aws protecting student privacy online have been slow to come to this state, but as federal lawsuits elevate the issue of data mining to the national stage, privacy advocates are calling on the state and its universities to do more.
Del. Anne Kaiser (D-Montgomery) introduced the Student Privacy and Cloud Computing Act this session in order to work to keep student data in cloud networks from being used and sold for commercial purposes. The bill was aimed at protecting students in kindergarten through high school.
Eric Barbalace, a sophomore economics and supply chain management major who interns for Kaiser, said the bill raises an important question as to whether student data should be available for sale.
“Although this data does create a large convenience for members of the educational institutions, it allows the holder of this information to be able to exploit it for a profit,” Barbalace said at a House of Delegates Ways and Means Committee hearing. “Student data should not be for sale.”
Google opposed the bill, and Ron Barnes, head of state legislative affairs for Google, testified in opposition. Barnes said the bill was very broad and he wasn’t sure it would address concerns about student privacy properly. When asked if Google is mining student data, he said he didn’t know.
Despite this, a lawsuit in California alleges Google is collecting student data through Google Apps for Education, which services email accounts for students, staff and faculty within universities. It further claims the data intercepted is then used for profit.
“According to the hearing in the suit, Google is using a content discovery engine on Gmail for education, but suppressing ads,” Chris Hoofnagle, an attorney and lecturer at the University of California, Berkeley, wrote in an email. “This means that Google can determine the content of individuals emails without the individual realizing it.”
In light of the lawsuit, social media attorney Bradley Shear said that while Kaiser’s bill is a good first step, it needs to expand to cover more students.
“We need to have legislation that covers all students,” Shear said. “There’s a real need for legislation or greater awareness for these types of issues.”
One of the issues that concerns Shear in particular is that, without the ads, students are even more unsure about where their information is going and who is using it.
“I highly doubt any University of Maryland student or any other student in the state of Maryland would ever think that the emails that they’re sending on their school-provided email accounts … would ever be used to sell advertising,” Shear said.
Shear said it is hard for lawmakers to understand how important online privacy laws are and more needs to be done to ensure student data isn’t mined and used for profit by outside companies.
“It’s very tough for people to really understand some of these issues out there as far as technology goes,” Shear said. “It takes years after the fact for the law to catch up with technology.”
The best way for institutions to respond to threats to student privacy is to be proactive, Hoofnagle wrote.
“Universities can change to a provider that promises not to engage in such analysis, such as Microsoft, or use an encryption appliance to scramble text of email and other communications before they reach Google,” he wrote.
