Recommendations for Schools and Workplaces

The COVID-19 pandemic has placed many schools and workplaces in the difficult position of finding ways to resume or continue operations while protecting both the health and privacy of students and workers. The following recommendations can mitigate some of the concerns raised by privacy experts.

1) School administrators should consider less invasive alternatives to surveillance technologies.

Before employers and schools implement any monitoring technologies, they should ensure that the technology is needed to serve a valid safety, productivity, or integrity purpose. This means that employers and schools should both determine whether the purpose to which they may deploy the tool in question is valid, and decide whether the tool itself is truly needed for that purpose.

For example, in many circumstances proctoring surveillance tools may not be necessary because there are alternative methods to assess student performance that are equally or more effective. Universities that have decided not to use exam proctoring software have created policies and implemented solutions to help instructors protect both privacy and academic integrity.¹ Alternatives to the use of proctoring software like open book exams, student-developed quiz questions, and group projects² demonstrate that in many cases, valid health and productivity concerns caused by the pandemic can be addressed with privacy-respecting and relatively equitable solutions.

2) Before purchasing a surveillance technology, school administrators and employers should determine that technology’s efficacy.

Schools and workplaces should ensure that the surveillance tools they are interested in implementing serve their purported health or productivity monitoring functions. As OTI noted in a 2020 white paper on contact tracing, institutions should avoid adopting or continuing use of surveillance tools that collect data that is “neither useful nor appropriate” for the purposes they intend to serve.³ In the context of pandemic-related response in schools and workplaces, this means making an informed judgement about whether or not tools actually protect health or increase productivity.

Unfortunately, some schools⁴ and workplaces⁵ adopted health and productivity monitoring tools without proper vetting. During our panel, Wilneida Negrón explained, “There’s just an influx of new tools and technologies that are not being vetted. We don’t know if they’re doing what they’re intended to be doing and [they] could be sowing the seeds of a continuing hyper-vigilant workplace.”

As detailed in the Health and Safety Measures section of this report, public health authorities and healthcare providers have been gradually sounding the alarm about the insufficiency of temperature checks as a response to the pandemic given the prevalence of asymptomatic COVID-19 cases.⁶ Under these circumstances, the health and safety purpose of mass temperature checks on their own does not appear to be valid, and thus the acquisition of thermal imaging systems without more fundamental measures, such as guaranteed sick leave and access to testing also appears invalid.

Moreover, the equity problems with technology can also create accuracy and efficacy issues. When exam proctoring software misidentifies the behavior of disabled students as suspicious,⁷ that tech is not only inequitable, but also inaccurate, because it delivers false positives.

3) School administrators and workers should practice transparency and incorporate stakeholder feedback,

Schools and workplaces should solicit and take into account the input of relevant stakeholders when implementing new health and safety technologies.⁸ At a minimum, students and workers should be informed of what health monitoring tools are being introduced, aware of how the data collected by those tools would be used, and have an active decision-making role in whether and how these tools are deployed and utilized.

As explained by Kent Wada during our panel, “It’s not like we can control everything, but disclosing what we can and can't control, what we do and don’t do [means that while] people may not agree with our position, at least then they’re focusing on the real issues as opposed to just speculating.” Similarly, as articulated during our panel by Anisha Reddy, “With regard to proctoring, I think a huge thing is that there should be opportunities for students to communicate issues that they're experiencing to their teachers and institutions and to feel heard, that these issues are being considered and there should be alternatives available to students.”

Many activity monitoring tools allow employers to decide whether or not to make their workers aware that they are being monitored and intentionally make their software difficult to detect.⁹ Secretly installing software to monitor workers covertly is never appropriate. When an employer finds it necessary to use activity monitoring technology, workers must be informed both what specific tool is used and the types of data it collects.

4) School administrators and employers should consult with privacy experts and conduct impact assessments.

In addition to directly consulting with those being required to use health or productivity monitoring tools during the pandemic, workplaces and schools deploying these tools should familiarize themselves with the numerous best practices documents drafted by privacy experts,¹⁰ and directly consult with privacy experts, implementing the best practices offered by privacy experts to the greatest extent possible.

Schools and workplaces introducing new surveillance tools in response to the COVID-19 pandemic could also conduct privacy impact assessments (PIAs) to understand the effect that these tools have on their students and workers respectively, and take steps to mitigate the privacy risks. PIAs are a legal requirement for Federal government agencies developing or procuring certain types of information technology systems.¹¹ For instance, to document the privacy impact of its own contact tracing system, NASA released a PIA that detailed the system’s categories of data collected, consent mechanism, security controls, information sharing practices, redress mechanisms, and compliance with existing laws.¹² If schools and workplaces conduct PIAs before deciding whether to use a tool or enter a contract with a vendor, they will be better positioned to make informed decisions.

Schools and workplaces should also assess whether tools could have a disparate impact on students and workers belonging to marginalized populations. Algorithmic impact assessments can “assess the short and long term impacts of these systems, whose interests they serve, and if they are sufficiently sophisticated to contend with complex social and historical contexts.”¹³ This type of analysis could help employers and school administrators identify methods to mitigate any disparate impact or determine that the risks posed by a tool outweigh its benefits.

5) School administrators and employers should minimize the data collected by surveillance technologies.

As OTI has urged in regard to higher education online learning,¹⁴ institutions utilizing data collection tools in response to the pandemic must minimize the volume and categories of data collected to only those needed for specific, clearly articulated purposes. This means collecting the minimum amount of data needed to implement legitimate workplace and schoolplace safety and monitoring measures. For example, instead of using exam proctoring software that continuously collects biometric information, schools could choose alternative models that capture images of students screens during exams.¹⁵ This approach could minimize the amounts and types of sensitive data collected while fulfilling the objective of academic integrity.

Sarah David Heydemann asserted during our panel that is the responsibility of employers to be, “ensuring that the data that's collected is for a particular purpose that doesn't go beyond the bounds of what's necessary, that there's an understanding of how long it will be kept for, and frankly an understanding of what kind of profit is being made off of the data that workers are, perhaps, unwillingly or unwittingly providing.”

6) Surveillance technologies deployed in the school and workplace should only be used for narrow and explicitly defined purposes.

Data collected for the purpose of maintaining the health and safety of workers and students during this pandemic must be only used for that purpose. This means that the use of all health and safety surveillance tools deployed in response to the pandemic must end once the pandemic ends, and the data collected by those tools must not be used for unrelated purposes.¹⁶ As explained by Anisha Reddy during our panel, “There should be a clearly defined purpose for this new data that’s being collected to ensure it’s only being used for that specific purpose and not being repurposed later on.”