Late last month, the House of Representatives Education Subcommittee on Early Childhood, Elementary and Secondary Education and the Homeland Security’s Subcommittee on Cybersecurity, Infrastructure Protection and Security Technologies held a joint hearing to discuss student data privacy, or more specifically, “How Data Mining Threatens Student Privacy”.

Fordham University Law Prof. Joel Reidenberg quoted from his 2013 study, which has some very scary statistics: While 95 percent of the surveyed school districts are using cloud services for such things as assessments, administration and learning, only 20 percent of the districts had policies in place to protect student data, and less than seven percent of the districts had written contract provisions that would prohibit the sale of student data by any of their vendors.

And while Reidenberg was unable to cite for the committee members any specific examples of third-party data use, a recent study by Politico did exactly that—it found and identified many examples of student data being collected and tracked, perhaps as many as 10 million unique data points on each child, each day.

Part of the problem is in defining exactly what is “education data” and what is covered under the main federal statute, the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99).

This law, now 40-years-old, was created, as one member of the hearing noted, “to protect the student records that are in the file cabinet in the principal’s office.” A 2008 update clarified the data that can be provided for research and accountability, in an anonymized manner, but is silent on many of the data points that are currently being collected. In addition, there is a large amount of data on students and prospective students that is collected by both for-profit and nonprofit organizations that falls outside of FERPA and is subject only to the collecting organization’s privacy policies and company culture.

And at what age are these companies collecting data?

The Children’s Online Privacy Protection Act requires parental consent to collect information on children under the age of 13. So if a school district signs up its first-grade class to an online service, is that valid consent? Until now, the law is silent on this point.

The other major battleground will be in the state legislatures, where there were more than 100 student privacy bills introduced in 35 states. The data being collected from the Department of Education Common Education Data Standards contains hundreds of data fields on each student and includes family income, health data, medical and dental insurance information, disciplinary records and much more.

It would be great if Congress updated FERPA; it’s not likely to gain enough support in the near term to be changed. And even if it was to be considered, it would be years before new legislation could be in force. Also, if FERPA was to be considered for an update, Congress should investigate and consider changing, or at least being more clear, when FERPA applies, as currently there is a great deal of confusion among schools and others over when exactly FERPA protections attach to the data.

And while FERPA is sitting still, the states are quickly moving forward, passing laws to protect their citizens as they feel appropriate, likely with very conflicting standards and requirements that could drive up compliance costs for national companies looking to provide services that are trying to meet all of their clients' needs.

In my opinion, the fastest and perhaps easiest-to-implement changes could come from industry itself. Companies that are doing business with schools and those that collect student data could be more transparent as to what data they are collecting, how it is being used, whether it is being shared—and with whom—or not shared at all and have an easy-to-read-and-understand privacy statement along with contact information and be willing and prepared to respond to a parent inquiry.

The benefits of using data on students to enhance educational opportunities and improve the options that are available to every student are many. So are the fears of parents, who have begun to make their voices heard at school boards and state and local legislators’ offices, questioning whether this is all moving too fast and without proper oversight and controls, effectively threatening to put a stop to what could be a vastly improved education system for all.