Privacy, big data and education: more about the inBloom databases

A new national database of personal student information understandably has parents and privacy advocates alarmed. As reported elsewhere, the new inBloom database houses information on millions of school children from nine states and includes names, addresses, telephone numbers, disciplinary records and learning disabilities.

One of the states is New York. Naturally, the mommy listservs in Brooklyn, where I live, are going wild with “opt-out” letters. My first reaction was surprise. Could it really be true that inBloom was going to release this private information to any ap developer who asked? (Disclosure:  inBloom, a non-profit organization, is funded by the Gates Foundation and the Carnegie Corporation of New York, which are also among the funders of The Hechinger Report).

inBloom explained to me that there are two separate data stores. One is the real data that belongs to the states and school districts. The other is a sandbox of fake data for developers.

With the real data, inBloom is functioning like an off-site storage service for school districts. inBloom says it will store any type of data that states and districts feel is relevant to their educational purposes. That’s why social security numbers could be in one of the fields. But inBloom spokesperson Barbara Roos says inBloom is not aware of any school district using social security numbers. Roos added that the regional data will not be mingled into a single national database; each state’s and district’s data will be maintained separately.

The sandbox contains only fake student data that developers can use for testing their new products. Sharren Bates, inBloom’s Chief Product Officer, emailed me that her development team generated the sample from scratch to be representative but not at all connected to any real student data set. …Some of the data was machine-generated and some was generated by hand.”

The hope here is that new applications will be able to plug into a school’s existing computer system. That would save schools hefty integration costs every time they buy a new piece of software.

But third parties can get access to the real data. That’s when a school district has directly hired a company to be an application provider of, say, a math program. The school district can authorize inBloom to release data to the vendor. inBloom is, in effect, a middle man. The school district could have just given the math company the data directly. Before inBloom’s creation, that’s exactly what happened.

Generally, there’s a contract between the school district and the vendor, defining exactly which data the vendor can have access to. The district could choose to include students’ arrest records, but that would be unlikely with a math program. inBloom says it has set up a “granular” system so that a district can specify exactly which data it wants and doesn’t want to go to a third party.

Of course, there’s plenty to be worried about. What if a school district bureaucrat makes a mistake and accidentally releases data to vendors that he shouldn’t have? What if a software company fails to protect this sensitive information?  What happens if personally identifiable information is transmitted to a vendor that goes out of business?  And how secure are these clouds, where the data is stored?

“Some people don’t want information about their children used or documented at all. Certainly they have the right to that opinion, but that’s a larger issue,” said inBloom’s Roos. “Recording information about students, storing it in the cloud and sharing it with vendors has been happening for a while.  inBloom hasn’t started that. People need to be having that conversation with their school and the government.”

Indeed, that conversation is starting. Last week the Washington Post reported that the Electronic Privacy Information Center sued the U.S. Education Department for making a change to regulations in 2011 that allowed third parties, such as software companies and foundations, to get access to private student data.

Earlier Hechinger Report coverage:

Big data and schools: Education nirvana or privacy nightmare? By Anya Kamenetz on March 6, 2013

 


POSTED BY Jill Barshay ON March 18, 2013

Comments & Trackbacks (3) | Post a Comment

Leonie Haimson

InBloom’s entire purpose is to encourage as many vendors to enter the field and to make this highly sensitive data accessible to as many of them as possible. This is why they’re going around the country holding camps for developers and giving them prizes etc. for the “best” learning tools. The more vendors get access to this highly confidential data the more likely it will leak out or be used inappropriately. This entire project is a powder keg waiting to explode, and inBloom’s statement that they’re not doing anything new and that parents should instead have “conversations” with their districts or the government about the need for consent, in an effort to disclaim their own responsibility is pretty outrageous.

Barbara Roos

Jill – thank you for your thoughtful examination of the work inBloom is doing. I also wanted to share a link your readers might find helpful: http://www.washingtonpost.com/blogs/answer-sheet/wp/2013/03/28/on-the-question-of-student-privacy/. It’s a guest post on the Washington Post’s “Answer Sheet” blog by inBloom’s legal counsel, Steve Winnick, explaining inBloom’s compliance with FERPA, and clarifying some key points about the EPIC lawsuit.

Anyone who has further questions about inBloom should also be sure to check out the FAQ at http://www.inBloom.org/faq.

Best,
Barbara Roos, on behalf of inBloom

[…] DNA, blood type, psychological evaluations and more into an alarming private database, called inBloom.  It will result in evaluation and guidance into two- or four-year colleges or trade schools, then […]

Your email is never published nor shared.

Required
Required