Technology: “Zooming In On Remote Learning: How To Protect K-12 Students’ Privacy In Virtual Classrooms?”

Policy Paper by Kiara Anthony, Cordelia Bellinson, Audrey Bertin, and Christine Kim.

Executive Summary:

This proposal would provide data privacy protections to K-12 students by extending all-party consent laws to the manufacturing and distribution of recordings on virtual education platforms for public school students nationwide.

Abstract:

In response to concerns about data privacy raised by the move to virtual learning during the COVID-19 pandemic, our proposal recommends the implementation of a national policy under which no K-12 public school student may be recorded on a virtual learning platform without written consent from that student’s parent or legal guardian. The structure of the policy will draw on statewide “all-party consent” recording laws, in which recordings of individuals’ activities and conversations in settings entailing “a reasonable expectation of privacy” are not legally permissible without the consent of all parties involved. In its implementation, our policy would entitle students to data privacy protections on the grounds that in-person educational settings entail such an expectation, and will allow them access to this privacy without having to compromise the degree to which they participate on virtual learning platforms.

It is imperative that such a policy be championed by the Federal Trade Commission, as it necessitates amendment of the Commission’s Children’s Online Privacy Protection Rule. In addition, deeply implicated in the policy’s implementation is the U.S. Department of Education’s Student Privacy Policy Office, given the Office’s federal role in protecting the privacy of students.

Introduction:

In an already internet-dependent society, the COVID-19 pandemic has thrust everyone from kindergarteners to CEOs into the world of virtual communication platforms. In K-12 public schools, students now attend class by joining sessions hosted through virtual learning platforms like Zoom, Microsoft Teams, WebEx, and Google Hangouts; additionally, in order to compensate for the lack of direct in-person instruction, many school districts and educators have chosen to record these virtual classes so that students might review the recorded sessions at their leisure.

However, these practices give rise to concerns about both the security of third-party platforms on which students are being recorded and the ethical implications of recording students in classroom environments, especially since the United States has no central federal data privacy law. Recordings captured with virtual learning platforms are subject to data breaches, in which files thought to be private–and which contain personally identifying information about students–are found to be accessible to the public. As an example, earlier this year, thousands of Zoom recordings containing private and personal information were found exposed on the internet. Some of these recordings were of elementary school classrooms, in which childrens’ faces, voices, and personal details were revealed (Harwell, 2020). K-12 students undergo intense intellectual and emotional development over the course of their school career; they deserve a classroom setting which entitles them to freedom of discourse and the security of knowing that their actions are not being recorded and leaked across the internet for all to see.

At present, the only measures students can take to avoid being captured by class recordings are to deactivate their microphones or video cameras and avoid participating in class activities, all of which put them at risk of academic penalization and educational detriment. Though federal laws protecting the data privacy of K-12 do exist, namely the Family Educational Rights and Privacy Act (FERPA, 1974) and the Children’s Online Privacy Protection Rule (COPPA, 1998), they fail to address such issues resulting from the rapid move to virtual learning and provide sufficient legal protection to such students.

In order to protect students from potential unwanted privacy violations, we recommend the creation of a new policy focused specifically on regulating the recording of students in virtual learning environments and requiring express written consent for manufacturing such recordings.

Policy Recommendation:

Our policy will prohibit the manufacturing of recordings of K-12 public school courses over virtual learning platforms without express written consent from a representative individual, as well as the distribution of such recordings. Although express written consent is not required to permit the legal recording of conversations in most states (Anderson, 2017), we argue the need for a stricter consent standard in K-12 educational settings. Under our policy:

1. No student shall be recorded over a virtual learning platform without the express written consent of a parent or legal guardian to do so. As examples of alternatives to full class recordings, instructors may choose to record only their own video and audio — a feature already provided by several of the most common virtual learning platforms and which can be implemented in others with minimal effort — or may choose not to record at all, instead sharing presentation slides and other materials with students for review outside of class.
2. Written consent for a student to be recorded may be given only by that student’s parent or legal guardian — except in cases where the student is an emancipated minor or over the age of 18, in which case that student is the agent of consent–using a standardized form to be delivered before the start of the academic period. For the benefit of the relevant parties, this form will contain a brief summary of how class recordings will be created, stored, and used. The form will also enumerate the mediums on which recordings will operate — e.g. audio, video, text — and the parties who have access to the recordings.
3. Consent to be recorded on a virtual learning platform is to be given or refused by the student’s representatives before the start of the academic term. Failure to submit a form on the part of the child’s representatives will be considered a refusal to consent.
4. Class recordings are to be restricted for educational use only by the following stipulations: recordings may be uploaded only onto a site utilizing multi-key encryption technology, to which access is limited — via password protection — to only the instructor and students currently enrolled in the course. Downloading class recordings is authorized only on the part of the instructor, and only insofar as is necessary to upload the recordings to said site. No further distribution of the recordings is permissible. Recordings are to be deleted no later than 90 days after the course’s conclusion.
5. Furthermore, no student will be penalized or educationally disadvantaged in the event that consent for that student to be recorded is not given by a parent or legal guardian. “Penalization” and “educational disadvantage” here include but are not limited to the following consequences:
   I. Being told to participate less extensively in class activities.
   II. Not being able to attend class synchronously without being recorded.
   III. Being academically disciplined through the institution of participation or grade reductions.

Acting as legal precedent to this policy are statewide all-party consent recording laws, under which the act of recording activities and conversations of others without their consent is prohibited in settings which entail a reasonable expectation of privacy (Kayyali & Zammuto, 2019; 191st General Court of MA, n.d.). Though such laws have not yet been adopted on a federal level, increasing privacy concerns nationwide related to recording — especially in consideration of the degree to which minors’ lives are recorded online — make all-party consent laws strong candidates for adaptation on a national scale to protect the data privacy of K-12 students.

The policy is based primarily on statewide all-party consent laws, but it is also grounded in fundamental policies related to K-12 students’ rights. Chief among these are two pieces of federal legislation: the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Rule (COPPA).

FERPA’s primary purpose is to protect the privacy of students’ educational records, defined by the Act as “records that are: (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution”: including, but not limited to, academic transcripts, grades, letters of recommendation, and school attendance histories. For students under the age of 18, such records can only be disclosed to third parties if the educational institution to which the student belongs obtains the signature of the student’s parent or legal guardian on a document identifying the information to be disclosed, the reason for the disclosure, and the parties to whom the disclosure is being made (FERPA, 1974).

However, FERPA stipulations are somewhat limited in their ability to protect students from unwanted video recording over virtual learning platforms. Under FERPA, class recordings do not always meet the standards for classification as educational records (Kaufmann, n.d.; Gutierrez, 2019). Video recordings are only considered educational records if the information and image within are directly related to or focused on a particular student and maintained by an educational agency, institution, or by a party on their behalf. This is typically not true of a classroom discussion or lecture of which the focus may be divided among many students participating in a conversation. When this is the case, FERPA may not prevent a district from releasing unredacted video recordings of student activities, even if the students shown therein were personally identifiable.

One might be led to conclude that concerns over this vulnerability could be resolved by classifying all class recordings as educational records. However, educational records must be maintained throughout students’ educational careers. Our policy stipulates that video recordings of a given course be deleted no later than 90 days after the course’s conclusion; storing courses as educational records each year would likely make undue technological demands of public school systems, and deleting class recordings after a course’s conclusion addresses privacy threats related to recordings’ storage and use.

Our proposed policy would therefore not amend FERPA’s definition of “educational records”, but complement it by protecting class recordings on virtual learning platforms under new stipulations.

COPPA, the second major piece of federal legislation protecting K-12 students’ rights, limits the ability of websites and online services directed to children under 13 years of age to collect personally identifiable information (PII). In most cases, involved companies are required to provide notice of their data collection and distribution practices and obtain verifiable parental consent (COPPA, 1998).

Comprehensive though this requirement may seem, COPPA stipulations do not apply in situations relating to minors over the age of 13 (Schifferle, 2020). Additionally, COPPA’s rules governing consent in schools are arguably more lenient than those governing consent in other online spaces: educational institutions can consent to the sharing of students’ information on behalf of their parents, as long as the service in question is being used for a school-authorized educational purpose and not for any other commercial reason (Federal Trade Commission, 2020).

Our policy would mandate that minors be represented by a parent or legal guardian, for which we cite as precedent:
The Every Student Succeeds Act (ESSA), which acknowledges that parents or legal guardians need act as representatives for minors in a situation involving transmission of personal information from the school to military recruiters (ESSA, 2015);
Individuals with Disabilities Education Act (IDEA), under which parents or legal guardians must provide consent for an educational institution to evaluate a minor in a way that might impact their education (IDEA, 2004).

These two policies are cited in acknowledgement of the fact that parents or legal guardians represent minors in circumstances involving acquisition of personally identifiable information by both a third party (i.e. a virtual learning platform) and the educational institution itself. Though the policies relate specifically to parents or guardians consenting to the release of educational records, we argue that since a K-12 educational environment entails a reasonable expectation of privacy and personally identifiable information may be revealed during a class recording not designated an educational record under FERPA, an analogy linking these policies and class recordings on virtual learning platforms is justified.

Our policy would therefore amend COPPA such that educational institutions would need to seek consent from parents or legal guardians in order to obtain consent to the manufacturing and distribution of class recordings on virtual learning platforms.

Some might also argue that it would be more effective and simple to place a strict ban on recording K-12 classes. However, we believe that such a policy would lead to unnecessary harm by disadvantaging further students who struggle with virtual learning, especially students with learning disabilities. Recording classes has been shown to benefit students’ learning as a whole, allowing them to review topics in greater detail and achieve stronger understanding of material from missed classes; however, the benefits of class recordings become near-essential in times of crisis when remote learning is commonplace. (Morris et al., 2019) In such times, students are more likely to have their traditional learning patterns and systems interrupted, face distraction from events outside of school that may affect their learning ability, and need to miss class more often. Our policy offers flexibility to students who rely on class recordings while protecting the privacy of those wishing not to be recorded.

Our policy would affect the four following primary stakeholders: K-12 students, their parents or legal guardians, virtual learning platforms, and K-12 public school administrators. K-12 students and their parents or legal guardians are the direct recipients of the policy’s benefits. Virtual learning platforms, schools, and instructors would be responsible for carrying the burden of policy implementation. However, this burden would be relatively minimal compared with the policy’s likely benefits.

Virtual learning platforms without functionalities in their software allowing hosts to record only themselves, such that their software could be used in virtual classes wherein students did not consent to being recorded, would need to implement such functionalities in order to remain competitive in the market. However, this is a relatively easily and quickly accomplished upgrade.

School administrators and instructors would be responsible for overseeing the distribution and processing of consent forms and the operation of classes in which students’ representatives do not consent to recording. Given that consent forms are already commonplace in schools under laws like IDEA and ESSA, schools already have experience working with such forms and would only need to make minor updates to procedure. Apart from the manufacturing of such forms, our policy does not impose any significant costs on schools.

Conclusion:

While over 80 countries have passed comprehensive data privacy laws, the U.S. has only passed small regional measures and put out broad guidelines for online conduct: a dramatic underreaction to the data threats faced by its citizens. Minors, many of whom conduct their social, academic, and professional activities over the internet, are left particularly vulnerable in this sense: especially in the new era of virtual learning, wherein normally in-person classroom activities and discussions are being captured in video recordings over virtual learning platforms, putting students’ conversations and identifying information at risk of unwanted viewing and distribution.

Although several laws exist to protect minors in educational settings, these fail to account for the challenges faced in the remote learning realm, allowing students to be recorded without their parents’ or legal guardians’ express consent and failing to prevent such recordings from being exposed to the public.

Free discussion and exchange of ideas are critical to the educational development of minors. Without well-defined consent law in remote learning environments, these educational tenets are put in jeopardy. Students who desire not to be recorded have no legal protection in doing so, and as such place themselves at risk of academic penalty for failing to properly participate.

We argue the need for a new policy applying to K-12 virtual learning environments, which affords students and their families the legal right to choose not to be recorded without fear of punishment.

We hope that our policy will not only provide a safe space online for K-12 students in public schools to develop as intellectual beings, but act as a cornerstone for future federal legislation protecting vulnerable groups from data threats online, including K-12 students at private and charter schools, individuals with disabilities, and senior citizens.

References:

191st General Court of the Commonwealth of Massachusetts. (n.d.).
Massachusetts General Laws Part IV, Title I, Chapter 272, Section 99: Interception of wire and oral communications. Retrieved October 24, 2020, from https://malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/Chapter272/Section99

Anderson, A. (2017). Classroom Taping Under Legal Scrutiny–A Road Map for a Law
School Policy. Journal of Legal Education, 66(2), 372–408.

Children’s Online Privacy Protection Rule (COPPA), 15 U.S.C. § 6501–6505 (1998).

Every Student Succeeds Act (ESSA), 20 U.S.C. ch. 28 § 1001 et seq. 20 U.S.C. ch. 70
(2015).

Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g; 34 CFR Part
99 (1974).

Federal Trade Commission. (2020, July 22). Complying with COPPA: Frequently Asked
Questions. Retrieved October 24, 2020, from https://www.ftc.gov/tips-advice
/business-center/guidance/complying-coppa-frequently-asked-questions-0

Gutierrez, I. R. (2019, October 18). Recording Devices in Public Schools: Commonly
Asked Questions. Retrieved October 24, 2020, from http://www.millernash.com/
recording-devices-in-public-schools-commonly-asked-questions-11–15–2019/

Harwell, D. (2020, April 24). Thousands of Zoom video calls left exposed on open Web.
Retrieved October 24, 2020, from https://www.washingtonpost.com/technology/
2020/04/03/thousands-zoom-video-calls-left-exposed-open-web/

Individuals With Disabilities Education Act (IDEA), 20 U.S.C. § 1400 (2004).

Kaufmann, M. (n.d.). U.S. Department of Education Clarifies That Video Recording
Virtual Lessons and Making Them Available to Students Does Not Violate FERPA and Provides Other Advice on FERPA Compliance in the Age of Virtual Learning. Retrieved October 24, 2020, from https://www.jdsupra.com/legalnews/
u-s-department-of-education-clarifies-41746/

Kayyali, D., & Zammuto, J. (2019, September 20). How Could States’ Wiretapping Laws
Affect Your Right to Film Law Enforcement? Retrieved October 24, 2020, from
https://lab.witness.org/how-could-states-wiretapping-laws-affect-your-right-tofilm-l
aw-enforcement/

Morris, N. P., Swinnerton, B., & Coop, T. (2019). Lecture recordings to support learning:
A contested space between students and teachers. Computers & Education,
140, 103604.

Schifferle, L. W. (2020, April 09). COPPA Guidance for Ed Tech Companies and
Schools during the Coronavirus. Retrieved October 24, 2020, from
https://www.ftc.gov/news-events/blogs/business-blog/2020/04/coppa-guidance-ed-tech-companies-schools-during-coronavirus

This was one of the winning papers in “Pandemic Policython” for Technology track.