This backgrounder concerns products destined exclusively for the educational market. For commercial products, refer to Backgrounder Collection of Personal Information.
1.1 What are some of the particularities of the educational market?
Among Canada, the United States, the European Union, France and Australia, currently, the United States is the sole country with federal and state legislation (FERPA and COPPA) governing the handling of student personal information. If your educational product is not marketed in the United States, refer to the backgrounder on the collection of personal information.
1.2 What is an EdTech product?
Current U.S. legislation identifies two categories of EdTech (educational technology) products:
- Formal: educational material developed based on a curriculum and sold to schools on a contractual basis. Any student information collected therein is solely for the school’s use and benefit.
- Informal: educational material developed in whole or in part based on the learning objectives of a curriculum. Distributed to the general public through various business models, these products can also be used in the classroom. How the information collected through such platforms is used remains at the producer’s discretion.
1.3 The notion of consent with regard to educational data mining
In an educational setting, schools are recommended to obtain parental consent as soon as the collection of personal information is involved. Teachers can send parents an explanatory note describing the application they wish to use. Parents could then be asked to register their child online, which would give them the opportunity to review the producer’s privacy policy. However, it must be remembered that in Canada, there is no law obliging educational institutions to take this approach.
*In the United States* For “formal” products, schools can act on parents’ behalf and consent to the collection of personal information, since the data collected is solely for the school’s use and benefit. For “informal” products, parental consent must be obtained.
Among Canada, the EU, France, Australia and the United States, the United States is the sole country with specific legislation governing the management of personal information collected from students.
Canada, the EU, France and Australia all deal with the issue of student privacy under more general laws governing the protection of personal information:
- Canada: Personal Information Protection and Electronic Documents Act (PIPEDA)
- European Union: Directive on Protection of personal data and Directive on Privacy and Electronic Communications, Handbook on European Data Protection Law
- France: Act on Information Technology, Data Files and Civil Liberties
- Australia: Privacy Act
United States
- Family Educational Rights and Privacy Act (FERPA)
The FERPA is a federal law that protects the personally identifiable information of students who attend federally funded schools.
For “formal” educational products, schools can act on parents’ behalf and consent to the collection of personal information from students, since the data gathered is solely for the school’s use and benefit. The FERPA requires schools to maintain direct control of any information they share with a producer. Ensure that the data you store can be easily accessed at all times.
Additional information : U.S. Department of Education. Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices
- Children’s Online Privacy Protection Act (COPPA)
COPPA is a federal law that governs the online collection of information about children. It applies to products that collect personal information about U.S. citizens under 13 years of age in a private or educational context, even if the company in question is based outside of the U.S.
Schools cannot grant consent on the parent’s behalf for “informal” educational products. For example, should a teacher want students to use a virtual world in a school project, he or she must obtain verifiable parental consent for each student.
Additional information : Federal Trade Commission: Complying with COPPA: Frequently Asked Questions
See Backgrounder Collection of Personal Information
Apple App Store
Google Play
*In March 2015, Google Play for Education was available in Canada, the United States and England.
Google Play for Education, a service available to primary and secondary schools, offers teacher-approved educational content categorized by subject and level.
Apps must meet certain criteria to be part of the selection. For details.
In the United States, various pledges issued by the EdTech industry demonstrate its commitment to protecting the confidentiality and security of personal information collected from students.
- In an educational setting, teachers can act as parents’ agents and provide consent for applications they wish to use in the classroom. To keep communications with parents transparent, post a clear, detailed, up-to-date and easily accessible privacy policy explaining your personal data collection and handling practices.
- Limit your collection of personal information to the requisite minimum. For example, if possible, offer students the option of registering under an alias rather than their first and last names.
- Limit your use of data to the purposes for which consent has been secured, and store the data for only the minimum amount of time necessary.
- Parents who request it must be allowed to access the personal information collected about their child; you must also honour their right to revoke their consent for future collection.
- Should you change your privacy policy, inform parents and schools and again request consent.
- It is your responsibility to ensure that any tracking tools embedded in your product are acceptable. For example, behavioural advertising is prohibited under FERPA and COPPA as well as in products aimed at the Québec market.
- *United States*: many states have their own laws regarding the protection of student information. Be sure to remain abreast of local regulations.
- *United States*The legal definition of “personal information” can vary. Different obligations and restrictions apply to “personally identifiable” and “aggregated” data.
