Why parents in a school district near the CIA are forcing tech companies to erase kids’ data
Parents at a public school district in Maryland have won a major victory for student privacy: tech companies that work with the school district now have to purge the data they have collected on students once a year. Experts say the district’s “Data Deletion Week” may be the first of its kind in the country.
It’s not exactly an accident that schools in Montgomery county, in the suburbs of Washington DC, are leading the way on privacy protections for kids. The large school district is near the headquarters of the National Security Agency and the Central Intelligence Agency. It’s a place where many federal employees, lawyers and security experts send their own kids.
As digital surveillance of American students expands rapidly in schools across the country, sparking new debates over tradeoffs between privacy and safety, Montgomery county is a revealing example of what protections some of the nation’s most well-informed, privacy-savvy parents think their children need.
Like thousands of American public school districts, Montgomery county gives students laptops and has hired tech companies to track students’ activities on those computers, including monitoring what they search for and what websites they visit.
This digital surveillance – a booming industry – is marketed as a way to keep kids safe from school shootings and self-harm. It also generates detailed data on individual children. Montgomery county parents fear that data might someday be used against their kids.
This is not a distant worry. Teenagers are already facing consequences for private behavior online. In 2017, Harvard rescinded the admissions of at least 10 incoming students for sharing racist and obscene jokes in a private Facebook group chat. This year, Harvard rescinded an offer of admission to Kyle Kashuv, a conservative activist from Parkland, Florida, because of racist comments he had made in text messages and a shared Google Doc as a 16-year-old, a decision that sparked a heated national debate.
Parents across the US told the Guardian that they were afraid about having detailed educational data about their children – like how quickly they complete their homework – being fed into the enormous black box of the data mining industry. Companies have long gathered, traded and sold vast quantities of data on individuals’ online behavior and consumer purchases, information that is also combined with public voter data and used to create targeted political advertising. Individuals have little way to know how their data is shared from one company to another, and no power to prevent giant, frequent data breaches.
By requiring tech companies to delete data they collect on schoolchildren once a year, parent activists in Montgomery county said they hope to shield kids from being held accountable in adulthood for youthful mistakes, as well as to guard them from exploitation by what one parent termed “the student data surveillance industrial complex”.
Montgomery county public schools tested Data Deletion Week last year and publicly launched the program this past August.
While not all student data is deleted that week, the district works to clean much of students’ digital slates over the summer, including data collected by Google and by GoGuardian, which tracks students’ web searches, according to Peter Cevenini, the district’s chief technology officer.
The district demands more than a vague assurance from tech companies that the data has been erased: “They send us a certification that officially confirms legally that the information has been deleted from their servers,” Cevenini said.
GoGuardian has already submitted its formal certification; the district is still waiting for formal certification from Google, Cevenini said.
One of the parent leaders of the Data Deletion Week campaign was Bradley Shear, an attorney who specializes in social media and privacy policy. Shear said he was attending a conference for privacy law scholars in Washington a few years ago when he received a phone call from his son’s teacher informing him that the second-grader was in trouble for having Googled the song Fuck You, by CeeLo Green, on his school laptop.
Shear said he was certain that his son had not searched for the song on purpose, and that the auto-complete function in Google search was to blame. But the incident prompted him to try to make sure that GoGuardian, which the school pays to monitor students’ search and website visits, would delete the data it had collected on his son.
The response he eventually got from the tech company in 2017, a pledge to delete or “de-identify” his child’s data, was not enough for Shear. As a policy expert who had worked to pass social media privacy laws in states across the country, Shear said, he knew that “de-identified” data could usually be re-identified again.
He decided to push for district-wide changes in how GoGuardian and other companies retain children’s data, including working to educate and organize other parents to push the school district to change its policies and require tech companies to regularly delete student data.
“You don’t need to keep for ever what these kids are searching for online, or what’s in their Gchats,” Shear said.
“Even when data is supposed to only be used for one purpose, it will be used for other purposes,” he added. “We don’t want any of this stuff hanging out and then being used against kids when they apply to college.”
Shear met with district officials to discuss his concerns, and he soon found allies on the district’s active parent-teacher association, which has an entire committee dedicated to “safe technology” issues.
One parent on the safe tech committee, who asked that her name not be used to protect her son’s privacy, had an experience similar to Shear’s.
She said her then eight-year-old son typed in “save the land” when doing a book report on conservation, “and up came the Ku Klux Klan … ‘Save the land, join the Klan.’ He didn’t know what that was,” she said.
When she talked to the teacher and suggested wiping the search from her son’s browser history, the teacher said that would not be possible, the parent recalled.
If anyone was building a digital footprint of her son’s behavior, the parent said, there would now be a visit to a Klan site in it.
“Kids are curious. They’re just going to plug in some key words thinking that they’re funny, and it just might stick,” she said.
“I want my child to do whatever he wants to do with his career and his life,” said Ellen Zavian, a George Washington University law professor and another of the parent advocates. “If he wants to run for office, something he did in second grade shouldn’t hold him back. If he wants to apply for college, he should have no data that the colleges have bought that would provide a negative data point.
“My goal is to have my son have the smallest [data] footprint to give him the largest opportunity,” she said.
Not a simple process
Even with broad parental support, demanding that companies delete student data was not a simple process, Shear said. Parents had to work with the school district to understand what the district had agreed to in its contracts with different technology companies, and to figure out if the contract language needed to be changed. The parents also wanted tech companies not simply to say they had deleted student data, but to certify that they had done so in an official letter to the district.
“It was a complicated process,” Shear said. “It was not something that was so simple.”
While parent fears over student data and privacy are “newer concerns” for school districts, the pushback that the district heard from a few parent activists also amounted to “kind of universal concerns”, and school officials