Update: As of 11/13/13, Education Commissioner Robert Hammond announced Colorado has become the 6th state to pull out of inBloom.
The Colorado Department of Education plans to help corporations profit from schoolchildren’s most sensitive and confidential information without even obtaining parental permission. Colorado is one of five states committed to planning to share personal student data with inBloom, Inc. a corporation funded by the Gates Foundation. This information—including your child’s name, home address, email address, test scores, racial identity, economic and special education status, and detailed disciplinary and health records—will be stored on a “data cloud” and shared with for-profit companies, without any guarantee that the information will be safeguarded.
The good news is that data sharing is not scheduled to begin until January, 2014 so there is still time to stop this ill-conceived project. Already four out of the nine states that originally planned to share data with inBloom have pulled out because of privacy concerns and extensive parent protests. And parents in Jefferson County—the first district in Colorado scheduled to share data with inBloom—have already gathered hundreds of signatures urging their local school board not to proceed or at least require parental consent.
What type of data will be collected, stored, and shared with private companies? inBloom is configured to collect extremely sensitive, personally identifiable student data, including student names, grades, test scores, detailed disciplinary, health and attendance records, race and ethnicity, and economic and disability status. Data fields even include whether a student is pregnant, attends a religiously affiliated school, has refugee status, has been removed from his or her home by Child Protective Services, or been involved with law enforcement for an out-of-school incident.
It is difficult to understand how students would benefit from having such sensitive personal information about them shared with for-profit corporations, but it is clear that such disclosures could harm students. Sensitive information about school employees, including teacher health records and reasons for employment termination, will also be shared with inBloom.
With which private companies will inBloom share student data? It has been reported that technology companies eagerly anticipate “huge” profits from access to this data. As of May 2013, the inBloom website lists 22 “providers,” including huge corporations like Amazon and Dell. To date, no inBloom or Colorado representative has identified what protections are in place to ensure that students’ information will not be shared within these enormous companies, many of which have multiple divisions other than those for whom the information is intended.
Who is paying for inBloom? The Gates Foundation has provided $100 million for the project’s initial development. Beginning in 2015, however, school districts will have to pay between $2 and $5 per student per year to have their students’ data stored on inBloom. Should data leakages, information abuse, or hacking occur, school districts could be liable for compromising their students’ confidential data.
Is this legal? Colorado officials claim that the sharing of data with inBloom and private companies is legal under the Family Educational Rights and Privacy Act (FERPA). But critics charge that the U.S. Department of Education’s 2011 changes to FERPA—which now allows school districts to share sensitive student data with private contractors—violate the original intent of the law. Recently, the Electronic Privacy Information Center filed suit against the U.S. DOE for these changes to FERPA. In addition, there are concerns that sharing of personal information violates the Children’s Online Privacy Protection Rule, which was recently updated by the Federal Trade Commission. The Children’s Online Privacy Protection Act restricts the capture and use of a child’s personally identifiable information in recognition of the huge risks to safety and privacy that occur when commercial entities obtain access to it.
Do schools need parental permission before sharing children’s information with inBloom? Can parents opt out on behalf of their children? No and no. Neither the state nor the district is giving parents the right to opt out or consent before their child’s data is shared with inBloom and other third parties.