Google, a ‘school official?’ A regulatory quirk can leave parents in the dark
washingtonpost.com
washingtonpost.com
Yes, if you use SAAS software, this information will be processed by remote servers.
Yes, if you use proprietary software, you will not know exactly how is this information processed.
And finally, if you have someone who is willing to work as school clerk, given how much do these jobs pay and how interesting they are, this person will likely not understand the complexity of these issues and will be a little bit lazy with their job, so she probably will not present parents with all the relevant information.
Now, every single one of these facts seem obvious; how is combination of these facts warrant an article in one of the biggest newspapers all of a sudden?
I think that is naive -- the general population understands perfectly that Google tracks users and uses that information to display ads. The GAFE apps are covered by different terms of service that restrict the collection of information, but Google draws the line in plain English in their GAFE/GAFW copy:
We do not scan for advertising purposes in Gmail or other Google Apps services. Google does not collect or use data in Google Apps services for advertising purposes. The situation is different for our free offerings and the consumer space.
I think the reason why schools go for GAFE is clear and simple: the choice is between having personnel on staff for maintaining servers, computer labs, and troubleshooting students' devices; or outsource it nearly for free to Google.
Which neatly leaves out non-advertising purposes. The statement even admits to collecting data for other purposes in the negative - otherwise the would simply say they "scan ... collect or use" the data at all.
This is just like the word-games the NSA likes to play when they insist they aren't collecting data "under this phone records program".
Both Google (for collecting and aggregating data) and the schools (for giving the data to a 3rd party) should be held liable for anything that happens from this data collection.
Articles like these hurts privacy because they cause noise where none is deserved and people just get tired of hearing things like this that they ignore legitimate worries like CISA.
Well, Snowden has shown us exactly that. Google participating voluntarily in PRISM.
OTOH, this is obvious. If you drop an analytics tag on GAFW or you track data for purpose of bug collection, or you are even keeping server access logs, then you are de facto collecting data.
For example, consider "we collect the following data" - because everything is hosted in GAFE, isn't Google technically collecting your email data? And your calendar data? And your students research papers? The list of "following purposes" could be very long to just even describe the list of features the client is expecting - and may even have to be updated every time a new feature is deployed - imagine you had to go through legal every time you wanted to push a change prod.
I would absolutely want every change by Google to jump through lots of hoops. Facebook-style "Move fast and break things" and "Ask for forgiveness instead of permission" is fine when you're allowing people to share photos of their cats, but not when you're managing the education data of nearly every child in the country.
It raises the far more interesting point that Google's Apps For Education policies are very granular and services such as Google Search and YouTube are allegedly not covered under the primary agreement - they carry completely different T&C's and may be used for advertising and data harvesting. It is highly likely that students logged in to GMail or Google Docs and doing schoolwork will be doing searches and watching (hopefully) educational videos to learn more about a subject. Those activities may not be covered by the educational use privacy policy.
What percentage of parents know this, even among those that bothered to check the T&C's? Did they notice the exception? What percentage of teachers or school administrators take the initiative and disable all non-core Google Apps For Education services like Google Search (which are enabled by default)? This is the conversation parents and school administrators need to be having.
I don't begrudge a advertising giant like Google from relentlessly collecting and data mining users to manipulate them, that's what ad companies do after all. Savvy users and regulators know this and can take appropriate action to guide the less-technical with safe defaults. I do think the defaults here are not safe from a privacy perspective, and I wonder if the time has come to re-examine whether the non-core services not covered by the educational privacy terms should be disabled by default.
[0]https://www.washingtonpost.com/news/the-switch/wp/2015/12/28...
Obvious or not, will this combination of circumstances result in what can widely be perceived as improper? Is that not worth note, just because your insight to the mechanisms means you understand the state of affairs?
If Google is a "School Official," their FERPA obligations do not stop at any point short of/when operating in that capacity.
Further, the idea that they can somehow "switch hats," and somehow maintain discrete sets of both FERPA and non-FERPA behaviors is at best naive, and at worst a conspiracy to commit various felonies.
The money shot of the article: EPIC didn't have standing when they filed their lawsuit, not that they were wrong with regard to laws being broken. With that, I hope entire school districts of parents with school age children file suit.
This was a huge deal in the USA PATRIOT domestic spying cases, where courts refused to hear lawsuits about spying, because plaintiffs couldn't prove they were being spied on before they won the right to collect evidence, because it was illegal for libraries/banks/IT companies disclose the spying!
It's really sad.
The average American does not care to the level of granularity needed to even raise the question of whether Google (a company many people trust with their private email accounts) is a trustworthy steward of private student information.
As a parent with a child entering Kindergarten this upcoming school year, and as an avid privacy and free software advocate, I'm not looking forward to the types of discussions that I'm likely going to have to have with our schools. The reality is that these aren't systems that are easy to roll back---it costs a lot of time and money to implement, and then you have vendor lockin.
So while I can hope for a receptive district, action is probably going to be more difficult. My hope is that they haven't ddone anything too disagreeable yet.
Does anyone else have any personal experiences working with their schools?
You have nothing but a webbrowser, which Google and the school control.
If it's the school's, then I would just say no. It's theirs, they can do whatever they want with it. How about giving your chid a real general-purpose computer instead, running completely free software:
http://minifree.org/product/libreboot-x200/
Just as Google et al. are trying to get kids conditioned to their ecosystems at a young age by pushing their product, those who advocate against them should do the same.
My point is the insinuation that Google or other tech-ed companies are inappropritely classified as "school officials" which the allows them access to data to profit from is made. It's all speculative what-if without any substantive reporting. No where in the article is a comment "Google declined our requests for information" or "Google declined to comment". The closest thing is a general quote from an EPIC associate about tech-ed companies being hush about how they use their data.
Fortunately, the FTC is empowered to do the "old-fashion sleuthing" if they find the accusation has merit on its face.
Disclosing partner and vendor data usage to parents is likely a tricky issue for schools. My guess is the current loophole is more about laziness and lack of mature regulation than any insidious plan by Google to capture data about our kids so they can show more relevant ads.