employees and contractors are still valuable to criminals out there in the world, whether or not they’re still employed by your district.

3. Evaluate file sharing policies and practices

Make it known to your staff members and students that not all types of information are okay to share without careful consideration.

One of the biggest risks to student privacy is when someone mistakenly shares a file that contains personal details, such as an address or phone number, with someone outside the school district. Develop a policy that specifically prohibits anyone from sharing certain types of records without consent.

Here’s the thing: Just because you have a policy doesn’t mean it’s being followed. With the right tool on your side, you can keep a watchful eye over your cloud domain and ensure that nobody’s improperly sharing sensitive data. In other words, it’s a good way to get people to practice what you preach.

4. Encrypt sensitive information

When using an edtech tool or online service, make sure that the data is stored and transmitted securely. Encryption is a data protection tool that keeps sensitive information confidential when it’s being stored, processed, or shared throughout your domain. Even if an unauthorized person does access the data, they won’t be able to read it without the key.

5. Teach digital citizenship

The more your students and staff know about data privacy and security, the better off they’ll be. Teaching digital citizenship will ensure everyone is on the same page when it comes to protecting student privacy.

Show your users the basics: How to spot a phishing scam, when to update your password, whom it’s safe to share your information with, etc. With a good foundational knowledge, it’ll be a lot easier to prevent risks from popping up in the first place.

6. Know your vulnerabilities

What good are your security measures if you don’t know what you’re up against? Evaluate your risk landscape and identify any and all potential vulnerabilities that might exist. This allows you to more effectively patch the gaps in your defenses so that nothing malicious gets in and sensitive data never gets out.

What’s also key is identifying the threat vectors that will inevitably target your data. Familiarize yourself with the most common risk factors — phishing, malware, ransomware, etc. — so that you know what to look out for when protecting your data.

7. Audit your third-party vendors

Third-party vendors have access to loads of sensitive data. You need to be sure that your chosen applications have solid privacy policies and data security practices in place before allowing them free reign over student information.

Evaluate your list of existing vendors and comb through their policies. Perform a quick search to see if they have a history of shady data-sharing agreements. Remove any unauthorized apps that students and staff members may have installed, as these can potentially put data in jeopardy.

8. Take advantage of cloud security automation

The tips outlined above are essential to securing your students’ personal information. Unfortunately, they’re not that easy to implement without the right solution. With a cloud security platform like ManagedMethods, you can automate critical tasks and streamline your workflows for a faster, optimized data privacy program.

From data classification and threat detection to incident management and investigation, you can amplify your data protection strategy with an extra layer of cloud security — squeezed right between you and your third-party vendors.