Recommendations for Policymakers

Policymakers must also consider a number of recommendations to curb any abuse of these technological tools. Action on the part of receptive employers and school administrators to ensure accountability for the tools deployed to guarantee the health, safety, and productivity of their respective employees and students is insufficient to protect their privacy and safety without concerted government action.

1) Congress must pass comprehensive privacy legislation.

A comprehensive privacy law would be the most important step policymakers can take to ensure protections around data use, access, and storage practices as it relates to technological tools utilized by private companies during the pandemic.¹ Among other provisions, Congress should codify requirements that companies follow privacy best practices such as those outlined above as recommended voluntary measures. A comprehensive data privacy law would also limit the data handling practices of companies that provide tech tools to public schools and universities. Further, through a comprehensive privacy law, Congress could establish transparency requirements to provide greater accountability. Creating a consistent set of standards for how industry players treat personal data would also be a major step towards mitigating harms and minimizing potential abuse of that data. Such a law could also inspire confidence in students and employees about the tools being deployed on them.

2) Federal and state policymakers should enhance education privacy protections.

While worker privacy would be bolstered by federal comprehensive privacy legislation, lawmakers seeking to protect student privacy need to pursue more targeted interventions. Fortunately, there are a number of actionable steps that lawmakers can take to protect student privacy during this pandemic. One measure that may be effective is updating the Family Educational Rights and Privacy Act (FERPA),² the primary law protecting student privacy. FERPA regulates the disclosure of students’ personally identifiable information (PII) which includes direct identifiers, like students’ names, and indirect identifiers, such as date of birth, which can allow re-identification through combination with other data points.³ Given the increasing use of education technology over the past few years,⁴ the volume of data collected about students has increased substantially,⁵ leading some lawmakers to call for reforming FERPA. In 2014, Sens. Ed Markey (D-Mass.) and Orrin Hatch (R-Utah) introduced a FERPA reform bill that would have put data minimization, deletion, and data security measures requirements on student data held by third parties.⁶ Restarting the conversation around updating FERPA would be a fruitful step in protecting student privacy during the pandemic and beyond.

In addition, the Department of Education (ED) could issue further guidance to schools on how to respect student privacy during the COVID-19 pandemic and beyond, as we face a potential future of increased use of remote learning technologies. In March 2020, ED put out guidance instructing school administrators and public health officials on how to navigate FERPA requirements during the pandemic.⁷ That same month, ED held a webinar on how FERPA applies to online learning, running participants through scenarios regarding PII disclosure during online learning.⁸ ED could bolster these efforts by holding more webinars and issuing further guidance, focusing on issues of education technology vetting and procurement during the pandemic.

Further, local and state lawmakers could pursue legislative reform to further student privacy. One instance of recent legislative reform on the issue of student privacy is New York State’s December 2020 law which imposes a moratorium on the use of biometric technology in schools, and mandates a study examining the use of these technologies.⁹ Given the novelty and disparate impact of biometric tools such as facial recognition,¹⁰ this measure benefits student privacy and should be emulated by other state legislatures.

3) In the short term, Congress should pass narrower legislation that focuses on privacy rights as it pertains to combating the spread of COVID-19.

In the short term, policymakers could consider legislation that has a narrower focus on technological tools deployed to combat COVID-19. For example, Rep. Eshoo, who spoke at OTI’s event, co-sponsored legislation, the Public Health Emergency Privacy Act, that applies to all digital tools used in a pandemic response. Specifically, the bill includes a data minimization provision stating that an organization should only collect data when “necessary, proportionate, and limited for a good faith public health purpose.”

As Rep. Anna Eshoo explained at the event, “What I thought then as I do now is that we need balance. We should use technologies that can help save lives and reduce the spread of COVID-19. That's a human effort. And that is essential. But the data that is collected by these technologies, whether they're controlled by the government or private companies should not be used for any other use, only for public health.”