0:05
Hi, good morning, everyone, Good afternoon, or good evening, depending on where you are. Thank you for joining us today for our webinar.
0:14
We’re excited to have an expert panel to discuss student data privacy, and how you can prepare your district and set yourself up for success this year.
0:26
I would like to start by introducing myself. I’m Vice President of Product Marketing at Lightspeed Systems.
0:33
We are dedicated to providing solutions to districts across the US and globally that provide safe, secure, and equitable education.
0:45
Today, I’m joined by three distinguished panelists, Kevin Lewis, the Data Privacy Officer at one Ed Tech Consortium, Jim Siegl, senior technologist at the Future of Privacy Forum and Jim Farmer, the CTO at Fayette County Schools in Georgia. So thank you all three for joining us.
1:07
I want to just remind our audience that we will be taking a Q&A session towards the end of our discussion.
1:14
And so, we are interested in your feedback, your questions, and observations based on the work that you’re doing in the field.
1:22
Please add those into the question box throughout the session, so that we can make sure that we can add those into the discussion.
1:31
Again. Thank you so much for joining us today.
1:33
We will be sharing the presentation as a resource and some resources throughout the presentation for your benefit OK, great, so I’d like to start today with allowing our panelists to introduce themselves a little bit about their background and the work that they’ve been doing in Education So let’s start with Kevin. Kevin, please take a minute to introduce yourself.
1:59
Absolutely. Thank you. Hi. My name is Kevin Lewis. I am the Data Privacy Officer at … checked.
2:06
My previous role kind of got mission started on my the privacy work that I do now with the Houston Independent School District, where I headed. There are student data privacy initiatives there.
2:16
I work with both schools and suppliers to promote transparency and communication with their privacy policies, assist schools in knowing the right questions to ask the weight of those questions, and then assisting suppliers in keeping them updated on the Internet Information that they need to sort of better create a policy and a culture of privacy within their organization that puts that shows their best foot forward for schools. And so, for both schools and supplies to work together, I’m sort of that middleman to assist in that communication in that collaboration often spreads.
2:49
Great, Kevin, thank you so much for joining us today.
2:52
Next, Jim Farmer, can you please introduce herself?
2:55
Thank you very much, Klaire. It’s great to be here with you. all our guests. My name is Jim Farmer, I’m the Chief Technology Officer in Fayette County Schools. Which is just south of Atlanta and Georgia.
3:07
I’m going on my six year there as a CTO, previous to that, I started my career in Broward County, Florida as a teacher and a Technology Specialist from Teaching elementary to working at the district level. And then moved to Georgia in 2004 and worked in South Georgia.
3:30
And also, Apigee, OK for Gnocchi Risa doing a little bit of consulting training and you know, a little bit of everything when it comes to technology and supporting the schools in that region.
3:42
And as I said, I’ve been in Fayette County now for going on six years. Great to be with you guys.
3:49
Thank you, Jim. and now I’d like you to introduce yourself Jim Siegl. Thank you for joining us today.
3:54
Great. Thank you and it’s great to be able to talk about this important topic.
3:58
So, I am a senior technologist at the Future of Privacy Forum on the youth and education team. We’re a privacy think tank. But before that, I was the technology architect for 19 years for Fairfax County Public Schools. So I’ve spent a lot of time sitting at that intersection of policy and technology, and I had the chance to work on a lot of the initiatives that we’re gonna be talking about today, Clothespins, Privacy Tool Kit, Common Sense Media Privacy Readings and the Student Data Privacy.
4:33
Great.
4:34
So again, these are three big hitters in the in this area of how do how to manage student data privacy what what you need to know about regulations today? Working with vendors, and ensuring that your district is in a good place. So, again, please make sure that you ask any questions, this is a great time, and you have some great experts here, to provide the information that you may be looking for. OK, so we’re gonna start off with a little bit of an icebreaker kind of question.
5:04
Um, really, it’s around, Like, what are some data points or stories that you, as panelists have heard recently that really made you stand up and think more closely about what are we doing around student data privacy.
5:17
I have one here on the screen that we recently have seen coming out of the site, the Cybersecurity I’m sorry, cybersecurity and infirm Infrastructure Security Agency.
5:31
And this number is pretty astounding, that between 2018 and 2021, the number of cyber incidents in schools and districts has rose from 400 to over 1300.
5:45
So a big data point there, Kevin, what are some, what are some things or what does the data point that you’ve heard recently or or talked to districts or vendors about that, need you stand up and take notice?
5:59
So the biggest thing that I can say, I’ve heard and am currently experienced.
6:05
See there’s just the sheer number of applications that are being requested for venting from the schools and the types of requirements that are being asked of suppliers there. So being that sort of that Middleman when I’m talking to suppliers.
6:23
They understand like the types of ask the questions that they’re getting, but it’s sort of frustrating to them because there are so many, and for schools, when we talk about sort of the cybersecurity, the different incidences and, uh, the opportunity four inches and just allowing hundred thousands and thousands of applications into there.
6:49
Districts vetting anything and everything, and not keeping those sort of short set of vetted or trusted applications. It’s been the hardest thing.
7:00
So for schools, they’re requesting reviews and a lot of applications, not realizing that, you know, you’re opening the opportunity for more and more incidents. And so we try to get ahead of it by bedding and reviewing, hoping to keep them safe and secure as possible.
7:16
But at the same time, we’re sort of opening the floodgates and letting all of those different resources and, you know, no matter how well they are, bed, you know, security is, is a whole new sort of master there. If someone wants to do something, they can, they can find a way to do it. And so, it’s, it’s between a rock and a hard place, you know, vetting, seeing all of the requests coming in, knowing that a school is using way too. Many digital resources, or applications at the teachers are requesting. However, they’re getting those requests and then, you know, just being able to go ahead and get those requests done knowing that, it’s probably a little too much, I would say.
7:56
OK, so just the sheer number of applications and digital tools that districts are currently using is kind of a Stand-up moment for from what you’re saying. Kevin, what about you, Jim?
8:09
Jim FERS: Oh, I forgot I have to. I will start with him or her.
8:17
Well, I think I would um, I echo a little bit of what Kevin said when we did an internal audit just for a snapshot of one week. We had over 4500 applications being used in our district.
8:32
So that number was a little, you know, shocking and frightening.
8:39
Obviously, the security and privacy side, knowing that we had those many things that were being used.
8:46
It doesn’t necessarily mean that they all had student data in them, but just that number was just so overwhelming.
8:53
That’s one thing that kind of sticks out to me.
8:56
The other thing I often reference is, I think it was going on two years ago now, but when it comes to cybersecurity, which this quote, you know, kind of, references here, and the … stuff is excellent as a resource, and reference and guide.
9:14
All right.
9:16
No.
9:16
Fire, I was a cyber consulting agency and they were probably one of the premier reputation, you know, for cyber consulting and they got breached.
9:27
And that always stuck with me because it’s up a premier, top tier cyber agency could be breached. Where does that put our K-12 systems?
9:38
And it was, you know, another point.
9:41
You know, how we are woefully in need of assistance, and guidance, and any kind of help we can get, because it is such an important topic, and if a premier agency can be breached, where does that put us?
9:59
Thank you. Jim Siegl. Let’s wrap this up on this.
10:03
So I’m going to take the opportunity to kind of put us a little bit different spin on this, and think about a past story, and then look ahead to a future story that is keeping me up.
10:13
So when we look back at the last year and something like the Supreme Court’s tops decision around reproductive rights, and what keeps me up is thinking about the intersection of student privacy laws.
10:29
When most of our schools are running content filters that are capturing and logging students’ searches and Internet traffic, and thinking about the potential, that is very likely that sometime this, you know, in the next year you might see a school have their search records or their content filters subpoenaed. So being, what does that mean as practitioners, as technologists, as privacy professionals? Should we be thinking about how we’re logging that information, how we’re deleting that information, how we’re flagging that information, and categorizing it. So I kinda think about recent events.
11:11
and then look ahead to what, how that should inform us about future stories and practices, the data retention practices, and potentially how the government may be getting involved. Interesting.
11:26
OK, great. So we’re going to move ahead to our first discussion point, which is what is different today about the need to secure student and district’s data?
11:37
It’s always been an issue, but I guess the question that we’re posing here is, We’re more and more of our district leaders are talking about it. More and more regulators are having this discussion. So, why is it different today?
11:52
Let’s start with you, Jim Siegl sure, in my, in my previous role, I spent a lot of time thinking about risk and we’re talking about risk in terms of probability and impact. So, I think there’s four things.
12:05
The volume, the volume of ed tech apps, and Kevin and Jim talked about that in the intro in.
12:12
Increase in apps, and just the proliferation of 1-to-1 devices after the attendant, the increase in parental awareness during the pandemic parents were, had a front row seat of what apps were being used at home.
12:27
The, the volume of threats, and we talked about security in the ransomware, and the volume of compliance requirements, and we’ll talk about a little bit later about the increase in the number of state level laws that are putting new compliance requirements around student privacy. So I think all of that has just really raise the volume and the level.
12:53
Those are great. Those are great points from the the SQL, I mean, the increase in device usage across districts going from kind of not 1 to 1 to now scaling, to 1 to 1 or 2 to 1 in some districts.
13:07
And then the volume of ed tech tools, and just digital learning, that’s happening in the classroom and outside of the classroom.
13:14
Kevin, let’s go to you on that.
13:16
Why do you think today we need to be focus more than ever on this on this issue?
13:27
Kevin, I think you’re muted.
13:30
Had to happen, right?
13:32
On the head with that one job, because it’s really the difference today versus in the past, is, schools are now more schools now, more than, in previous years, have gone 1-to-1. There are more devices in the hands of students taking them home, or have a device available for them every day in the classroom, with more devices, comes more digital resources, more tools. More applications that are on the district network is just an abundance, an overwhelming abundance of applications. And now, you know, everyone in education is familiar with the term Wild Wild West. And now getting all of those things back, you know, sort of wrangling all of those in and making sure that, OK, hey, you know, we need to start thinking about privacy, we need to see about all of these resources. And so, it’s really like, you know, we just said, and I’ll just keep beating this horse here. It’s the abundance of resources, the availability of devices.
14:40
Great. And Jim Farmer as as a current CTO, how do you feel about this topic?
14:46
Yeah. So, I think it is a combination for sure.
14:52
Dramatic increase in usage with districts go into 1-to-1 with having to go virtual for an extended amount of time.
15:00
Absolutely.
15:01
Opened the floodgates for a lot more apps to be used and teachers to rely on that because they had to, so, that’s part of it.
15:10
I think, you know, there’s also to Jim’s point earlier that the the volume of parent involvement and parent awareness also increased, so now there’s that aspect of, well, what is being used, why’s it being used?
15:29
And that transparency piece is changing the landscape, along with, of course.
15:35
There’s, there’s been a great awareness about the security risk and privacy concerns that we should have, because of all the news about breaches, and ransomware, and all that kind of stuff.
15:46
So there is a push from the regulatory side as well, for transparency and accountability.
15:55
So those are the things that the pressures on us and K-12 districts has increased over, I would say, the last five years dramatically.
16:06
Yeah, and actually, now, we did ask some poll questions as we started this session. And so I wanted to see if we could share those poll questions now to see how you feel like you’re prepared.
16:20
Let me open the pool.
16:31
I just seem to have lost one second.
16:47
OK, wait, I’m going to have to go back and grab those later, So let’s move on to our next next question And then we’ll take a pulse of the audience.
16:56
Oops, Excuse me.
17:01
OK, Great.
17:22
Sorry about that. I’m having some technical difficulties here.
17:25
Just want to make sure, can you see my my presentation mode?
17:31
Are you back or we’re back on Jim, Can one of you. let me know here?
17:35
Yeah, it’s on your Preview Mode OK, great, so let’s see here.
17:40
there you go, there we go, OK. Thank you.
17:44
So we’re going to talk quickly about the regulatory environment and I think Jim Siegl, you are obviously an expert in this area.
17:53
And, you know, recently, I know that we’ve had a number of, you know, some state regulations coming across. But I’d love to hear from this group, particularly you, Jim, what you’re seeing here, and what should some of our district leaders know or be paying attention to.
18:13
Thank you. And this is an area where there’s been a lot of activity and many of us are familiar at the federal level, with, with FERPA, which was passed in 1974, and has been updated number of times. But a lot of the activity, in the last eight years has been at the state level where since 2014, more than 120 laws have been passed. It’s something that we keep track of. Right now. We’re in the middle of the state’s legislation sessions, and we’re actively tracking student privacy and even more child privacy bills.
18:44
But I just wanted to mentioned, because really, a lot of these come into play in what my colleagues will talk about, when you think about seeing this in terms of service.
18:52
But really, what we’re seeing in state laws in terms of good practices that some state laws have. And this is not all of them, and not all of them have this, but they typically have a prohibition on targeted advertising.
19:05
Some kind of requirement for privacy training to employees, and that could be vendor employees or district employees, depending on the law, or requirements for some kind of, privacy and data security plan.
19:20
Our requirements publish a list of approved gaps. So, transparency, training, all of those things are important.
19:28
Some type of requirement for data breach response.
19:33
And very few states. But designating a data protection officer or privacy officers, that last principle. Having someone in charge so training, transparency, targeted advertising, and someone in charge.
19:50
Jim, to how easy is that. If we, if we think about, actually, I’m interested in like Jim and Jim and Kevin’s feedback on this.
19:57
But how easy is that for most districts to kind of, like, meet those different, um, specific needs or requests that we’re seeing come across the regulation.
20:11
I would say from, from my perspective, for many of the districts, and I can speak to, you know, some of the ones that I’ve been involved in and now work at a, you know, district with 20,000 students.
20:24
one of the challenges is a capacity issue. You know, lack of personnel, the experts. So we have to rely on partners.
20:33
We have to rely on Consortium’s to educate ourselves and to bring awareness up in our districts.
20:39
But it’s, it’s also very overwhelming, because every legislative session, there’s a priority, And the last couple of years, it’s been, you know, as Jim mentioned, the transparency piece. I think it’s really important that he mentioned the data breach response has definitely taken an uptick in the last couple of years.
21:01
I know for a fact that, you know, for those of us in who used to get cyber insurance, very easily, it was a checkbox when you got the application, Do you want it? Yes. And you got it.
21:16
The last two years, it’s gone from seven questions to now, I think about 20 questions that we have to answer in great detail, and again, that goes to the expertise and the capacity issue.
21:30
We’re being asked to do all these things without having for example, I don’t know very many districts that have a CSO.
21:38
It’s a, it’s a high level position for security, that, obviously, a lot of companies have, but not very many school districts can afford that, or have that capacity.
21:48
So, it’s a fine line between trying to raise awareness and education in your departments, in your district, and getting everyone up, you know, raising the floor for everybody, with the limited resources.
22:04
Yeah, that’s great.
22:05
And actually, Jim, I think we’re going to talk a little bit more around, um, who can be involved in making sure that that responsibility is shared across the district a little bit later. But, Kevin, I’m interested in your perspective, from a vendor, from all the vendors that you’re working with right now.
22:24
What are, like, how do they fit into this regulatory equation, and how how are they thinking about it as they, our kind of working with and partnering with districts, Obviously, for them, it’s very important, too.
22:40
For a lot of the suppliers that we speak with, it is very difficult.
22:44
As great as, a lot of these regulations are the well established, as well as the ones that are just being sort of sent to either Congress or through the local legislation.
22:57
They struggle with keeping, you know, keeping up with all of the different regulations.
23:04
And one of the biggest things I see that I’ve heard from suppliers is that it’s sort of, it hurts them in a lot of ways it stifles innovation.
23:13
They’re not able to quickly innovate and produce new technologies and new applications, and to present to schools, because of the different regulations.
23:22
For a lot of those smaller supplies, ours, that, a lot of these regulations, keep them sort of segment it in.
23:29
Maybe just one space, like K-12, but can’t move into higher ed, because things are a little more difficult in that space, and they’re only in the K-12 space because of the different regulations.
23:38
And so, I hear from suppliers a lot. But one thing that I think that IT leaders shouldn’t know about the regulatory environment is, you know, who? Who’s writing the laws? Who’s presenting the laws?
23:51
What’s being done around, you know, Who are they getting their information from?
23:56
Because I think when they’re creating these different regulations, divorce leads, they need the voice of the people who it’s meant to serve.
24:04
And, and, and I’m not sure, I haven’t seen, and maybe I just haven’t looked around enough, I haven’t seen a coalition, or sort of group, or task force, educational leaders that are sort of sharing their perspective.
24:18
And sharing their sort of everyday interactions with these different types of applications after working with, and how hard it is to get a supplier to assign a data sharing agreement. Based off of the different regulations. And you’ll see a lot of suppliers start to push back, because they feel like they’re doing enough. They feel like they need the regulation of the California law, for example. And now they’re somewhere, you know, looking at the walls in Texas, and they don’t feel it’s, they feel that they’re strong enough in one area.
24:51
And so they’ll push back on the school, ask them to sort of change what they’ve already done, and what they’re currently doing.
24:56
And so, I do see a lot of pushback in schools reach out, ask, Hey, how can we get this organization to sign a data sharing agreement? Then I talk to that same organization, and they’re kinda just spent there. There.
25:10
Like they’ve done so much, and they can’t really sort of shift any more than what they’ve already done.
25:18
So it’s, it’s a very sticky situation for a lot of our suppliers who want to do the right thing, but feel like it’s an ever changing, and always moving, movable Goalpost for them.
25:31
Do you have thoughts? Tim Segal, just because we are going to talk about some resources later, but how can actually like for any of you how can kind of educators that are on the frontlines using these tools need these tools to improve learning?
25:46
How can they be a part of the conversation, as opposed to just like, like, receiving the information, You know, how can, how can are, there specific, you know, state groups, or what do you recommend?
25:59
So that district from the educator and classroom educator, or kind of district leaders are involved in, and better crafting guidelines.
26:12
Couple of thoughts on that one, and I think we’re really focused on two, on the, the unfunded mandate, and the unintended consequences, which are the two things that we see a lot, and this.
26:24
So, school leaders and educators can work with local associations, like the Consortium of School Network, colson, Which has an annual day, I believe, it’s typically in April, where they, as part of their conference, they send people up to up to the Hill in DC to talk to policymakers. Individually in states, many of the ST chapters, or the coasts and chapters are good places. I was just talking with a group in Massachusetts that was very interested. As Massachusetts is one of the states, the seven states that don’t have a recent student privacy law.
27:04
And I think the unintended consequence, unintended consequences, are as equally important as the unfunded. You know, one example that I think of a lot that would have really benefited from a legislator having talked to any educator would be New York’s recent biometric ban, where they ban the use or purchase of any device that was capable of capturing a biometric.
27:28
So with an audience of technologists, you can imagine that would include almost any kind of computing device from a Windows device, to an iPad two, to a Mac. So hearing the voice of people that are actually going to be impacted by the technology.
27:47
Anything additional that, Jim, I know you’re an active CoSN member and is this a topic that you’re talking about?
27:55
Absolutely. I think I would, I would mention to …
28:00
for sure has seen great awareness packets and toolkits and frameworks that they have that they provide up.
28:09
You know I’m heavily involved in the Georgia chapter of Coase and so we are actively working to expand the organization and to expand the membership.
28:19
because of the great resources that are there.
28:22
But I’d also say, we’re very fortunate in Georgia to have an affiliate membership for every single district for one EdTech.
28:30
So what EdTech has some great resources that can help with awareness of that around this issue.
28:36
So, for example, one of the things we’ve done is, we’ve looked at Apps and vetting of apps, is that the dashboard that Kevin has worked so hard on in the last few years, is turning that into an education and awareness opportunity for our teachers to see.
28:55
There is an extensive amount of work that goes into, when we are vetting an app, and helping them to see the rubric has been very helpful, and getting them, to buy in, and understand that, Oh, no, I get it.
29:10
It’s because of we’re concerned about what they’re doing with our kids information, the advertising that they may or may not be doing.
29:17
And the security of that information is extremely important.
29:20
So when they see the rubric and the tiles, the best way, I can describe it. They look like Trivial Pursuit tiles. And there’s no greens, and reds and yellows. It helps them to understand the extent of the work that goes into it.
29:36
Because each of those four areas are, you know, within them have about 20 questions each. So there’s a lot of work that goes into it, and it has helped us raising awareness and getting buy in.
29:51
Great, and actually that’s, do. you mind if I jump because our next or Kevin, did you have a comment on that?
29:56
Sorry, are Michiko, thank you!
30:00
OK, oh, I was going to say, because our next discussion point is just around, um, whose responsibility is data privacy a shared responsibility? Who at the district needs to be involved?
30:12
And, I think that maybe is a good segue jam because you’re talking about kind of educating, not just the technologists and the IT leaders about, um, bedding apps or kind of understanding like a nuance of like, how is the data being used?
30:29
So, kind of, let’s expand on that a little bit about how to, who needs it, who else is involved in this, security data, privacy problem?
30:40
Yeah, this is a, you know, a topic that we’ve taken attacked of doing it through a data governance approach.
30:50
Some of my peers have done it through a cybersecurity approach. Some of my peers have done it through, you know, a privacy, and security approach.
30:58
So, there’s different ways that you can approach this, But, for us, with, my team, in our district, we felt like, um, creating a data governance council, that was representative of the district.
31:11
So, we have district leadership, school level leadership, and departments across the district that are represented.
31:20
And, I said, you know, earlier, we have about 20,000 students. So, our data Governance council is made up of about 25 people.
31:27
And, it covers, you know, the whole gamut of the district, down to the school, leadership, and even a couple of teachers on board, as well.
31:36
So, we have approached that.
31:41
Concentrating it first on awareness, and education and explaining, you know, what is data governance, because if you asked the 25 people in that room, you’re gonna get, you know, 25 different answers. So the first, and this was a very long process but about the who needs to be involved. Our perspective was that this could not be a technology initiative.
32:03
This had to be a Fayette County Initiative and therefore we had to raise the level of everyone at the table so that they could go back and work with their departments and disseminate the information and education and awareness that we’re doing.
32:17
Because we are tackling things like vetting of apps, password policies, security procedures, data cataloging.
32:26
All of the different, broad, range of areas that, you know, you would think about when it comes to data, and privacy, and securing, and storing and sharing in an appropriate way.
32:37
So, just about anybody in your district is going to have access to, or be able to have access to information, or student data.
32:48
And so, it can’t just be a technology initiative, it has to be done as a team, and it has to be taken on as probably, you know, one of the most important things, obviously, Beyond our teaching and learning environment, that’s our priority.
33:02
It’s, it’s right up there as as an important lever that we have to, to take care of.
33:11
That’s great, and I, and I want to kind of like zoom in a little bit on two levels.
33:16
one is, you had, you had shared an example with me about like the educators at your, at your district and how you helped kind of enable them to be part of that vetting of apps and tools, as they are kind of potentially at a state or regional, you know, Ed tech conference. Or, can you share a little bit about some of the work that you did there?
33:41
Because they are such a big part of being able to, you know, judge an app, and how does it work academically? And then, but also, like, be a part of that solution? From a data privacy perspective.
33:53
Yeah, absolutely.
33:54
I think there’s a couple of things that, you know, and this is obviously still a work in progress. But we’ve been working on this, I would say, for over three years.
34:04
So it hasn’t been something that we just, you know, turnkey and it happens overnight.
34:08
It’s, there’s a lot of conversations, there’s a lot of laying the groundwork to build upon it.
34:14
And so, one of the things where we’ve done, unfortunately, to have a digital learning team.
34:20
That is fantastic made up of Master teachers that get up into our schools, and before, our big Georgia Technology Conference, we share a rubric with our staff.
34:31
When they go to the conference, they usually find all these wonderful new apps they want to come back and use.
34:36
So we’ve given out a rubric that they can then kind of, you know, kinda pre vet these apps and determine, is this something that’s going to fit and work?
34:47
As opposed to just coming back and downloading and using the 5 or 10 new things they just saw over the last few days at a conference, and that has helped with awareness and education.
34:58
The other part of it, too, is, are our app vetting process.
35:03
We included leadership from the school levels to be a part of building the process.
35:10
So we had administrators and educators on that on that group to set up the workflow.
35:18
No, I want an app, OK, how does that work?
35:21
What does what, what process do I need to go through?
35:23
And so including those, those teams on the front end of building the process, has really helped us to sell it and to get buy in from everybody else, because it was their peers that helped create it. So, those two things have been really helpful for us. But, again, we’re still learning and we’re still growing in this, in this area.
35:42
And a lot of that comes from, are no networking with, like, our friends at one EdTech and CoSN.
35:51
And we’re very fortunate in Georgia to have a really good collaborations between technology leaders that is, has been very beneficial.
36:01
Great, thank you, Jim Siegel, I was gonna I was wondering if you could share your pneumonic it passes and how that should explain that to us.
36:11
Yeah, so to kind of tag on to Jim’s points, this is not an IT only process of app vetting. So rubrics are tools.
36:21
The tools that Kevin’s organization provides are wonderful tools, but just a communication tool, and getting buy in across a large group of people that have kind of very different interests and sometimes competing interests. This is not the bringing on an approving. An EdTech app isn’t just a privacy thing. So I would use a communication tool.
36:44
I had a mnemonic around app vetting that is just the pneumonic, it passes kind of something that resonates a lot in in education. And the pneumonic stands for some of the key things that I would look at.
36:57
And my colleagues would look at when we would vet an app and it stands for interoperability, training, privacy, Accessibility, security, safety, Effectiveness, and sustainability. So being able to do more than just piloted. So, when I think about that, those are all of the conversations that we would have as a district, And as educators and technologists. So it was a very inclusive way of bringing people into the conversation to talk about this, is more than just a privacy checklist, or a privacy gateway.
37:32
It was, how are we bringing this particular education tool into the district to support student learning, and make it sustainable, and private, and secure, and a lot of these things, The Interoperability, the privacy securing are things that, I know Kevin may be able to talk about, in terms of the tools that he provides.
38:00
Kevin, do you want to jump in there to talk a little bit about this or remove obsolete.
38:07
Yeah, absolutely. So just real quick, I liked how Jim mentioned the data governance team.
38:13
I wish at the time when I was at the district, we have something like that.
38:18
I think data privacy, the responsibility is shared by everyone in the district who handles student data in any form or fashion, and everyone needs to be involved.
38:27
Because, for, for me, starting out, with, with the privacy at the district, it was, it was almost like running a campaign.
38:36
It was grass groups, knocking on doors, it was first researching and finding out what departments are in the district and realizing, wow, there are hundreds of departments I’ve never knew existed, then get it to introduce yourself to that department hearings, or what they do, and then really promoting your campaign. It’s promoting what, who you are, what you’re doing. And trying to convince them that your priorities should be on their list of priorities as well. And so, it took, and that’s a ton, a ton of time.
39:09
And so, that’s all, I would say, for, as a shared responsibility, IT curriculum, and a ton of different departments. I can’t even remember, need to be involved in that process. Feel just dealing with student data and handling that data in a responsible way.
39:29
That’s great. OK, so we talked a little bit, we’re gonna move on, some of the resources, we already talked about, obviously, and we have some of the experts, here, are some of the organizations want to tag the student data privacy? Or? Our data privacy forum, and then the student Data Privacy Consortium.
39:49
What other other resources that you would say that might make it easier if you’re kind of sitting there thinking, I’m not sure where to start?
40:01
We also have a list here. Later, I think these, I’m gonna, I’m actually a jump to the next one for interested of time, because I’m going to combine these two. One is just like resources and ed organizations. We’ve talked about a couple, But is there anything else that the group here wants dimension?
40:17
Maybe we haven’t talked about.
40:22
We’ve listed a lot of these coasts and a number of others.
40:27
one that I do want to mention, just because it’s a phenomenal resource that’s available from the Department of Education, the, the, the student data privacy website, student privacy, dot, ed dot gov, and the Privacy Technical Assistance Center.
40:43
You can actually e-mail them or call them with a question, which is kind of an amazing thing, given that they have to support 16,000 school districts across the country, and there are a number of very good resources that support complying with federal privacy laws.
41:00
They don’t deal with state privacy laws, but really some, some phenomenal resources.
41:05
They regularly hold webinars and we’ll go out regionally.
41:14
Anything else, Kevin or jam? I’m going to also we do have a list here for the audience that I’ll just bring up if anyone wants to comment on these.
41:24
I will touch just briefly on sort of what we provide at one at tech.
41:30
So we get a lot of requests from schools and even suppliers to reach out and have heard about the privacy rubric that we have here.
41:40
That Progressive rubric was, it took about three years to create that rubric, and it was done in collaboration with K-12 higher ed, State Departments of Education, and different EdTech providers.
41:53
And that was important because that unique set of organizations all working together to make sure that we created something that works for all.
42:03
It was meant to give schools who wants to vet their applications, a quick snapshot into what that suppliers’ doing, how transparent they are with their policies, and things like that.
42:15
So, the rubric that we have, this is definitely a very strong rubric and it helps you answer the question from teachers, want something yesterday if they request the app.
42:25
And they need it almost now, That rubric assists in those regards and it’s meant to sort of handle the low I’m applications that are being sent to that poor person who has to vet those income and resources in their district.
42:43
I’ll just add, Go ahead, Jim.
42:47
And along along the same lines we have our Student Data Privacy Pledge, which is a checklist of 12 attributes. It’s a yes or no. And we have Policy Council that review them and review the privacy policies before we add them to the student privacy Pledge.
43:04
So some very baseline requirements.
43:10
Now that’s an important one to mention that I thank you Jim.
43:14
Yeah. I was just going to add you know I know a lot of the ones on the slider or are excellent. Of course the one at tech resources. We’ve been talking about CoSN and also has the Annual Horizon Report that they work on.
43:27
That’s pretty extensive and it’s really good for kind of educating and awareness. The CISA information is excellent for, for technology leaders at the district level or state levels there.
43:42
They’ve expanded immensely in the last couple of years. They even have contacts that you can reach out to and provide guidance and assistance. We have worked with them pretty closely over the last year, and are doing more with them.
43:55
So I would say, those have been really, you know, excellent educational and awareness partners for us. But, you know, in Georgia, we’re fortunate to have races, that are regional service agencies.
44:10
I would say reaching out to them if you’re new or unsure.
44:14
And then we’re have a State DOE that’s led by doctor Keith Osbourn, is the CIO for the State, and they have done an amazing job of kind of, transforming into a service and support agency for school districts.
44:35
And that has been a really neat thing to see, happen over the last couple of years with partnerships with one EdTech with partnerships.
44:43
We’re providing security resources for school districts, so there’s been a lot of movement in those areas at the state level. And then through our partnerships, but the one that’s, it’s, the last bullet point, I think, is a really big one.
44:58
It’s making sure you work with your partners that you have, because there’s already hopefully a relationship there, and having these important discussions about privacy, about security, about your concerns as a district.
45:12
You’ve got to have those conversations with your partners, because they are the ones that can make it happen.
45:20
And the more we can be involved together as as teams, the more we can tackle these issues as we’ve been mentioning how, you know, the, the onslaught of things that are coming at us is, it’s pretty amazing.
45:34
And there’s no way to do it alone. Just like we were talking about.
45:39
You know, the app bidding and things like that with data governance?
45:42
It can’t be done alone. It has to be Seen as the important issue that it is. And, therefore, you need your departments.
45:50
You need your partners, and it needs to be, it’s something that we all are on the same page, working towards that safe and secure future.
46:00
Yeah, and that’s a great point.
46:01
And I think being from lightspeed systems, I mean, and that, you know, providing a partner, Salute set of solutions to districts.
46:11
We, you know, we are, you need to have vendors that are ready to work on, know, the right type of agreement. So, the districts that we meet your district needs from a data security and data government’s perspective.
46:26
Um, you know, we also, at lightspeed systems, we have a tool which, you know, we embed and bring in the one EdTech Vetted App badging, and Student Data Privacy Consortium badging.
46:41
This is our Digital Insight Product, which allows districts to see the entire of, or have visibility of your entire ecosystem of what apps and and digital learning applications you’re using, whether they’re approved or unapproved, whether they’re licensed or free.
47:00
It gives you that view, so you can, kind of, 0, 0 in on potentially new apps that your teachers are using and find out, Are they approved or they’re already in our system? If they’re not, OK, I’d see that they are they are one EdTech vetted.
47:15
So I feel more comfortable about the way that They are securing data privacy and interoperability that they’re using.
47:24
So, I think working with, you know, your vendors either, whether it’s from, like a contractual perspective or making sure that they are using these types of standards and lightspeed systems. We can give you, help, give you visibility of your entire ecosystem to help give you a quick snapshot on what’s being used. And whether it does comply with that, your data privacy policies at your district or state.
47:50
So, important to involve the vendor community, and the ed organizations in this conversation, so that we can all ensure that we’re securing student and district data together.
48:02
I think everyone is heavily invested in making sure that learning is safe and secure, Each one of you, as well as the partner community. OK, so let’s jump into Q and A We have a few minutes left. So thanks for staying on with us.
48:23
All right. Is there a general guideline of how long we should be storing student data? OK, so, this is actually, Jim, going back to the beginning of this session, where we were talking about data retention.
48:38
So, is there a general rule around storing data? Is it different depending on the nature of the data.
48:44
So, feel free to jump in with any thoughts there.
48:48
Yeah, and I’ll ask Jim to chime in as well. But this is there is no specific requirement in any legislation for for data retention. So, for example, when I was in Virginia, the retention schedules were governed by the library of Virginia and they put out policies that it differed by the nature of the type of data.
49:11
So, for example, you know, field trip permission slips were kept for current school year. And other kinds of data were kept current, school, year, plus one. And, you know, some things like the educational record were 70 years. So it varies, and they tend to not be in regulation, but that doesn’t prevent you from applying just kind of data minimization and retention, in terms of not keeping records. So FERPA only requires you to secure the law while you’re maintaining it. It doesn’t specify how long you have to have to keep it.
49:52
And I’d be curious from your experiences in Georgia as well, Jim.
49:56
Yeah.
49:56
I know I’ve had this conversation with our person who’s in charge of data retention, and it To your point, it depends on the data. It depends on what department attended. It depends on how it’s being used.
50:10
We have some data that is required to be stored and secured forever.
50:17
And that’s some of our like HR data, But then there are the things to your point about yearly, that it needs it.
50:26
But, again, the information that I’ve gotten about this is that it can tend to be very unclear, I guess is the best way to put it.
50:36
So we have a person in our department, in our district that we go to that has the latest information.
50:42
That goes to all the data conferences and keeps up with the Georgia specific laws.
50:47
But to your point, as well, there’s, there’s federal regulations that are required on some cases.
50:52
So with FERPA as the baseline, it kind of sets like guardrails, but it doesn’t give you specifics on data so that it’s going to be determined a lot of times also by school boards policies, and some school boards are different than others on how they will approach that.
51:12
So, it really is unique to each, sometimes, each district, as well.
51:17
And Jim, I’m curious, at least in Georgia, I know one of the things in the Student Data Privacy Consortium, which has a national data protection agreement, many districts utilize one of the, the exhibit’s, which is basically a form to request that the vendor delete data or return the data. I’m kind of curious, do you deal with it, kind of turning it from the law side to the, to the contracting side. Do you deal with any of that on the contracting process?
51:46
That’s exactly what our data governance council is starting to to approach. As of right now, we’re kind of in the beginning phases of creating our own data sharing agreements.
52:02
For things like for example, the school photographers, right? There’s not a contract per se. It’s just, they’re going to come in and take pictures. But they have student information.
52:11
They have access to all this database of, uh, info that they have.
52:18
So we are in the process of working on those pieces, but again, it’s early phases and it’s, it’s challenging because it’s, it’s so there’s so much of it in so many different areas.
52:32
And to Kevin’s point earlier, you know, I know a lot of partners that we speak to about approaching them with the data, sharing our data privacy agreement.
52:41
And there’s sometimes some pushback because, as Kevin mentioned earlier, they feel like they’re doing a lot when they’re trying to reach, you know, the minimum for the California law and now Texas has some things, and Georgia has some things.
52:57
So, it makes it, sometimes, where the vendors are being stretched, sometimes a little further than they’d like, so it’s a fine line to walk.
53:09
Yeah, I think it’s interesting because, like you’re talking about in the district, like your retention of your district data, and then the vendor is also storing data like a student learning data or whatever that might be. So making sure that you speak with the vendors about or at least, like, how long are you retaining that data? I mean, I know we have that Publish, We have that available for all of our clients. So that they know how long we’re retaining their District data in our systems, or any any specific data. So I don’t know, Kevin, do you have anything from the vendor perspective? Do you most vendors or in your, in your Rubric around data retention at this point? Yeah?
53:48
Yeah, absolutely.
53:49
So since I probably read well over 60 privacy policies a week, a lot of the common statements that I see around data retention in the supplier’s policy, as they use the term commercially reasonable and they make a lot of references to you. When you request deletion of your data, we still may retain it for multiple purposes. Some, some suppliers make the case for, they need to hold on to that data even if you request the deletion of it, but they need to hold on until it, for lawful purposes. They never state what the law is, but they. but it doesn’t make sense that if, you know, they use it for in case they get sued or if there’s any type of case, where they need to refer back to that data to sort of protect themselves against lawsuits. And things like that, They will hold onto that data And, they will say, for a commercially reasonable amount of time, which is never really defined in any policy.
54:47
I’ve seen, But there’s no sort of like when Jim Siegel said there’s no real law that says what the retention time has to be, but they always mentioned the types of data In a lot of the policies that are really depending on the type of data, we may hold onto it for these reasons.
55:06
And they will list those reasons, most fully, most lawful reasons why they hold onto it, even if you’re requesting.
55:14
And a lot of the times, they don’t give you any type of timeframe for retention unless a school asked for. So, some vendors are able to delete that data, or it will have a retention period of immediately, you can delete your data.
55:29
And we’ll delete it right, as you do so, Or they know, it’s cool doesn’t ask them to delete it.
55:43
I think Kevin’s the audio we might have lost in there for a second, So, in the interest of time, we have another. a few, a few additional questions. So Jim Seal, I think this might be a good one for you, is there additional funding to help schools meet SDP regulations specifically?
56:00
one of the things that state laws tend not to be good at is funding, the things that they require. There are very few states, Utah is really the only example that I’m aware of, that passed a student data privacy law, that actually provided funding to do what was accomplished.
56:17
On the, that’s on the privacy side, some states have stepped in and, and signed up entire state at the state level with a, as a student data privacy consortium membership, so kind of getting that, that group. So, for example, that is the way that it’s handled in Virginia for the 130 or so, so, districts. I’m kind of curious to know if there are things that you’re seeing in Georgia, or seeing on the security side. I know that there are grants and some federal things around, with with … around cybersecurity.
56:53
Yeah, there. There definitely are.
56:54
And I would say, as I mentioned earlier, the DOE and Georgia has really taking some steps in this direction as well.
57:02
They’ve provided every district in Georgia with an affiliate membership to one Ed tech, so that’s been, I think, really beneficial, and I think that’ll just get better and better.
57:12
There’s also some things that the state is doing for, from a security perspective, with giving people some resources to help on the cybersecurity side of things, which, of course, is, you know, indirectly related to student data privacy, Of course, because the more secure we can be, the better that that whole umbrella is. So I think there are some things that are being done at that level.
57:36
Now it’s just a matter of raising awareness and education of all of our districts, and so that’s, that’s one of the things we’ve tried to do through the one EdTech meetings that we have, and through expanding the membership of CoSN and throughout the state of Georgia.
57:54
You know, and elsewhere of course, because of the TLE seal (Trusted Learning Environment) is fantastic for districts to learn about, it’s a trusted learning environment.
58:04
And then of course for individuals the Fetal Certification which is the Certified Education Technology Leader which kind of covers many of these topics that we’ve talked about.
58:15
And it just helps to raise that level of expertise and awareness that we as leaders in this area, need to have.
58:25
Yeah, and I think, I don’t know, Jeremy, for you or any of you, but I know E rate, there’s discussions right now about Will there be E rate funding that actually goes towards more of a cybersecurity? I think that’s under review or, like, comment right now.
58:39
So, I think as cybersecurity data, privacy, and data governance become an increasing or continued issue for districts, it sounds like at the federal level, they’re realizing that school districts need help funding be appropriate technology solutions and potentially consulting solutions, or, you know, whatever types of needs that they, they have there.
59:09
So, I think that there will be more to come, I guess. Yeah. There, we should see more information about that.
59:19
And I’m sure that there will be continued discussion about how do states states fund these needs, as well as the federal government.
59:29
Well, I want to thank the audience for joining us, and Kevin, Jim. Jim, I’d love to love to thank you for your thoughts. We really appreciate sharing your insights today.
59:41
We are going to wrap up in the interest of time, but, again, thank you for joining us.
59:47
We want to provide you with the information that we have, and the solutions and tools that we have at lightspeed system. So, if you’re interested in more information about some of the ways that we can help you around data privacy, security, and compliance, please reach out to your lightspeed account manager. Or if you do not have one, please reach out to us by visiting our website.
1:00:12
Again, I want to thank our panelists for a great discussion today, and thank you for joining us.
1:00:20
A recording will be sent out shortly, and we appreciate your time, and we appreciate your dedication to education. Thank you so much. Have a great day.
1:00:32
Thank you.