# data[].attributes.attachment_link.title
@Lucykirch's link in bio | Resources and socials | Linktree

# data[].attributes.attachment_link.description
Explore @Lucykirch's official socials, latest resources, relevant content and more. Everything they do, all in one place on Linktree.

# data[].attributes.attachment_link.description
Hackers are terrorizing schools with increasingly complex attacks, causing data breaches and more. Here’s what educators need to know.

# data[].attributes.attachment_link.title
Recent cyberattacks highlight the vulnerability of California schools

# data[].attributes.attachment_link.description
Many school districts have limited or no dedicated cybersecurity teams. With no statewide standards, districts make their own decisions about cybersecurity measures. Lea este artículo en español. If Los Angeles Unified, the state's largest school district, can be hit with a ransomware attack, how prepared are California's public schools for the increasing threat of cyberattacks?

# data[].attributes.attachment_link.readable_text
This website uses cookies. See our Website and Cookie Privacy Policy. We will only place necessary cookies for the website to function, unless you choose to also allow any other type of cookies. I Agree

# data[].attributes.attachment_link.title
Higher Education Institutions - Student Data and EdTech | Student Privacy Compass

# data[].attributes.attachment_link.description
This website uses cookies. See our Website and Cookie Privacy Policy. We will only place necessary cookies for the website to function, unless you choose to also allow any other type of cookies. I Agree

# data[].attributes.attachment_link.readable_text
Cyberattacks are an increasing threat to businesses, governments, and organizations of all kinds. Schools are no exception. Last month, the Los Angeles Unified School District, the nation's second largest school system, was victimized by a massive ransomware attack. In late September, Michigan's South Redford school district was targeted by a cyberattack that closed schools for two days.

These attacks aren't isolated incidents.The explosion in online learning during the pandemic only exacerbated these challenges. In 2020, the K-12 Cybersecurity Center reported a record-breaking number of incidents, with 408 reported across 377 school districts in 40 states.

The issue for schools isn't just ransomware, but a range of cyber incidents including data breaches, ... [+]
getty

Last winter, Eileen Belastock, chief of technology and information in a Massachusetts school system, explored the cybersecurity risks facing America's schools and noted how ill-prepared schools are for the challenge. She observed, "Of the 17 industries studied by information-security company SecurityScorecard, the education sector ranked as the least secure in 2018."

How can schools respond as these attacks grow more frequent and disruptive? On that count, I recently talked with Doug Levin, co-founder of the K12 Security Information eXchange (K12 SIX), who had a hand in crafting national educational technology plans during the Clinton, Bush, and Obama administrations.

For starters, Levin points out that the issue for schools isn't just ransomware, but a range of cyber incidents including data breaches, phishing attacks, denial-of-service attacks, "and the takeover and defacement of school websites, social media accounts, and email systems." The consequences are significant, including, school closures, disruptions in teaching and learning, millions in taxpayer funds, and identity theft of students and staff. Since 2016, he notes, there have been more than 1,300 publicly disclosed incidents of this ilk.

Levin explains that these attacks are typically the work of "criminal groups operating overseas seeking to extort money from victims in exchange for the restoration of their IT systems and [sensitive data]." Since 2019, he says, districts across the U.S. have been increasingly targeted. Asked why schools would be attractive to these criminal enterprises, Levin says, "Schools manage more than enough money to capture the attention of cyber criminals."

Moreover, while Levin notes that hackers "could care less about students' algebra grades, it turns out that the identity information of minors is especially valuable to criminals interested in perpetrating credit and tax fraud." The Consortium for School Networking's 2019 K-12 IT Leadership Survey Report has noted that hackers are shifting from firms "which are devoting increased resources to cyber defenses" to "more vulnerable sectors like school districts, universities, and nonprofits."

So, what can schools do?

There are several things schools can do to better protect themselves. Levin says, "This is mostly not a technical issue that the right firewall or anti-virus software can fix. This is not about district IT leaders needing to just 'cyber' harder." Rather, "Just as schools deal with physical security risks on their campuses, they need to develop plans to prioritize and manage cybersecurity risks, resource these plans appropriately, and practice them."

Of particular import, Levin notes that school districts have been shifting away from local servers to take advantage of cloud-delivered software and services, for a slew of instructional, administrative, and operational needs. This is so important, he says, because "while companies like Amazon, Google, and Microsoft-which operate the infrastructure that powers most education software and services-have far better IT security operations than schools ever will, not every vendor delivering their software via the cloud can say the same."

The result, Levin observes, is that the ed-tech vendors providing schools with customized instructional and administrative services have been hit by "a significant number" of data-breach incidents that affect students and teachers, even as services have been interrupted as vendors are forced to address cyber incidents of their own. In the end, he says, the solution will require educational leaders to demand "better cybersecurity policies and practices from their vendors and suppliers."

There are also common sense measures that need to be taken. Levin stresses, "Ultimately, everybody has a role to play. Use a password manager. Use multi-factor authentication. Keep your devices' software up-to-date, and for Pete's sake don't click that dodgy link." As for how policymakers can help, Levin suggests that one priority should be better disclosure requirements for school cyber incidents that will yield a more comprehensive "research base about how and how frequently schools are being compromised."

Especially after three years in which schools have become increasingly dependent on technology for instructional delivery and operations, cybersecurity must become a priority for educational leaders.

# data[].attributes.attachment_link.title
Schools Are Getting Hit Hard By Cyberattacks. What Can They Do About It?

# data[].attributes.attachment_link.description
Cyberattacks are an increasing threat to businesses, governments, and organizations of all kinds. Schools are no exception. Last month, the Los Angeles Unified School District, the nation's second largest school system, was victimized by a massive ransomware attack. In late September, Michigan's South Redford school district was targeted by a cyberattack that closed schools for two days.

# data[].attributes.attachment_link.title
Student Privacy 101:  FERPA for Parents and Students

# data[].attributes.attachment_link.readable_text
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."

Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.

Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law.

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

# data[].attributes.attachment_link.keywords[]
policy; privacy; academic records; technical assistance; parent rights; student rights; ferpa

# data[].attributes.attachment_link.title
Family Educational Rights and Privacy Act (FERPA)

# data[].attributes.attachment_link.description
Family Educational Rights and Privacy Act (FERPA) Home Page.

# data[].attributes.attachment_link.title
Protecting Student Privacy While Using Online Educational Services

# data[].attributes.attachment_link.title
Signatories - Pledge to Parents & Students

# data[].attributes.headline
CISA CyberSecurity and Infrastructure Administration (US Gov)

# data[].attributes.subject
CISA CyberSecurity and Infrastructure Administration (US Gov)

# data[].attributes.attachment_link.provider_name
Cybersecurity and Infrastructure Security Agency CISA

# data[].attributes.attachment_link.readable_text
Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

# data[].attributes.attachment_link.title
Cyber Threats to K-12 Remote Learning Education | CISA

# data[].attributes.attachment_link.description
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (Lock A locked padlock ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

# data[].attributes.attachment_link.readable_text
This section houses all guidance documents, training materials, policy letters and other resources dedicated to protecting student privacy. To narrow the list of documents below, use the drop down menus to select the type of resource, the topic and/or the audience and click the 'apply' button. An updated list of resources will then be displayed below.

# data[].attributes.attachment_link.description
This section houses all guidance documents, training materials, policy letters and other resources dedicated to protecting student privacy. To narrow the list of documents below, use the drop down menus to select the type of resource, the topic and/or the audience and click the 'apply' button.

# data[].attributes.attachment_link.title
Data Privacy - Educational Data Governance (EDGO) (CA Dept of Education)

# data[].attributes.attachment_link.description
Laws, policies, and best practices related to both general and student data privacy at the California Department of Education. It provides data privacy information for parents, teachers, local education agencies, and the general public.

# data[].attributes.attachment_link.readable_text
The .gov means it's official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you're on a federal government site.

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

The Children's Online Privacy Protection Act (COPPA) applies to websites for kids, but it also may apply to sites aimed at general audiences. Read this revised publication to find out when your site is subject to COPPA.

A step-by-step plan for determining if your company is covered by COPPA - and how to comply with the Rule.

Do you have a question about COPPA, the Children's Online Privacy Protection Act Rule? Here are answers from FTC staff to help your business comply with COPPA.

A GUIDE FOR BUSINESS AND PARENTS AND SMALL ENTITY COMPLIANCE GUIDE The following FAQs are intended to supplement the compliance materials available on the FTC website. In addition, you may send questions or comments to the FTC staff's COPPA mailbox, CoppaHotLine@ftc.gov. This document represents the...

When it comes to the collection of personal information from children under 13, the Children's Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation's consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites...

# data[].attributes.attachment_link.description
The .gov means it's official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you're on a federal government site. The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

# data[].attributes.attachment_link.readable_text
When it comes to federal protections for students' sensitive personal information, the Family Educational Rights and Privacy Act, or FERPA, tends to get most of the attention.

In a nutshell, COPPA requires operators of commercial websites, online services, and mobile apps to notify parents and obtain their consent before collecting any personal information on children under the age of 13. The aim is to give parents more control over what information is collected from their children online.

This law directly regulates companies, not schools. But as the digital revolution has moved into the classroom, schools have increasingly been put in the middle of the relationship between vendors and parents.

The Federal Trade Commission, which enforces COPPA, has said that schools can, in many situations, stand in for parents and let companies collect information from young children. In some cases, companies may try to shift some of the burden of COPPA compliance away from themselves and onto schools. And it's clear that the law places significant indirect burdens on schools and educators.

Those dynamics have opened up multiple cans of worms, said Sonja H. Trainor, the director of the Council of School Attorneys for the National School Boards Association.

"The FTC has decided, not based on law or regulation, but as a practical reality, that schools can give consent on behalf of parents," Trainor said. "That is not without risk, and COPPA has a whole lot of gray area that gives school attorneys pause."

In an emailed response to questions from Education Week, FTC staff members provided clarification and new insights on a number of key areas that have had both schools and vendors worried.

But despite whispers in the field that the Federal Trade Commission and the U.S. Department of Education may be gearing up to jointly issue a formal new document with more answers, the commission doesn't "currently have a timetable for release of additional business guidance," according to FTC staff.

In the meantime, what do school boards, superintendents, principals, teachers, parents, and companies serving the K-12 market need to know?

Education Week turned to federal officials and documents, education law experts, and leaders in the field of student-data privacy to get their advice.

What exactly is COPPA?

Who does COPPA apply to?

Two groups:

Operators of commercial websites, online services, and mobile apps that are directed at children under 13 and "collect, use, or disclose personal information" from those kids.

And operators of websites and online services that are for a general audience but have "actual knowledge" that they are collecting, using, or disclosing personal information from children under 13.

COPPA generally does not apply directly to state government agencies, schools, or nonprofits.

What does COPPA require companies to do?

The list is long. Among other things, COPPA-covered operators must:

Post a "clear and comprehensive" online-privacy policy

Give parents "direct notice" before collecting information from children under 13

Obtain "verifiable parental consent" before collecting such information

Allow parents to review their children's information and request that it be deleted

Allow parents to opt out of further collection, use, or sharing of information pertaining to their child

Maintain the confidentiality and security of any child's information that is collected

Delete children's information after it is "no longer necessary to fulfill the purpose for which it was collected."

What types of information are we talking about?

For COPPA purposes, "personal information" can mean a child's name, address, or Social Security number; his or her username or screen name, if that could be used to make contact with the child; some geolocation information; persistent identifiers that might allow the child to be tracked across time or across websites; and more.

Less clear, though, is whether COPPA covers information such as IP (internet protocol) address, device identification number, the type of browser being used, or other so-called metadata that can often be used to identify users.

It's worth noting that COPPA applies only to information that is collected from children, not to information that is collected about children. So services that collect information from parents, for example, are not covered, even if some of that information pertains to their children.

OK, cut to the chase-where do K-12 schools come into the COPPA discussion?

Here's the heart of the matter:

In its FAQs, the Federal Trade Commission says that under certain circumstances, "schools may act as the parent's agent and can consent to the collection of kids' information on the parent's behalf."

There's a lot to unpack in that.

Yes, there is.

Let's start here: Do schools have to obtain parental consent to pass along to companies, or can schools grant consent in place of parents?

This is one of those big questions that have given schools pause. Trainor of the Council of School Attorneys, for example, said that some school lawyers have taken the FTC's previous guidance to mean that their districts must get consent from every single parent, for every single product that collects information online from young children.

In its responses to Education Week, though, the FTC provided new clarity.

"When schools give consent, the school may consent in lieu of the parents," according to staff at the commission.

That's what often already happens in practice, said Bill Fitzgerald, the director of privacy-evaluation initiatives at Common Sense Media.

But there are still a number of issues for schools to consider.

Whether and how schools can grant COPPA consent varies under certain circumstances, Fitzgerald said.

And in addition to consent, the law requires parental notification. Generally, the FTC expects companies to publicly post a privacy policy that includes descriptions of what information is collected from children, how that information may be used and disclosed, contact information for any third parties that may also be collecting information through the site, and more. Schools in turn are expected to make such notices available to parents. In practice, the details of that information exchange can get messy.

You said whether and how schools can grant COPPA consent varies under "certain circumstances." Explain.

First, according to the FTC, schools can grant consent on behalf of parents only when the operator of the website, online service, or app in question is providing a service that is "solely for the benefit of students and the school system" and is specific to "the educational context."

If the service isn't just for education, the operator and/or the school clearly has to get verifiable consent directly from parents.

How are schools supposed to determine if a website or app is strictly educational?

Now you're starting to see just how tricky this can get.

In its FAQs, the trade commission does provide a helpful list of questions for schools to ask operators when seeking to make this determination.

First and foremost, what information will be collected, and how will it be used?

And more specifically, will any information collected from children under 13 be used or shared for commercial purposes unrelated to education? Are schools allowed to review the information collected on students? Can schools request that student info be deleted?

If the answers to that second group of questions are, respectively, yes, no, or no, schools are not allowed to grant consent on behalf of parents, according to the FTC.

That sounds fairly straightforward.

In reality, it's not.

Fitzgerald of Common Sense Media laid out a number of areas where this can get complex.

In many cases, he said, companies include in their terms of service a provision that it's the school's responsibility to get verifiable consent from parents. Companies may even stipulate that schools using their service are required to retain proof of that consent and produce it on demand. If it's in the terms of service, it can be binding for schools that use the product, Fitzgerald said. The takeaway, he said, is that schools should read carefully all terms of service before letting students use a website, online service, or app.

Is that it?

No. Many vendors also allow third-party trackers (usually related to analytics or advertising) to be embedded into their sites and services. This complicates things tremendously, on all sides.

In its FAQs, the FTC says that operators are responsible for determining the "information-collection practices of every third party that can collect information" via their app, service, or site. And in response to questions from Education Week, FTC staff members went even further, writing that "generally speaking, an operator must disclose the existence of any third-party tracking services that are collecting personal information from children using the operator's website or online service."

In practice, though, vendors often don't provide that information to schools, or do so only in vague or conditional terms. In response to questions from Education Week, FTC staff said operators that don't adequately disclose the activity of third-party trackers that collect information from users under 13 cannot obtain informed consent from either parents or schools. That declaration could have huge implications.

Is that it?

Not quite. There's also a bigger reality that places schools in a bind when determining if and how they can grant COPPA consent on behalf of parents: Many of the online services in schools have both educational and commercial versions and applications.

Think about Google, for example. It's not at all unusual for students to enter one of G Suite's educational services through their student accounts, then venture out from there to one of Google's commercial services, like Maps or Search.

That must worry educators. Can schools be held liable for COPPA violations, or for improperly granting consent to a company that commits COPPA violations?

There are a number of ways to think about this.

First, here's how FTC staff responded when Education Week posed this exact question: "COPPA applies to operators of commercial websites and online services. COPPA does not apply to schools."

For Trainor of the Council of School Attorneys, though, the legal considerations for schools aren't quite so cut-and-dried. Here's what she had to say:
I wouldn't say the liability concerns for schools are so extreme that they should be put above more everyday concerns, like budgets or student achievement. But I would say that school leaders should be aware that this is a fuzzy area of the law. And school boards should be asking their attorneys and state board associations what kind of liability might exist in their state.
And then there's the broader issue of public trust and perception. If a school grants consent for an operator to collect information from young children, and that company turns around and violates COPPA, the school may not face any legal liability. But it's almost certain the school will have some angry parents to contend with.

OK, let's get practical for a second. How do schools notify parents and get their consent under COPPA?

Often through an Acceptable Use Policy or similar document that is sent home to parents at the beginning of the school year, said Fitzgerald of Common Sense Media. Sometimes, such a document describes the types of online services a school intends to use, what types of information they may collect, and how that information might be used. Even better, Fitzgerald said, is when schools provide a detailed list of exactly what websites/online services/apps students will be using, and what the information practices of each are.

This probably isn't as straightforward as it sounds, either.

Nope.

For one thing, some privacy experts say that a one-time, blanket sign-off at the beginning of the school year may not be considered valid notification and consent under COPPA, especially if it doesn't list the specific online services that children will be using.

Who in the school should be responsible for granting COPPA consent?

In its FAQs, the FTC recommends that this happen at the school or district level, and that responsibility for deciding "whether a particular site's or service's information practices are appropriate" not be delegated to teachers.

Many districts do in fact have that kind of review-and-approval process.

But don't many teachers also make their own decisions about what sites and apps they use?

Yes.

But that presents a couple of problems.

One is "click-wrap agreements." Often, these are the kinds of agreements that almost all of us are guilty of just clicking through without actually reading. Significantly, FTC staff said that "typically, a click-wrap agreement on its own would not suffice" to meet COPPA standards around notification and consent. This point could have big implications for both companies and schools.

More broadly speaking, it's still unclear whether a teacher can enter into a contract and provide COPPA consent on behalf of parents, even if it's not via a click-wrap agreement, said Amelia Vance, the education-privacy-policy counsel at the Future of Privacy Forum.

Many schools seek to avoid any situation where a teacher can incur liability on behalf of the district-and for good reason, she said.

"You just naturally have less due diligence when a teacher is the one signing up," Vance said. "They have a million things to do in a day, and that doesn't often include going through detailed privacy policies on a company's website to verify that it's in compliance with COPPA."

Does consent for a child to use a site/service/app carry over from year to year, or do schools need to get fresh consent each school year?

This is yet another gray area that's been troubling schools. The FTC provided some helpful insights to Education Week. Here's what commission staff wrote in their response to our question:
The consent [granted by a parent or school under COPPA] is specific to the particular website or online service offered and is not tied to the specific class or school year. However, COPPA requires the provider of the site or service to obtain a separate consent for any material change to its data collection or use practices.
In practice, Fitzgerald said, this appears to mean that a parent or school granting a company consent to collect information online from a child "basically lasts forever."

That would seem to be true even if the nature of the site or service evolves dramatically over time, Vance added.

What about when kids move?

In this situation, the new school enrolling the child "should ensure that it has received the necessary notice from the operator and given consent for the child's use," according to FTC staff.

In practice, Vance said, that appears to mean that COPPA consent is not transferable from school to school. That appears to be especially true when a child moves between states that may have different student-data-privacy laws of their own.

Vance also raised another question: When a child under 13 moves, what happens to the COPPA-covered information that companies hold on that child?

"The first thing parents do when they move is not go find all the companies who are storing their child's information and make sure it's deleted," she said. "And there's not really a clear process by which schools can go to companies and let them know a child is no longer there."

Well, what's the answer?

It's not clear.

What happens when an operator collects information on a child under 13, and then that child turns 13?

According to FTC staff, COPPA does not require any new consent for newly collected personal information after a child turns 13.

Other privacy laws likely apply, though.

And FTC staff did have this to say, which again could have big implications for schools and ed-tech companies:
An operator cannot combine the previously collected personal information [from a child under 13] with the newly collected personal information [from the same child, once he or she is 13 or older], to engage in uses beyond what had previously been consented to by either parents or a school. And of course, any data collected from a child under 13 can only be retained as long as is reasonably necessary to fulfill the purpose for which the information was collected.
Let's say a school successfully and appropriately provides COPPA consent for its students to use a particular app. Do parents still retain their rights under the law?

Good question. Remember, COPPA isn't just about consent. It also requires operators to let parents review their children's information, request that it be deleted, and more.

Unfortunately, the FTC's response to Education Week didn't provide much clarity.

Trainor, the director of the school attorneys' group, said this is another gray area.

"I think parents might be able to make that request directly of an operator under COPPA," she said. "But it's fuzzy."

What about schools? Under COPPA, can they request to review/delete the information collected from children under 13? Should they? Does this ever happen?

Yes, it does happen, but probably not as often as it should, privacy advocates say.

Fitzgerald of Common Sense Media is among those who would "love to see schools and parents get together and submit sample requests" just to see what happens.

What are the penalties for COPPA violations?

Operators can be hit with a civil penalty of up to $40,654 per violation.

Have any companies actually been sanctioned under COPPA?

Yes.

The most recent was in 2015, when two developers behind popular kids' apps such as My Cake Shop and Cat Basket agreed to pay $360,000 in civil penalties as part of a settlement with the FTC.

Large, well-known general-audience companies have been caught up in COPPA troubles, too. In 2014, Yelp agreed to pay a $450,000 civil penalty over a complaint that it had for years collected personal information from children without first getting parental consent.

And one of the larger COPPA settlements came in 2012, when the operator of fan websites for music stars such as Justin Bieber and Rihanna agreed to pay a $1 million civil penalty.

"Even a bad case of Bieber Fever doesn't excuse [operators'] legal obligation to get parental consent before collecting personal information from children," FTC Chairman Jon Leibowitz said at the time.

# data[].attributes.attachment_link.title
COPPA and Schools: The (Other) Federal Student Privacy Law, Explained

# data[].attributes.attachment_link.description
When it comes to federal protections for students' sensitive personal information, the Family Educational Rights and Privacy Act, or FERPA, tends to get most of the attention. In a nutshell, COPPA requires operators of commercial websites, online services, and mobile apps to notify parents and obtain their consent before collecting any personal information on children under the age of 13.

# data[].attributes.attachment_link.readable_text
The Children's Internet Protection Act (CIPA) was enacted by Congress in 2000 to address concerns about children's access to obscene or harmful content over the Internet. CIPA imposes certain requirements on schools or libraries that receive discounts for Internet access or internal connections through the E-rate program - a program that makes certain communications services and products more affordable for eligible schools and libraries. In early 2001, the FCC issued rules implementing CIPA and provided updates to those rules in 2011.

What CIPA requires

Schools and libraries subject to CIPA may not receive the discounts offered by the E-rate program unless they certify that they have an Internet safety policy that includes technology protection measures. The protection measures must block or filter Internet access to pictures that are: (a) obscene; (b) child pornography; or (c) harmful to minors (for computers that are accessed by minors). Before adopting this Internet safety policy, schools and libraries must provide reasonable notice and hold at least one public hearing or meeting to address the proposal.

Schools subject to CIPA have two additional certification requirements: 1) their Internet safety policies must include monitoring the online activities of minors; and 2) as required by the Protecting Children in the 21st Century Act, they must provide for educating minors about appropriate online behavior, including interacting with other individuals on social networking websites and in chat rooms, and cyberbullying awareness and response.

Schools and libraries subject to CIPA are required to adopt and implement an Internet safety policy addressing:

Access by minors to inappropriate matter on the Internet;

The safety and security of minors when using electronic mail, chat rooms and other forms of direct electronic communications;

Unauthorized access, including so-called "hacking," and other unlawful activities by minors online;

Unauthorized disclosure, use, and dissemination of personal information regarding minors; and

Measures restricting minors' access to materials harmful to them.

Schools and libraries must certify they are in compliance with CIPA before they can receive E-rate funding.

CIPA does not apply to schools and libraries receiving discounts only for telecommunications service only;

An authorized person may disable the blocking or filtering measure during use by an adult to enable access for bona fide research or other lawful purposes.

CIPA does not require the tracking of Internet use by minors or adults.

You can find out more about CIPA or apply for E-rate funding by contacting the Universal Service Administrative Company's (USAC) Schools and Libraries Division (SLD). SLD also operates a client service bureau to answer questions at 1-888-203-8100 or via email through the SLD website.

Printable Version

Children's Internet Protection Act (CIPA) (pdf)

# data[].attributes.attachment_link.title
Children's Internet Protection Act (CIPA)

# data[].attributes.attachment_link.description
The Children's Internet Protection Act (CIPA) was enacted by Congress in 2000 to address concerns about children's access to obscene or harmful content over the Internet.

# data[].attributes.attachment_link.description
SDPC Resource Registry The SDPC Resource Registry has been developed to provide a framework for identifying solutions that have on-the-ground and real-world impact on student data privacy enabling schools, districts, state, and vendors find resources, adapt them to their unique context and implement needed protections.

# data[].attributes.attachment_link.description
The Student Data Privacy Consortium (SDPC) is an unique collaborative of schools, districts, regional, territories and state agencies, policy makers, trade organizations and marketplace providers addressing real-world, adaptable, and implementable solutions to growing data privacy concerns.

# data[].attributes.attachment_link.provider_name
State of California - Department of Justice - Office of the Attorney General

# data[].attributes.attachment_link.readable_text
The CCPA requires businesses to give consumers certain information in a "notice at collection." A notice at collection must list the categories of personal information businesses collect about consumers and the purposes for which they use the categories of information. (To find out how you can learn what specific information a business has collected about you, see the Right to Know section.) If the business sells consumers' personal information, then the notice at collection must include a Do Not Sell link. The notice must also contain a link to the business's privacy policy, where consumers can get a fuller description of the business's privacy practices and of their privacy rights.

This notice must be provided at or before the point at which the business collects your personal information. For example, you might find a link to the notice at collection on a website's homepage and on a webpage where you place an order or enter your personal information for another reason. On a mobile app, you might find a link to the notice in the settings menu. In a retail store, you might find the notice on a printed form used to collect your personal information.

A business's privacy policy is a written statement that gives a broad picture of its online and offline practices for the collection, use, sharing, and sale of consumers' personal information. The CCPA requires business privacy policies to include information on consumers' privacy rights and how to exercise them: the Right to Know, the Right to Delete, the Right to Opt-Out of Sale and the Right to Non-Discrimination.

Another California law, Civil Code section 1798.99.80, defines a data broker as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." This law exempts certain businesses that are regulated by other laws from this definition. Exempted businesses include consumer reporting agencies (commonly known as credit bureaus) and certain financial institutions and insurance companies.

Data brokers collect information about consumers from many sources including websites, other businesses, and public records. The data broker analyzes and packages the data for sale to other businesses.

The California law on data brokers requires data brokers covered by the law to register with the Attorney General and to provide certain information on their practices. The Data Broker Registry can be found on the Attorney General's website at https://oag.ca.gov/data-brokers.

Data brokers are subject to the CCPA. On the Data Broker Registry website, you will find contact information and a website link for each registered data broker, as well as additional information to help you exercise your CCPA rights.

You can click on the "View Full Submission" link on the Data Broker Registry to get instructions on how to opt-out of the sale of your personal information. However, you may not be able to stop the sale of all of your information. The CCPA's definition of "personal information" does not include information lawfully made available from government records, which are often sources used by data brokers.

You can also go to a data broker's website through the link posted on the Registry and find the broker's privacy policy to learn more about its privacy practices and how to exercise your CCPA rights.

Consumer-Action.org

# data[].attributes.attachment_link.description
The CCPA requires businesses to give consumers certain information in a "notice at collection." A notice at collection must list the categories of personal information businesses collect about consumers and the purposes for which they use the categories of information.

# data[].attributes.attachment_link.description
The ISTE Educator Standards challenge educators to deepen their practice, empower students and rethink traditional approaches to education.

# data[].attributes.headline
ISTE Digital Citizenship in Action Course (Grad units available)

# data[].attributes.subject
ISTE Digital Citizenship in Action Course (Grad units available)

# data[].attributes.attachment_link.readable_text
Digital citizenship is about more than online safety. It's about creating thoughtful, empathetic digital citizens who can wrestle with the important ethical questions at the intersection of technology and humanity.

In Digital Citizenship in Action, you'll learn how to teach and model digcit so you can help students be responsible and active in online communities. The course starts with the basics and moves outward to guide you in exploring various sets of learning standards, identifying frameworks for digcit education, integrating digcit across content areas, and even sharing how students can connect online to participate in social justice and sustainability projects.

This is a 15-hour, self-paced course with ongoing instructor support.

# data[].attributes.attachment_link.description
@media (max-width: 767px) { .for-desk { display: none; } } @media (min-width: 768px) { .for-mob { display: none; } } Digital citizenship is about more than online safety. It's about creating thoughtful, empathetic digital citizens who can wrestle with the important ethical questions at the intersection of technology and humanity.

# data[].attributes.headline
ISTE Expert Webinar-June 6, 2023 10-10:30 am PT

# data[].attributes.subject
ISTE Expert Webinar-June 6, 2023 10-10:30 am PT

# data[].attributes.attachment_link.description
FERPA, COPPA, CIPA, oh my! Federal student data privacy laws are an important part of our educatio

# data[].attributes.headline
9 Tips for a Robust Discussion on Student Data Privacy

# data[].attributes.subject
9 Tips for a Robust Discussion on Student Data Privacy

# data[].attributes.attachment_link.readable_text
Student data privacy is an important topic but a complicated one, and therefore school leaders often find it difficult to talk about with parents and students about measures they can take to protect personal information. Student data privacy doesn't set off alarm bells the way topics like screen time and cyber-bullying do.

Still, it's imperative that parents, students and teachers are well informed about the types of data that schools keep and how they safeguard it. Here are nine tips for talking about student data privacy in a way parents can understand.

Be transparent.

Take the initiative to provide information students and parents need about safety and security. Remove the mysteries and misunderstandings about what is going in a student's "permanent file." Provide all the school policies, rules and guidelines for how the district collects, uses, protects and shares data.

Know your roles.

It's everyone's job to provide security and safety but the roles of districts, principals and classroom teachers are different. Work within the organization to define roles. Then study up and become comfortable with your place and what you are responsible for sharing.

Name a point person.

There should be one person and place in the organization responsible for data privacy answers. In some districts, there is a designated privacy officer. There should always be at least one highly trained person who parents and students can contact with their questions and concerns.

Ask parents' permission.

Make information available on the web and on paper about the online tools being used and links to their privacy policies. Then ask them to sign off on the tools. If they have safety concerns, give options.

Ask for parents' input.

If parents discover internet tools that are helpful, provide a form where parents can submit their ideas so a district committee can vet the tools.

Tout your training.

Offer training so all stakeholders can be well informed. Marsali Hancock, president and CEO of the Internet Keep Safe Coalition, trains and presents nationwide. A mother of six children, she can relate to parents, so her website offers clear guidance.

Don't waste time.

Students, families and educators should have timely access to information collected about students whenever they ask for it. Information delays discourage inquiries.

Have a plan in case of mistakes.

Inform parents how they will be notified if there is any misuse or breach of information and available remedies.

Avoid acronyms and edu-speak.

Educators may be familiar with the technical terms surrounding data privacy, but don't overuse them with a general audience without explanations. You'll know when you're overdoing it when people respond with another acronym, MEGO (my eyes glaze over).

Here's a list of some common acronyms and what they stand for:

FERPA: Family Educational Rights and Privacy Act

IDEA: Individuals with Disabilities Education Act

COPPA: Children's Online Privacy Protection Act

SOPIPA: Student Online Personal Information Protection Act

PPRA: Protection of Pupil Rights Amendment
This is an updated version of a post that was originally published on April 8, 2015.

# data[].attributes.attachment_link.title
9 Tips for a Robust Discussion on Student Data Privacy

# data[].attributes.attachment_link.description
Student data privacy is an important topic but a complicated one, and therefore school leaders often find it difficult to talk about with parents and students about measures they can take to protect personal information. Student data privacy doesn't set off alarm bells the way topics like screen time and cyber-bullying do.

# data[].attributes.attachment_link.title
Student Data Privacy - California IT in Education

# data[].attributes.attachment_link.title
SDPC: Search California Alliance Website

# data[].attributes.attachment_link.description
The Student Data Privacy Consortium (SDPC) is an unique collaborative of schools, districts, regional, territories and state agencies, policy makers, trade organizations and marketplace providers addressing real-world, adaptable, and implementable solutions to growing data privacy concerns.

# data[].attributes.attachment_link.description
Join the Community Becoming a Member The Access 4 Learning Community (A4L) and it's special interest group the Student Data Privacy Consortium (SDPC), is unique as it offers all members an equal voice. Whether you are a small business or a multi-national, a one-building district/division or national education agency, your voice and opinions count and [...]

# data[].attributes.headline
Forbes Article: How to Protect Your Student Data in College

# data[].attributes.subject
Forbes Article: How to Protect Your Student Data in College

# data[].attributes.attachment_link.title
How To Protect Your Student Data In College

# data[].attributes.attachment_link.description
In a data-driven world, protecting your data is an essential skill in your student and personal life. Colleges and universities are collecting more data than ever. Understanding which information is collected, how it’s used and how data collection can impact you is critical to data security. If y

# data[].attributes.attachment_link.readable_text
/ CW50 Detroit

REDFORD, Mich. (CBS DETROIT) - South Redford School District officials said no data was breached during a cyberattack that closed schools for the second day in a row.

In an update released Wednesday afternoon, the district said the cyberattack was isolated before it could spread.

The district is just the latest that hackers have targeted.

It also comes on the heels of an FBI advisory, warning schools about an increase in cyber attacks

After warning teachers and students not to use school-issued devices, the district said chrome books can now be used, but windows based computers should still stay offline.

The district is working with cyber forensics teams on the issue.

"When you talk about schools, it's very sensitive information," said David Derigiotis cyber security expert from EmBroker. "You have all sorts of data on children, on minors. You have payroll information, health care information for teachers. It can be extraordinarily disruptive to the busing services, the meal plans."

Derigiotis said there is no silver bullet to prevent getting hacked, but he said it's important to train employees on how to avoid malicious emails, make sure systems and apps are updated, and to use multi-factor authentication.

"Security is all about layers," he said.

As of 4 p.m. on Wednesday, there is no word on if classes will resume Thursday.
Read the district's full update below:
This week South Redford School District was a victim of a malicious cyber-attack that has impacted the learning of our students. It is hard to believe that someone would deliberately try to disrupt our children's education, but overnight our Cyber Forensics teams made great progress in resolving this attack and securing our systems. Using advanced internet security software, Cyber Forensic teams identified the cyber-attack that appears to have been isolated before it could be spread throughout the District; due in part to early detection, intervention, and proactive measures of the District to limit technology and network usage. At this time, the Cyber Forensic team have yet to identify any evidence of a data breach. The District hopes to have additional updates for our community later this afternoon. In the meantime, Cyber Forensics teams are advising the District that student and staff-issued Chromebooks were not impacted by the cyber-attack and can be brought back into service at this time. Windows-based computers, issued by the District, should remain offline while Cyber Forensic teams continue to run advanced diagnostics and software on these systems. Again, we appreciate the overwhelming support and patience from our community as we navigate this difficult situation. We look forward to an opportunity to put all of our time and energy back to where it belongs; educating the students of the South Redford School District.

Raymond Strickland

# data[].attributes.attachment_link.title
Officials provide update on cyberattack that shut down South Redford Schools

# data[].attributes.attachment_link.description
CW50 Detroit REDFORD, Mich. (CBS DETROIT) - South Redford School District officials said no data was breached during a cyberattack that closed schools for the second day in a row. In an update released Wednesday afternoon, the district said the cyberattack was isolated before it could spread.

# data[].attributes.attachment_link.title
Toledo Public School students seeing effects of massive data breach

# data[].attributes.attachment_link.description
TPS parents are saying they’re being notified about accounts trying to be opened in their kids’ names.

# data[].attributes.attachment_link.readable_text
(Francine Orr / Los Angeles Times)

The Los Angeles Unified School District disclosed Wednesday that "approximately 2,000 student assessment records" were posted on the dark web as a result of a recent cyberattack, including those for 60 who are currently enrolled.

The posted records also included an unspecified number of driver's license numbers and Social Security numbers. The district statement did not say to whom those numbers belonged, but the school system does not routinely collect Social Security numbers from students.

Separately, the Long Beach school system, one of the state's largest, notified families Wednesday of a data breach that, so far, appears to contain the email addresses of students and student ID numbers.

The acknowledgment by L.A. Unified regarding sensitive student data came in the wake of an article by The 74, an education news site, reporting that detailed and sensitive mental health records of "hundreds - and likely thousands - of former Los Angeles students" were published on the dark web, containing "personally identifiable information about students who received special education services, including their detailed medical histories, academic performance and disciplinary records."

The district did not directly address how many affected students or their families had been notified of the breach.

"We have already notified some individuals and vendors who have been impacted by this attack and will continue notifying individuals as they are determined," the statement said.

The district also provided some additional details on the types of records that had been breached.

"Some of these records go back almost three decades which creates further time-consuming analysis," the statement said. "Our review has also revealed positive COVID-19 test results were part of the breach. Further analysis is ongoing."

It's hard to uncover the trail of effects from such data breaches, Brett Callow, threat analyst for the cybersecurity company Emsisoft, told The Times.

" What impact does knowing that extremely sensitive information have on people, including in terms of their mental health?" Callow said. "How often is the stolen information misused? How often do third parties scrape the data and share it on other websites or on social media? How often [are] people actually contacted in extortion attempts?

"Unfortunately, it's not unusual for attacks to result in sensitive information leaking online," he continued. "Ransomware is more of a problem than people sometimes realize, and we really do need to find better ways to counter it."

The nature of most of the compromised records had been publicly disclosed months ago, with L.A. schools Supt. Alberto Carvalho characterizing individuals compromised by the breach as "outliers," given that the district has records for millions of individuals in its databases.

The new disclosures considerably increase the number of acknowledged victims and add details about the confidential information that was obtained.

Hackers are currently thought to have entered district computer systems as early as July 31. District technicians noticed the intrusion on Sept. 3, the Saturday of the Labor Day weekend, and responded by quickly shutting down systems to prevent further harm. After the district refused to pay ransom to the hacking gang, which has specialized in targeting educational institutions, the hackers posted about 500 gigabytes of data on the dark web.

The hackers' encryption of district systems, "tripwires" left behind that could have caused further harm and the district's own shutdown led to several weeks of gradually diminishing disruption. Some technical fixes have yet to be made.

Wednesday's statement marked the second time this year that L.A. Unified had disclosed greater harm than previously announced.

The first instance came by way of a notification in January to state regulators that the intrusion probably exposed confidential information, including Social Security numbers, of more than 500 people who worked for district contractors. This notification also stated that the intrusion into the computer systems of L.A. Unified began more than a month earlier than had been described in district briefings.

That January notification was part of documentation required by the state of California and did not become public until journalists found it in state records.

"Los Angeles Unified continues to assess the ramifications of the September 2022 cyberattack," according to the L.A. Unified statement, which was attributed to Jack Kelanic, senior administrator for IT infrastructure. "This is an ongoing investigation in partnership with forensic and cybersecurity experts where arduous, painstaking efforts are taking place to comb through the data, review individual pieces, determine what information was accessed, locate the impacted individuals and notify them of resources to protect themselves."

He added in the statement: "The aftermath of a cyberattack is a multi-layered, dynamic process in which real-time updates often alter the direction of an investigation... Ongoing legal notification is complex and made harder in many instances due to the age of files."

District spokesperson Shannon Haber said the district "always reported the information we had at the time," which she said was vetted before release by district lawyers and investigating law enforcement agencies.

The data breach in Long Beach Unified involved at least 130,000 student names, along with their corresponding school district-provided email addresses and their student ID numbers. These ID numbers are used within the school system but are not part of a permanent identification system in the manner of a Social Security number or driver's license.

A district spokesperson said that the student information system "remains secure, and no sensitive student data was accessed." Data that remain secure include addresses, birth dates and grades.

"Our team worked closely with a consortium of federal and local law enforcement agencies to ensure that more sensitive information was not compromised," said spokesman Chris Eftychiou. "As always, LBUSD will continue working to implement new features within our internal network to limit the capabilities of bad actors who look to gain notoriety through breaching sensitive data."

# data[].attributes.attachment_link.title
L.A. Unified data breach last year includes at least 2,000 student records, officials say

# data[].attributes.attachment_link.description
The Los Angeles Unified School District disclosed Wednesday that "approximately 2,000 student assessment records" were posted on the dark web as a result of a recent cyberattack, including those for 60 who are currently enrolled. The posted records also included an unspecified number of driver's license numbers and Social Security numbers.

# data[].attributes.headline
K-12 Student and Educator Training Videos (Cyber.org)

# data[].attributes.subject
K-12 Student and Educator Training Videos (Cyber.org)

# data[].attributes.headline
South Florida Data Breach: Ransom Attack

# data[].attributes.subject
South Florida Data Breach: Ransom Attack

# data[].attributes.headline
Albuquerque, New Mexico attack shuts down district (article) 

# data[].attributes.subject
Albuquerque, New Mexico attack shuts down district (article) 

# data[].attributes.attachment_link.readable_text
A cyberattack against Albuquerque Public Schools prompted the state's largest district to cancel all classes districtwide on Thursday and possibly Friday.

APS Superintendent Scott Elder said the attack was discovered Wednesday morning "when teachers tried to log onto our student information system and were unable to gain access to the site."

The district is working with authorities. A spokeswoman couldn't say whether hackers had demanded money from APS.

The district's information technology department had been "mitigating attacks over the last few weeks," Elder said in a brief statement aired on the district's YouTube channel.

"This is the first time we have dealt with this situation and we are doing everything to address it that we can," he said.

Elder said all APS classes are canceled Thursday and possibly through Friday.

APS' 31 charter schools "may be affected because there will not be food or transportation services" on Thursday, said APS spokeswoman Monica Armenta. She said charters must decide independently whether to hold classes Thursday and inform their families and staff.

Elder stressed that the closure of APS schools "is not in any way tied to the pandemic." He said the situation is still developing.

"APS is working with local and national law enforcement as well as teams of cyber specialists to as quickly as possible limit our exposure to this attack, to protect all systems in our network and ensure a safe environment to return to school and business as usual," Elder said.

Armenta said the attack affected the district's student information system, which is used by teachers to track grades, absences and other student information. The APS website states the student information system "is responsible for student information collection, management, storage and retrieval."

APS is insured for cyberattacks, Armenta said, "to what extent I don't know."

She said she did not know if attackers had demanded money from the district.

"Because this is an ongoing investigation, we have limited information," Armenta said.

The news came exactly one week after Bernalillo County announced it had been hit by a ransomware attack.

The attack on the county government's systems forced the temporary closure of some county buildings, prompted a lockdown at the Metropolitan Detention Center and halted all legal filings with the Clerk's Office.

The FBI said Wednesday that the APS cyberattack does not appear to be related to the attack against Bernalillo County.

New Mexico Public Education Department spokeswoman Judy Robinson said PED was notified of the attack by Elder about 1:15 p.m. Wednesday. The state agency offered technical assistance from PED IT personnel, she said.

Robinson said to her knowledge no other school districts in the state have been affected by a cyberattack.

On Wednesday afternoon, APS notified parents, students and staff by Twitter and email of the closure "due to a cyberattack that has compromised some systems that could impact teaching, learning and student safety."

APS hoped to reopen schools on Friday, the message said. "However, if the issue isn't resolved by midday Thursday, students, families and staff will be notified."

APS is working with "contracted professionals to fix the problem," the district posted on Twitter.

Meanwhile, Bernalillo County continued to struggle with consequences of its week-old cyberattack.

County Manager Julie Morgas Baca told the county's elected, five-member commission Tuesday that the county had assistance from law enforcement and computer forensics specialists, and that its own information technology staff had been working tirelessly - "12-hour days, on weekends" - and was making progress toward recovery.

But the county so far has declined to say if it had or would pay a ransom or even if the attacker had made a specific demand.

"A crime has occurred and we acknowledge that, and we are limited to what we can say so as not to interfere with the investigation or recovery efforts," Morgas Baca said during Tuesday's commission meeting. "We sincerely appreciate everyone's patience and understanding, and I just personally want to apologize, especially to our public that has been inconvenienced by this."

A spokesman for the FBI said Wednesday the agency is aware of the latest attack on APS but would not confirm or deny it is investigating.

"However, when the FBI learns about intrusions, it's customary that we offer our assistance in these matters, especially when it has such a direct impact on our community," spokesman Frank Fisher said in an email to the Journal. "At this time, it does not appear the APS and Bernalillo County cyber incidents are related."

With attacks on two other major public agencies in a week's time, a spokeswoman for the city of Albuquerque's Technology and Innovation Department said the municipal government is "always vigilant" when it comes to cybersecurity but declined to say whether the city had done anything different to guard itself lately.

"We do actively and continually work with our security partners," city spokeswoman Erika Eddy said. "Security is always taken very seriously."
Journal staff writer Matthew Reisen contributed to this report.

# data[].attributes.attachment_link.authors[].name
Olivier Uyttebrouck And Jessica Dyer / Journal Staff Writers

# data[].attributes.attachment_link.title
School's out as cyberattack forces APS to cancel classes

# data[].attributes.attachment_link.description
A cyberattack against Albuquerque Public Schools prompted the state's largest district to cancel all classes districtwide on Thursday and possibly Friday. APS Superintendent Scott Elder said the attack was discovered Wednesday morning "when teachers tried to log onto our student information system and were unable to gain access to the site."

# data[].attributes.headline
Common Sense Education: Privacy and Security Lessons

# data[].attributes.subject
Common Sense Education: Privacy and Security Lessons

# data[].attributes.attachment_link.readable_text
Overview

This topic introduces students to the concept of online privacy and the potential implications of sharing private information with a range of people: friends, the public, app providers, and more. Sharing information about yourself can be a natural and healthy activity, and it can lead to positive connections and personal growth. However, it can also present safety risks, and students need to be aware of potentially harmful consequences such as identity theft and financial exploitation.

Our Instructional Approach

Balance of Benefits and Risks

On this topic, it is easy to default to scary rhetoric about the dangers of "Big Brother" and "stranger danger." However, a balanced approach looks at both the rewards and risks of sharing information online with others. Our lessons highlight some of the amazing opportunities that students have to interact, grow, and learn from each other. They also seek to prepare students to have a reasonable and cautious awareness of the serious risks associated with engaging in online activity, both from strangers and from third-party providers. Students will learn concrete strategies for safe, appropriate digital interactions so they can minimize the risks of online sharing -- and take advantage of the rewards.

Real-Life Scenarios

To help students see the importance of being safe and secure when they're online, our lessons include real-life scenarios where private information could potentially be shared, and where the benefits and risks are notable but not sensationalized. From encountering clickbait to setting up passwords to messaging with people online, the scenarios in our lessons provide an authentic context for grappling with the potential dangers that come with spending time online.
Go to lessons

# data[].attributes.attachment_link.title
Privacy & Security | Common Sense Education

# data[].attributes.attachment_link.description
Common Sense provides a comprehensive set of K-12 digital citizenship lessons. This page provides an overview and key considerations for teaching lessons in the topic Privacy & Security.

# data[].attributes.headline
Google: Be Internet Awesome (Younger Students) 

# data[].attributes.subject
Google: Be Internet Awesome (Younger Students) 

# data[].attributes.attachment_link.readable_text
The Be Internet Awesome curriculum gives educators the tools and methods they need to teach digital safety fundamentals. The materials developed by Google in partnership with iKeepSafe enable educators to bring the most critical teachings-and the excitement of Interland-into the classroom.

Included in the curriculum are lesson plans for the five topics, with activities and worksheets that were designed to complement Interland.

This work is licensed under a Creative Commons Attribution 4.0 International License.

Align with ISTE Standards

Don't require any personal information or login

Can be used across devices

Are free for everyone

# data[].attributes.attachment_link.description
We've created internet safety resources to make it easier for educators and students to incorporate and practice good digital habits in the classroom.

# data[].attributes.attachment_link.readable_text
Privacy is about the safeguarding of user identity, whereas security is about the safeguarding of user data. In today's online world it's important to understand how to keep your data and identity safe.

With UpSavvy, students learn how to protect their privacy and security in the platforms and apps they use today. Students will be sure to know how the applications work, the content and trends, and what the purpose of that each particular tool is. How to choose what information to share and what settings are available to protect it.

UpSavvy privacy & security lessons

Staying safe on the internet

Using websites and apps safely

What should be kept private when online

Choosing strong passwords and keeping them safe

What kinds of information are safe to share online

Protecting yourself from viruses and malware

Identifying phishing attacks and malicious websites

Sharing personal information with apps

How to secure social media accounts

Protecting your personal data on social media

How your personal data is shared by companies

Understanding hackers, ransomware and cryptocurrency

Privacy and security considerations after high school

Digital citizenship curriculum topics

About UpSavvy

UpSavvy provides one minute lessons for digital citizenship using interactive video format. It can be deployed with single sign-on and integrates with Google, Microsoft, Clever, ClassLink. UpSavvy was launched by former Googlers who helped over 4 million people learn how to use Google Apps.

Why UpSavvy works

200+ bite size lessons with resources in a ready to go package.

Students learn about apps and scenarios they encounter online.

Teachers minimize their time investment with ready to go resources.

Admins integrate easily with school systems, with customization and reporting.

Parents access resources to understand their kids' use of technology.

Contact us to find out how we can help your district.

# data[].attributes.attachment_link.title
Privacy & Security Lessons for Students | UpSavvy

# data[].attributes.attachment_link.description
Privacy is about the safeguarding of user identity, whereas security is about the safeguarding of user data. In today's online world it's important to understand how to keep your data and identity safe. With UpSavvy, students learn how to protect their privacy and security in the platforms and apps they use today.

# data[].attributes.attachment_link.readable_text
Data protection laws exist across the globe. This tool has an interactive map identifying those countries with data protection laws. Within each country's listing, if available, you can link to a resource containing the data protection law, the data protection authority, and relevant IAPP resources. The IAPP Resource Center also hosts a " Global Comprehensive Privacy Law Mapping Chart," which maps the differences between comprehensive privacy laws globally.

The Westin Research Center will periodically update these tools. As always, we appreciate input from our members. If you have comments about the information or believe additional material should be included, please share it with us at research@iapp.org.

Note: This tool is for informational purposes and is not legal advice. The status of a country's data protection legislation should always be verified via official sources.

# data[].attributes.attachment_link.description
Data protection laws exist across the globe. This tool has an interactive map identifying those countries with data protection laws. Within each country's listing, if available, you can link to a resource containing the data protection law, the data protection authority, and relevant IAPP resources.

# data[].attributes.attachment_link.readable_text
Overview

SELFIE is a tool for the school only. No personal data is collected.

All answers provided through SELFIE are anonymous. Individual students, teachers, school leaders or other staff members replying to the questions and statements cannot be identified personally.

Each school is the owner of its SELFIE report, which is not shared with others unless the school chooses to do so.

No other organisation, including the European Commission, can track the answers for an individual school or participant.

SELFIE is hosted on a server owned and managed by the European Commission and data gathered is subject to the Commission's data processing rules.

The anonymised and aggregated data can be used for policy and research purposes only and never for commercial purposes.

SELFIE Privacy Statement

This privacy statement provides information about the processing and the protection of your personal data.

Processing operation: Self-Reflection on Effective Learning by Fostering Innovation through Educational technologies

Data Controller: JRC.B.4

Record reference: DPR-EC-01019

1. Introduction

2. Why and how do we process your data?

3. On what legal ground(s) do we collect your data?

4. Which personal data do we collect and further process?

5. How long do we keep your personal data?

6. How do we protect and safeguard your personal data?

7. Who has access to your personal data and to whom is it disclosed?

8. What are your rights and how can you exercise them?

9. Contact information

10. Where to find more detailed information?

1. Introduction

The European Commission (hereafter 'the Commission') is committed to protect your personal data and to respect your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (repealing Regulation (EC) No 45/2001) 1 .

This privacy statement explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.

The information in relation to processing operation " Self-Reflection on Effective Learning by Fostering Innovation through Educational technologies " undertaken by JRC.B.4 is presented below.

2. Why and how do we process your personal data?

Purpose of the processing operation: SELFIE supports the development of quality education policies, which is foreseen under Art. 165 of the Treaty on the Functioning of the European Union. It was developed as a specific action of the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on the Digital Education Action Plan COM(2018) 22 final.

JRC.B.4 collects and uses your personal information provided on an anonymous and voluntary basis through a series of questions to generate automatically (through SELFIE tool) a tailor-made report showing the aggregated results in a visual and interactive way for the schools to help them with the use of digital technologies for teaching, learning and assessment. The findings can help the school to see where it is at and, from there, start a conversation on technology use and develop an action plan. SELFIE can then be used at a later stage to gauge progress and adapt the action plan.

These results are fully anonymised and do not include any personal information such as gender or age. Individual students, teachers, school leaders or any other staff members replying to SELFIE questions cannot be identified personally in these reports. SELFIE does not measure or compare the knowledge or skills of school leaders, teachers or students and is not designed to assess or benchmark schools. The European Commission may use the aggregated data from SELFIE platform in the following ways: download aggregated and anonymised data into other European Commission systems for analysis, produce public reports and presentations based on aggregated and anonymised data and its analysis. Individual participants will never be identified in these reports and analyses.

At no time will individual responses from the school ever be shared or made public, or any aggregated data shared that might allow individual students or staff members to be identified. Additionally, your personal data will not be used for an automated decision-making including profiling.

3. On what legal ground(s) do we process your personal data

We process your personal data, because you have given your consent to the processing of your personal data for one or more specific purposes according to Art. 5(d) of Regulation (EU) 2018/1725. Participation of the data subjects is voluntary.

We do not process special categories of data; therefore Article 10 of Regulation (EU) 2018/1725 does not apply.

4. Which personal data do we collect and further process?

In order to carry out this processing operation JRC.B.4 collects the following categories of personal data: birth year (only for students); age group (for school leaders and teachers); total years of work experience (for school leaders and teachers); attendance and usefulness of professional development activities (only for teachers); use of devices for teaching (only for teachers); confidence in using technology (only for teachers); percentage of time using digital technologies in class (only for teachers); time of technology use (only for students). A 'prefer not to say' option is always available.

Additional non-compulsory information are gender, additional email address, contact person in the school (name and surname), role of the contact person, website or social media account.

5. How long do we keep your personal data?

JRC.B.4 only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing, namely for a maximum duration of 4 years after the end of SELFIE project.

6. How do we protect and safeguard your personal data?

All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of the European Commission. All processing operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

In order to protect your personal data, the Commission has put in place a number of technical and organisational measures in place. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

7. Who has access to your personal data and to whom is it disclosed?

Access to your personal data is provided to the Commission staff responsible for carrying out this processing operation and to authorised staff according to the "need to know" principle. Such staff abide by statutory, and when required, additional confidentiality agreements.

The information we collect will not be given to any third party, except to the extend and for the purpose we may be required to do so by law.

8. What are your rights and how can you exercise them?

You have specific rights as a 'data subject' under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular the right to access, rectify or erase your personal data and the right to restrict the processing of your personal data. Where applicable, you also have the right to object to the processing or the right to data portability.

You have consented to provide your personal data to JRC.B.4 for the present processing operation. You can withdraw your consent at any time by notifying the Data Controller. The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent.

You can exercise your rights by contacting the Data Controller, or in case of conflict the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor. Their contact information is given under Heading 9 below.

Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e. their Record reference(s) as specified under Heading 10 below) in your request.

9. Contact information

The Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controller, JRC.B.4, writing an email to JRC-EAC-SELFIE-TOOL@ec.europa.eu.

The Data Protection Officer (DPO) of the Commission

You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

10. Where to find more detailed information?

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.

This specific processing operation has been included in the DPO's public register with the following Record reference: DPR-EC-01019 Self-Reflection on Effective Learning by Fostering Innovation through Educational technologies.

1 Regulation (EC) N° 45/2001 (OJ L8 of 12/01/2001).

# data[].attributes.attachment_link.description
This privacy statement provides information about the processing and the protection of your personal data.

# data[].attributes.attachment_link.readable_text
For the first time a common set of rules on intermediaries' obligations and accountability across the single market will open up new opportunities to provide digital services across borders, while ensuring a high level of protection to all users, no matter where they live in the EU.

What are the key goals of the Digital Services Act (DSA)?

By setting clear and proportionate rules, the DSA protects consumers and their fundamental rights online, whilst fostering innovation, growth and competitiveness, and facilitating the scaling up of smaller platforms, SMEs and start-ups. The responsibilities of users, platforms, and public authorities are rebalanced according to European values, placing citizens at the centre.

better protection of fundamental rights

more control and choice

stronger protection of children online

less exposure to illegal content

For providers of digital services

legal certainty, harmonisation of rules

easier to start-up and scale-up in Europe

For business users of digital services

access to EU-wide markets through platforms

level-playing field against providers of illegal content

greater democratic control and oversight over systemic platforms

mitigation of systemic risks, such as manipulation or disinformation

Which providers are covered?

The DSA includes rules for online intermediary services, which millions of Europeans use every day. The obligations of different online players match their role, size and impact in the online ecosystem.

Intermediary services offering network infrastructure: Internet access providers, domain name registrars, including also:

Hosting services such as cloud and webhosting services, including also:

Online platforms bringing together sellers and consumers such as online marketplaces, app stores, collaborative economy platforms and social media platforms.

Very Large Online Platforms pose particular risks in the dissemination of illegal content and societal harms. Specific rules are foreseen for platforms reaching more than 10% of 450 million consumers in Europe.

The Commission has designated 19 Very Large Online Platforms (VLOPs) and Very Large Online Search engines (VLOSEs):

AliExpress

Amazon Store

AppStore

Booking

Facebook

Google Maps

Google Play

Google Shopping

Instagram

LinkedIn

Pinterest

Snapchat

TikTok

Twitter

Wikipedia

YouTube

Zalando

All online intermediaries offering their services in the single market, whether they are established in the EU or outside, will have to comply with the new rules. Micro and small companies will have obligations proportionate to their ability and size while ensuring they remain accountable. In addition, even if micro and small companies grow significantly, they would benefit from a targeted exemption from a set of obligations during a transitional 12-month period.

What is the impact of new obligations?

The Digital Services Act significantly improves the mechanisms for the removal of illegal contentand for the effective protection of users' fundamental rights online, including the freedom of speech. It also creates a stronger public oversight of online platforms, in particular for platforms that reach more than 10% of the EU's population.

The DSA requires platforms to put in place measures to counter illegal goods, services or content online, such as a mechanism for users to flag such content and for platforms to cooperate with 'trusted flaggers'.

Those with the sharpest eyes may have already noticed some changes, such as X's new functionality to report illegal content. This feature is available if you click on the three small dots in the top right corner of each post. X is not the only platform to have implemented new and easy-to-use options to flag illicit content. For example, Apple, Pinterest, Facebook, Instagram and TikTok also provide new and easy ways to report illegal content.

The Commission is now assessing, together with Member States, the effective implementation of mechanisms to remove illegal content.

Digital platforms are a space where we express ourselves, showcase our work, and are in contact with friends or customers. This is why it is particularly frustrating when our content gets removed, or the reach of our posts is inexplicably reduced. With the DSA, platforms must communicate why content is removed, or an account is limited: they have now a legal obligation to provide clear and specific information, called 'statements of reasons', on their content moderation decisions. The DSA also empowers users to challenge these decisions and it provides new means to appeal platforms' decisions. Even platforms that already offered this information, such as Facebook and Instagram, are now providing for a broader range of content moderation decisions.

To ensure transparency and enable scrutiny over the content moderation decisions of platforms, as mandated by the DSA, the Commission launched the DSA Transparency Database, a first-of-its-kind database making accessible to the public all statements of reason. VLOPs must publish their statements of reason starting from end of August, while the deadline for publication for all other platforms in scope of the DSA is 17 February 2024.

Member States and the Commission will supervise and enforce in close cooperation the provisions related to the transparency of content moderation decisions and the right to appeal them.

The DSA obliges platforms to guarantee greater transparency and control on what we see in our feeds. We can now discover on what basis platforms rank content on our feeds and opt out of personalised recommendations, as platforms must offer an option to turn off personalised content, in one way or another. The same applies to ads: in addition to further transparency and control on why we see a certain ad on our feed, platforms must label ads and maintain a repository with details on paid advertisement campaigns. For example, TikTok, Facebook, and Instagram now offer the option to disable the personalised feed to comply with the DSA.

Member States and the Commission will supervise and enforce in close cooperation the provisions related to the transparency of recommender systems and advertisement, including the implementation of ads repositories.

The DSA permanently bans targeted advertisement to minors. Platforms have been reacting to this obligation: for example, Snapchat, Alphabet's Google and YouTube, Meta's Instagram and Facebook do not allow advertisers to show targeted ads to underage users. TikTok and YouTube now also set the accounts of users under 16 years old to private by default.

Member States and the Commission will supervise and enforce in close cooperation the provisions on the ban of targeted advertisement for minors.

According to the new rules, online platforms used by children should protect the privacy and security of their users as well as to their mental and physical well-being, for instance by adopting special privacy and security settings by default. Platforms can put in place age verification measures to control who can access their services, parental controls so that parents and guardians can help protect their children against risks such as harmful content, as well as reporting tools where users can signal abuse or get support. Some first steps are being taken: for example, TikTok and YouTube, in addition to banning targeted ads for minors, have set the profiles of minors automatically to private, which means that the videos they upload can only be viewed by the people they approve.

The Commission, along with Member States, will supervise the compliance with obligations and enforce the provisions promoting the online protection of minors.

The DSA requires VLOPs and VLOSEs to identify, analyse, and mitigate risks related to the elections, a central element of our democracies.

In the upcoming months, several Member States will hold elections; next year, all European will be called to vote in the EU Parliamentary Election. The Commission is monitoring VLOPs' actions to mitigate risks related to election disinformation and is engaging with all stakeholders to ensure that such measures are effective, while putting strong emphasis on protecting freedom of expression.

Prior to the Slovak elections in September 2023, the Commission's representatives have met with the most relevant platforms (Meta, Google, TikTok) to assess the implementation of the DSA by the platforms in the context of elections. In those meetings the Commission saw that VLOPs' approach to electoral integrity, among other things, has changed since the DSA entered into force. Progress has been made with regard to shorter response time to flagging by the local authorities and trusted partners, clearer escalation processes, increase in fact-checking capabilities, and overall increase in resources and capacities.

However, shortcomings persist in the enforcement of policies and terms of service in relation to elections. Examples include enforcement of bans for political ads, better identification and labelling of deep-fakes, clearer feedback to flaggers, more consistency and transparency of moderation actions.

The Commission, along with Member States, will continue monitoring the compliance and enforcement of provisions related to minimisation of risks related to electoral processes and civic discourse.

What else is being implemented?

New obligations on traceability of business users in online marketplaces, to help identify sellers of illegal goods or reasonable efforts by online marketplaces to randomly check whether products or services have been identified as being illegal in any official database

Ban on certain type of targeted adverts on online platforms (when they target children or when they use special categories of personal data, such as ethnicity, political views, sexual orientation)

Transparency measures for online platforms on a variety of issues, including on the algorithms used for recommendations

Obligations for very large platforms and very large online search engines to prevent the misuse of their systems by taking risk-based action and by independent audits of their risk management systems

Access for researchers to key data of the largest platforms and search engines, in order to understand how online risks evolve

These are some of the changes that we, as users, can notice immediately in our everyday digital interactions. The Commission's work, as enforcer, has just begun. It will monitor the correct implementation of all DSA provisions and of their impact to create a better reality and a better future. Just like we would not stand for this in the offline world, harassment, bullying, illegal content and people pretending to be someone else also have no place on online platforms that have become integral tools of our daily lives and those of our children.

More changes are coming, and the monitoring of the application of the measures introduced by the DSA has just started. The goal, however, has not changed: a safer, more inclusive digital world for all.

Find out more on new rules for users

Find out more on new rules for businesses

Find out more on new rules for platforms

How is the DSA enforced?

Following the entry into force of the DSA on 16 November 2022, online platforms had 3 months to report the number of active end users on their websites. This means that as of 17 February 2023, all platforms had to publish the number of monthly users, which must now be updated every 6 months.

Based on the numbers published by the platforms and its investigative powers, the Commission can assess whether a platform is to be designated as a Very Large Online Platform (VLOP) or Very Large Online Search Engine (VLOSE). Following such a designation decision by the Commission, the entities in question become regulated entities, like financial institutions, and have 4 months to comply with the obligations under the DSA, including carrying out and providing the first annual risk assessment exercise.

On 25 April 2023, the first designation decisions were made. The first VLOPs and VLOSE had until the end of August to comply with the DSA. In case of non-compliance, companies face fines of up to 6% of global turnover, enhanced supervision and even a temporary ban on operating in the EU Single Market in case of repeated serious breaches threatening people's life or safety.

The supervision and enforcement of the provisions introduced by the DSA will be shared among the Commission and Member States. To allow for the supervision and enforcement of the DSA, Member States have to empower their Digital Services Coordinators (DSCs) by 17 February 2024, the general date of entry in application of the DSA. DSCs can request access to VLOPs and VLOSEs data, order inspections and impose fines in the event of an infringement. They will be responsible for certifying 'trusted flaggers' and out-of-court dispute settlement bodies.

Finally, for the efficient enforcement of the DSA, the Commission is building a network that will involve the relevant European authorities and leading experts in the field covered by the DSA.

On 18 April 2023, the Commission launched the European Centre for Algorithmic Transparency (ECAT), a first-of-its-kind scientific centre in Sevilla which will support the Commission and national authorities in the monitoring of the application of the DSA. Among others, ECAT will:

conduct technical tests on algorithmic systems to understand their functioning

analyse transparency reports, risk assessments and independent audits

support investigations and inspections

identify emerging risks associated with the use of VLOPs/VLOSEs

act as a knowledge hub for research conducted thanks to access to data provided by the DSA.

In this framework, ECAT has also signed a cooperation agreement with the French Centre 'Pole d'expertise du Regulation du Numerique', one of the world's first data science teams working on the issues covered by the DSA. It has also appointed the members of the special group on the EU code of conduct on age-appropriate design, which kicked off its work on 13 June 2023.

Documents

Regulation on Digital Services Act

Download

Intermediary services offering network infrastructure: Internet access providers, domain name registrars, including also:

Hosting services such as cloud and webhosting services, including also:

Online platforms bringing together sellers and consumers such as online marketplaces, app stores, collaborative economy platforms and social media platforms.

Very Large Online Platforms pose particular risks in the dissemination of illegal content and societal harms. Specific rules are foreseen for platforms reaching more than 10% of 450 million consumers in Europe.

All online intermediaries offering their services in the single market, whether they are established in the EU or outside, will have to comply with the new rules. Micro and small companies will have obligations proportionate to their ability and size while ensuring they remain accountable. In addition, even if micro and small companies grow significantly, they would benefit from a targeted exemption from a set of obligations during a transitional 12-month period.

The Digital Services Act significantly improves the mechanisms for the removal of illegal contentand for the effective protection of users' fundamental rights online, including the freedom of speech. It also creates a stronger public oversight of online platforms, in particular for platforms that reach more than 10% of the EU's population.

Find out more on new rules for users

Find out more on new rules for businesses

Find out more on new rules for platforms

# data[].attributes.attachment_link.description
A common set of EU rules that helps better protect users' rights online, bring clarity to digital service providers and foster innovation for online businesses.

# data[].attributes.attachment_link.readable_text
Some large online platforms act as "gatekeepers" in digital markets. The Digital Markets Act aims to ensure that these platforms behave in a fair way online.Together with the Digital Services Act, the Digital Markets Act is one of the centrepieces of the European digital strategy.

# data[].attributes.attachment_link.title
The Digital Markets Act: ensuring fair and open digital markets

# data[].attributes.attachment_link.description
Some large online platforms act as "gatekeepers" in digital markets. The Digital Markets Act aims to ensure that these platforms behave in a fair way online.Together with the Digital Services Act, the Digital Markets Act is one of the centrepieces of the European digital strategy.

# data[].attributes.attachment_link.provider_name
General Data Protection Regulation (GDPR)

# data[].attributes.attachment_link.readable_text
Welcome to gdpr-info.eu. Here you can find the official PDF of the Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version of the OJ L 119, 04.05.2016; cor. OJ L 127, 23.5.2018 as a neatly arranged website. All Articles of the GDPR are linked with suitable recitals. The European Data Protection Regulation is applicable as of May 25th, 2018 in all member states to harmonize data privacy laws across Europe. If you find the page useful, feel free to support us by sharing the project.

Quick Access

Key Issues

Table of Contents

Chapter 1 General provisions

Chapter 4 Controller and processor

Section 1 General obligations

Section 2 Security of personal data

Section 4 Data protection officer

Section 1 Independent status

Chapter 11 Final provisions

# data[].attributes.attachment_link.title
General Data Protection Regulation (GDPR) - Legal Text

# data[].attributes.attachment_link.description
The official PDF of the Regulation (EU) 2016/679 - known as GDPR - its recitals & key issues as a neatly arranged website.

# data[].attributes.attachment_link.readable_text
Disclaimer: Updating and uploading of all Central Acts available on this web page is the proprietary of the Legislative Department in the Ministry of Law and Justice.
The updating and uploading of Rules, Regulations, Notifications, etc., and linking them with relevant sections of the respective Principal Act under which the said subordinate legislations have been made is the proprietary of the concerned Ministry/Departments in the Government of India administering subject matter of the Legislation.

# data[].attributes.attachment_link.title
India Code: Information Technology Act, 2000

# data[].attributes.attachment_link.description
Disclaimer: Updating and uploading of all Central Acts available on this web page is the proprietary of the Legislative Department in the Ministry of Law and Justice.The updating and uploading of Rules, Regulations, Notifications, etc., and linking them with relevant sections of the respective Principal Act under which the said subordinate legislations have been made is the proprietary of the concerned Ministry/Departments in the Government of India administering subject matter of the Legislation.

# data[].attributes.attachment_link.readable_text
The Department of Education, its employees, contractors and agents (collectively, 'the department') is subject to the Privacy Act 1988 (Cth) (the Privacy Act) and to the requirements of the Australian Privacy Principles (APPs) contained in Schedule 1 of the Privacy Act.

We also adhere to applicable Privacy guidance for organisations and government agencies provided by the Office of the Australian Information Commissioner.

Our privacy policy has been developed in accordance with APP 1 and embodies our commitment to protecting the personal information we hold.

View the complete Privacy Policy.

The remainder of this webpage contains an abridged version of the complete privacy policy (condensed privacy policy).

Condensed Privacy Policy

The complete privacy policy provides more detailed information about:

the types of personal information that we collect, hold, use and disclose

our personal information handling practices

our authority to collect your personal information, why it may be held by us, how it is used and how it is protected

whether we are likely to disclose personal information to overseas recipients and if possible, to whom and

how you can access your personal information, correct it if necessary and complain if you believe it has been wrongly collected or inappropriately handled.

You should read our complete or condensed privacy policy if you are:

a student

a parent or guardian

a child care service provider

a registered higher education provider

a tertiary admission centre

a principal or teacher

an academic or researcher

a participant in a program or service delivered by us

a contractor, grant recipient, consultant, or supplier of goods or services to us

an applicant for a grant or a tenderer for a contract provided by us

a policy stakeholder who works with us

a person whose information may be given to us by a third party, including other Australian Government agencies

an entrant in a competition conducted by us

a person seeking employment with us

a current or past employee of the department or

any other individual whose personal information we may collect, hold, use and disclose.

Information we collect and why we hold, use and disclose it

We are responsible for national policies and programs, which ensure that Australians can experience the wellbeing and economic benefits that quality education provides. The department's strategic priorities include:

ensuring quality, affordable and accessible early education and care for families

improving schooling outcomes for children

preparing our future workforce through globally competitive tertiary education and research sectors and

developing a strong evidence base for effective policy that reflects and understands the varied needs of the Australian population, business and industry.

We collect, hold, use and disclose personal information for a variety of purposes, including:

performing management, employment and personnel functions in relation to our employees, labour hire workers and contractors (more detailed information can be found in the Collection of personal information for employment purposes document that supplements the complete privacy policy)

performing our legislative and administrative functions

policy development, research and evaluation

to deliver services to other Commonwealth agencies and so other Commonwealth agencies can provide services, such as ICT services, to the department

data sharing or data integration with other Australian Government agencies, including but not limited to, data sharing or data integration with the Australian Bureau of Statistics for the Multi-Agency Data Integration Project and the Data Integration Partnership for Australia

assessing eligibility for Commonwealth financial assistance in relation to higher education students

complaints handling

administering requests received by us under the Freedom of Information Act 1982 (Cth) (FOI Act) and the Privacy Act

preventing, detecting, investigating or dealing with misconduct and fraud, cyber-attacks against the Commonwealth, or other unlawful activity relating to the Commonwealth

program management

maintaining effective working relationships with state and territory governments, non-government education authorities and providers, universities and other relevant stakeholders

policy advice and other support to our Ministers

contract management, and

management of correspondence with the public.

We only collect, hold, use and disclose personal information for a lawful purpose that is reasonably necessary or directly related to one or more of our functions or activities or where otherwise required or authorised by law.

We use and disclose personal information for the primary purposes for which it is collected. We will only use your personal information for secondary purposes where we are able to do so in accordance with the Privacy Act.

Tax file numbers

The following information is provided to comply with the department's obligation under subrule 14(1) of the Privacy (Tax File Number) Rule 2015 (TFN Rule).

Purpose of collection

A tax file number (TFN) is a unique identifier issued by the Commissioner of Taxation. The department may collect TFNs for the following purposes:

to administer the programs we manage, including but not limited to the Higher Education Loan Programs

to make payments of salaries and wages to eligible employees and contractors

to administer child care financial assistance payments.

The department's collection of TFNs is authorised under the Income Tax Assessment Act 1936 and the Taxation Administration Act 1953. You are not legally obliged to quote your TFN, but there may be financial consequences where you choose not to do so.

Prohibitions and penalties

Certain Commonwealth legislation prohibits the collection, recording, use and disclosure of TFN information. Further information about prohibitions and penalties is available at part 2.3.2 of the department's Complete Privacy Policy.

Privacy notices

In addition to our complete privacy policy, we may need to explain specific privacy practices in more detail at other times. In such circumstances we develop and provide separate privacy notices to describe how we will handle the personal information that we collect. This separate privacy notice where issued, will detail our personal information handling practices in relation to that particular program.

Electronic communication

There are inherent risks associated with the transmission of information over the internet, including via email. You should be aware of this when sending personal information to us via email or via our website or social media platforms. If this is of concern to you then you may use other methods of communication with us, such as post, fax or telephone (although these also have risks associated with them).

Passive collection

Your information - including personal information - is collected by a variety of software applications, services and platforms used by your device and by the department to support it to deliver services.

This type of information collection is 'passive' as the department is not collecting this information directly and it does not directly relate to the department's provision of services. Your consent for your information to be collected and shared in this way is typically obtained at the time you first use an application or service on your device.

You can opt out of some of these passive data collections, including by:

disabling / refusing cookies

disabling JavaScript

opting-out of Google Analytics

disabling location services on your device.

Additional advice regarding how to protect yourself online can be found at Stay Smart Online.

Active collection

The department directly collects some of your information - including personal information - via its website. Generally, this information is collected to enable the department to properly and efficiently carry out its functions and deliver services to you.

No attempt is made to identify you through your browsing other than in exceptional circumstances, such as an investigation into the improper use of the website.

Information may be collected by:

Type of information:

Information collected to:

Internet browser

Cookies

Google Analytics

Social media platforms

Qualtrics

Your browser type

Your browser language

Your server address

Your location (where location services are enabled on your device)

Your top level domain name (e.g. '.com', '.gov', '.au', '.uk')

Date and time you accessed a page on our site

Pages accessed and documents viewed on our site

How our website was accessed (e.g. from a search engine, link or advertisement)

Measure the effectiveness of our content

Better tailor our content to our audience

The department

Name

Email address

Phone number

Education history

Employment history

Deliver services to you

Contact you

Identify you

Subscribe you to a service or update you have requested

Evaluate our programs

Inform policy development

Links to external websites and social networking services

Our website includes links to other websites. We are not responsible for the content and privacy practices of other websites. We recommend that you examine each website's privacy policy separately.

We also use social networking services such as Facebook, Twitter, Google+, YouTube, Instagram and Yammer to talk with the public and our staff. When you talk with us using these services we may collect your personal information to communicate with you and the public.

The social networking service will also handle your personal information for its own purposes. These services have their own privacy policies. You can access the privacy policies for these services on their websites.

Disclosure of personal information overseas

We will on occasion disclose personal information to overseas recipients. The situations in which we may disclose personal information overseas include:

the publication on the internet of material which may contain personal information, such as departmental reports and other documents; photographs, video recordings and audio recordings and posts and comments on our social media platforms (where consent has been given for this or we are otherwise authorised by law to provide this information)

the provision of personal information to overseas researchers or consultants (where consent has been given for this or we are otherwise authorised by law to provide this information)

the provision of personal information to recipients using a web-based service where data is stored on an overseas server, for example, the department may use Mailchimp for email subscriptions (further details on this service can be found in the department's Complete Privacy Policy)

the provision of personal information to foreign governments and law enforcement agencies (in limited circumstances and where authorised by law)

where recipients of departmental communications use an email account that stores data on an overseas server and

where people post and comment on our social media platforms.

Further information about the disclosure of personal information overseas is available at part 2.17 of the department's Complete Privacy Policy.

Information collected by our contractors

Under the Privacy Act we are required to take contractual measures to ensure that contracted service providers (including subcontractors) comply with the same privacy requirements applicable to us.

Storage and data security

Storage of personal information (and the disposal of information when no longer required) is managed in accordance with the Australian Government's records management regime.

We take all reasonable steps to protect the personal information held in our possession against loss, unauthorised access, use, modification, disclosure or misuse.

Data quality

We take all reasonable steps to make sure that the personal information we collect and store is accurate, up-to-date, complete, relevant and not misleading.

Access to and alteration of records containing personal information

You have a right under the Privacy Act to access personal information we hold about you.

You also have a right under the Privacy Act to request corrections of any personal information that we hold about you if you think the information is inaccurate, out-of-date, incomplete, irrelevant or misleading.

It is also possible to access and correct documents held by us under the FOI Act. Further information about how to make an FOI application is available on the Freedom of Information page. You can also contact our FOI team at foi@education.gov.au.

For further detail, including a comparison of both access mechanisms and how you can make a request, please see our Guide to Accessing and Correcting Personal Information.

Privacy Impact Assessments

A privacy impact assessment (PIA) is a systematic assessment of a project that identifies the impact that the project might have on the privacy of individuals, and sets out recommendations for managing, minimising or eliminating that impact.

The Privacy (Australian Government Agencies - Governance) APP Code 2017 (Privacy Code) requires us to undertake a PIA in certain instances and to maintain a register of those PIAs from 1 July 2018. In accordance with the Privacy Code, we publish our PIA Register (see below).

Privacy Impact Assessment Register

The department's PIA register has been prepared in accordance with section 15(1) of the Privacy Code.

Last updated: 18/05/2023

PIAs completed by the Department of Education since its establishment on 1 July 2022

Early Childhood and Youth (ECY) Case Administration and Request Support (ECARS)

April 2023

Australian Competition and Consumer Commission Child Care Price Inquiry - Data Sharing

Piloting Joint Monitoring and Data Sharing Project

February 2023

Review of the Impact of COVID-19 on School Students with Disability

January 2023

PIAs completed by the then Department of Education, Skills and Employment from 1 February 2020 - 20 June 2022

Migrant Skills Incentive 3 - Employability Assessments

June 2022

Automation of Police Checks

June 2022

Youth Allowance Data Link Project

May 2022

School Leavers Information Service

March 2022

Credit Card Risk Indicator Detection Program

March 2022

Apprenticeship Data Management System - Release 1.4

March 2022

Contact Centre Telephony Genesys

March 2022

English Language Learning for Indigenous Children (ELLIC) - go-live phase

February 2022

Fraud Prevention Measure

December 2021

National Schools Constitutional Convention Expansion Pilot

December 2021

Userzoom

November 2021

Digital Services Contact Centre Customer Relationship Management System

November 2021

Literacy and Numeracy Test for Initial Teacher Education Students (LANTITE)

October 2021

Boosting Apprenticeships Commencement - Interim data exchange with the ATO

October 2021

Dynatrace

October 2021

Apprenticeship Data Management System - Release 1

October 2021

Employer Reporting Line

October 2021

Provider access to information on the ESSWeb

September 2021

Data and Analytics Platform

September 2021

PaTH Business Placement Partnerships 2020−2022

July 2021

English Language Learning for Indigenous Children (ELLIC)- beta phase

July 2021

Phase 1 of the Gateway Project

June 2021

Community Child Care Fund (CCCF) Restricted Services Notification of Serious Incident Form

June 2021

Elasticity review of Australian Apprenticeship Incentives

June 2021

Amendments to the National Vocational Education and Training Regulator Act 2011 to include information sharing provisions

May 2021

Data sharing with the ATO for wage subsidy administration

March 2021

Literacy and Numeracy Test for Initial Teacher Education Students

March 2021

Supporting Apprentices and Trainees Wage Subsidy Measure

February 2021

Non-government school census 2020

January 2021

English Language Learning for Indigenous Children (ELLIC) - alpha phase

December 2020

Solv Safety and Solv Injury Case Management System

December 2020

Tuition Protection Service - Up-front payments guidelines

December 2020

Commonwealth Scholarships Program for Young Australians

December 2020

Time to Work Employment Service

December 2020

Data Sharing Project

December 2020

Tuition Protection Service Extension

November 2020

Unique Student Identifiers Extension Project

November 2020

Youth Jobs PaTH Industry Pilots

November 2020

Seasonal Worker Programme Regional Pilot

October 2020

Capacity to Contribute Score Review Process

September 2020

National Vocational Education and Training Regulator Amendment Regulations 2020: National Register details

August 2020

PaTH Internship Vacancy and Caseload Qlik App

August 2020

PIAs completed by the then Department of Education between 1 July 2018 and 31 January 2020

Proposed HESA and VSLA Amendments: impact on the TCSI solution

December 2019

SEMS Project (myHELPbalance application and StEME

December 2019

Trades Recognition Australia
Note: This PIA relates to a function that was transferred to the Department of Employment, Skills, Small and Family Business on 29 May 2019.

June 2019

NCCD Data Assurance Project

May 2019

Schools Census Post-Enumeration Process

December 2018

2018 Student Residential Address Collection

September 2018

Schools Special Circumstances Application

August 2018

PIAs completed by the then Department of Employment, Skills, Small and Family Business between 1 July 2018 and 31 January 2020

Complaints

If you think we may have breached your privacy you may contact us to make a complaint using the contact details below. In order to ensure that we fully understand the nature of your complaint and the outcome you are seeking, we prefer that you make your complaint in writing.

For further information about our complaint handling processes please see our Privacy Complaint Handling Procedures.

Contact Us

If you have any enquiries or complaints about privacy, or if you wish to access or correct your personal information, please email us at privacy@education.gov.au or write to:

Privacy Officer
Legal Services
Department of Education
LOC: C50MA1
GPO Box 9880
Canberra ACT 2601

Changes to this condensed privacy policy

Please note that the condensed privacy policy may change from time to time.

Last updated: November 2022

# data[].attributes.attachment_link.description
The Department of Education, its employees, contractors and agents (collectively, 'the department') is subject to the Privacy Act 1988 (Cth) (the Privacy Act) and to the requirements of the Australian Privacy Principles (APPs) contained in Schedule 1 of the Privacy Act.

# data[].attributes.attachment_link.authors[].name
Katitza Rodriguez and Veridiana Alimonti

# data[].attributes.attachment_link.title
A Look-Back and Ahead on Data Protection in Latin America and Spain

# data[].attributes.attachment_link.description
We’re proud to announce a new updated version of The State of Communications Privacy Laws in eight Latin American countries and Spain. For over a year, EFF has worked with partner organizations to develop detailed questions and answers (FAQs) around communications privacy laws. Our work builds upon.…

# data[].attributes.attachment_link.provider_name
Inside Higher Ed | Higher Education News, Events and Jobs

# data[].attributes.attachment_link.readable_text
Administrators and faculty members can -- and must, according to data privacy advocates -- encourage students to get a better handle on what personal data their institutions collect on them and why. A Student Voice survey from Inside Higher Ed and College Pulse, presented by Kaplan, found that students are largely unaware of just how much data their colleges have and how they may (or may not) be used.

When asked about very specific data points that tend to be on file, responses from the 2,286 undergraduates from 120 colleges and universities surveyed reveal a lack of awareness. For example, only about half think their institutions have information about what websites they visit while connected to campus Wi-Fi, the amount of time spent on coursework via learning management systems or what buildings they have accessed using a student ID. About three in 10 students don't even think their institution collects basic enrollment status data, such as whether they are enrolled full- or part-time.

Increasing student knowledge about data helps them realize the implications of their personal information being used, sold or known by commercial entities or prospective employers, to name a few examples. In the event of a data breach, of course, identity theft can very directly impact personal finances, and being conscious of one's data footprint may decrease the possibility of being affected by a breach.

Click on the infographic for four ways students can be urged to obtain more understanding and control of their data.

[block:block=176]

Subscribe to a Newsletter

# data[].attributes.attachment_link.title
How to protect student data privacy in college (infographic)

# data[].attributes.attachment_link.description
Administrators and faculty members can -- and must, according to data privacy advocates -- encourage students to get a better handle on what personal data their institutions collect on them and why.

# data[].attributes.attachment_link.readable_text
Many in higher education believe that students who have grown up using digital technologies ("digital natives") have little concern for the privacy of their data. Research proves otherwise.

Credit: View Apart / Shutterstock.com © 2021

A popularly held belief is that people who have grown up using digital technologies ("digital natives," born in 1983 and later) have little concern for the privacy of their data. This is particularly concerning because many in this age group live much of their academic and personal lives online. A 2018 Pew Research Center survey found that almost all Americans 18 to 24 years old use social media platforms: YouTube (94%), Facebook (80%), Snapchat (78%), Instagram (71%), and Twitter (45%).

What does this mean for higher education? A 2019 Inside Higher Ed survey found that 46 percent of faculty taught an online course, up from 44 percent in 2018 and 30 percent in 2013. And of course, when campus buildings shut down across the country in the wake of the COVID-19 pandemic in the spring of 2020, many colleges and universities transitioned to online learning-a trend that is likely to continue in the years ahead. In addition, higher education institutions increasingly depend on online platforms related to student learning, advising, and management in order to optimize processes and deliver student services at scale.

Today's students not only are users of these data products and platforms and online learning but also will become tomorrow's software engineers, technology entrepreneurs, and professionals in other fields integral to privacy conversations. Their attitudes toward data privacy will shape the policies and practices that govern the internet.

Students' Attitudes and Expectations
Students care about their data privacy, and this concern is increasing. Students want to protect information regarding their personal lives and their academic or professional prospects, but they prioritize the latter.
In an informal survey conducted by The Atlantic in 2018 to understand how the Cambridge Analytica privacy breach impacted social media use, David, a young professional living in Boston, explained that he began self-censoring his social media posts after a friend's mother found Facebook photos of him drinking while underage and reported the behavior to his school headmaster. He continued: "Right off the bat I . . . understood that anything you post on there can be seen pretty much by anyone at any time. . . . So I don't really post anything at all. Anything that could be out there for public consumption, I try to manage very closely." The Atlantic found that of the 2,218 respondents, 82.2 percent self-censored on social media.

Suffering negative effects from admissions officers and potential employers discovering compromising information on social media profiles is more likely than being the victim of doxing or identity theft. The outcome of the latter is much worse, however, as students may suffer constant psychological, emotional, and even physical harassment or bear the reputational, financial, and perhaps criminal costs of someone having stolen their identity. Young people express a keen awareness of this personal risk.
Students expect boundaries between their personal and academic lives and want colleges and universities to use their data predominantly for educational purposes.
A 2015 EDUCAUSE report on undergraduate students' views of information technology found that more than three-fourths of students approved data collection for analytics when institutions used it for progress toward a degree or certificate goal and that most approved of such collection for assessing course performance. However, less than half of the students approved of data collection to analyze students' campus-based activities logged through their IDs, smart cards, or smartphones; one-third approved of geolocation data collection; and one-quarter approved of data collection to analyze their social media activities. Another interview-based study likewise found that students felt data collection was justified if the data was used only for educational purposes. One participant stated: "If they had the intention of using my data to create better programs or better educational tools, then I'm all for it." However, the study also revealed that students were generally unaware of which information their schools collected and for what purposes.
Students care more about protecting immutable identifiers, such as biometric information, in higher education contexts.
Students have also mobilized to prevent schools and governments from adopting privacy-invasive systems that use biometric information. Erica Darragh, a community organizer from Georgia, is part of a campaign to ban facial recognition on campuses. In an article published in VICE, she wrote:

We have already given up so much privacy and liberty for the sake of "security," but facial recognition must be where this stops. Facial recognition does not improve security and may actually make it worse. It's also a technology that, once mainstreamed, can never be taken back. It is fundamentally coercive for educational institutions to require students to participate in biometric surveillance in order to attend class. While we wait for the government to ban facial recognition at the federal level, young people can take control of the narrative and demand policies that ban the technology in school districts and on college campuses.

Some personal identifiers, such as email addresses, are easily replaced, or people can possess many of them. But biometric information-such as facial, retinal, or fingerprint scans-is singular and irreplaceable. Students' strong belief in protecting immutable identifiers thus likely stems from their desire to shield themselves from privacy risks and harms that may follow them for the rest of their lives.
Students have greater confidence in educational institutions and the government to protect their privacy than they do in technology companies.
Recommendations
#1. Higher education institutions should teach data privacy, ethics, and literacy courses to encourage students to think critically about privacy.
Research demonstrates that students care about privacy, but knowledge of the depth and breadth of their awareness is still lacking. The higher education system must prepare students to fully comprehend the implications of the collection, use, and sharing of their personal information without their knowledge and consent. The US education system was built to develop an informed citizenry able to participate in a democracy. Now more than ever, students need to understand the factors that shape their opinions and influence their decisions. Understanding how data is collected and used, as well as how they can protect their personal information and actively engage with the platforms collecting and the policies governing their data, is a key defense against targeted advertisements and other manipulative techniques.

To keep pace with societal and technological developments and cultivate data-literate citizens, higher education should develop curricula that include instruction on data privacy and ethics. The benefits of this instruction are clear. In an article published in the Stanford Daily, Trisha Kulkarni, an undergraduate student, shared her reflections on taking the course "Computer Science, Ethics, and Policy": "By the end of the class, I was overwhelmed at the details I had overlooked in my daily practices, such as clicking 'accept' without reading a privacy notice or continuously giving an app or website information about my interests in order to customize my experience." Practitioners, scholars, and policymakers should also collaborate to design data ethics curricula.
#2. To foster trust and cooperation, higher education institutions and technology companies should communicate how and why they collect and use students' personal information.
Higher education institutions should collect and use only the information necessary to fulfill goals related to understanding and improving students' educational outcomes and well-being. Institutions should also convene town halls, organize student advisory boards, hold office hours, and publish clear explanations of how and why they collect and use students' personal information. They should share these policies on institutional websites in plain language that clearly communicates the methods that students can use to review, change, or opt out of data collection. Moreover, because third-party technology companies often mediate data use by higher education organizations, these companies should also provide transparency related to their proprietary systems and the processes, scope, and intent of data collection, analysis, and use. Social media companies should do the same, given that students use their products.
#3. Organizations should release additional findings on students' attitudes toward privacy, and researchers should conduct more studies on specific privacy topics.
To verify and extend the findings we have outlined, researchers and organizations should conduct more studies of students' attitudes about privacy. The field would greatly benefit if Pew, Gallup, and other organizations conducted public opinion polls on privacy concerns, with subgroup data reported by age, including a narrow range for "traditional age" college/university students (18- to 24-year-old students). Rather than attempt to replicate these well-designed surveys, organizations holding the data should consider releasing their information tailored to the target population.

Studies should also be conducted to determine how students' privacy attitudes differ based on race, ethnicity, socioeconomic status, special needs, citizenship status, gender, and other characteristics. Education stakeholders need to better understand which types of personal information students want to protect and from which parties they believe they need protection. Studies could also explore which contexts, sources, and events influence students' attitudes about privacy. Finally, we need to understand how students' attitudes about privacy change over time.

Conclusion

Leaders at higher education institutions increasingly rely on data collected from students to inform decision making, and they employ technology platforms that allow them to collect, analyze, and use vast amounts of this data. As students have become more aware of this ongoing data collection and use, they have begun to express their concerns and desires to limit the use of their data to guide institutional decision making. The conversation about the use and privacy of students' data has just begun, and students' voices need to be privileged in that conversation. Higher education institutions, technology companies, researchers, other interested stakeholders and students can collectively shape the future of data privacy in higher education.

This content is part of the EDUCAUSE showcase series Post-Pandemic Future: Implications for Privacy. In 2021 EDUCAUSE is spotlighting the most urgent issues in higher education through this thematic series. For each topic, we've gathered all the tools and resources you need into one place, to help you guide your campus forward.

Notes

The authors would like to thank the various people who contributed to this article, particularly Larissa Kehne, Preeti Jain, Dr. Carrie N. Klein, and Ashleigh Imus.

1. For more about our scope, methodology, selection of sources, and limitations, refer to the full report, "Higher Education Voices: College Students' Attitudes Towards Data Privacy," to be published in late February on https://studentprivacycompass.org/.

2. D. Christopher Brooks, ECAR Study of Undergraduate Students and Information Technology, EDUCAUSE (2016), p. 22; John Fleming, Millennials Most Trusting on Safety of Personal Information, Gallup, May 11, 2015; John H. Fleming and Amy Adkins, Data Security: Not a Big Concern for Millennials, Gallup, June 9, 2016; Jeffrey M. Jones, Facebook Users' Privacy Concerns Up Since 2011, Gallup, April 11, 2018.

3. Libby quoted in Katey Psencik, "How Much Do College Students Care about Online Privacy?," USA Today, May 29, 2013; Andrew Perrin, Americans Are Changing Their Relationship with Facebook, Pew Research Center, September 5, 2018.

4. Nis Bornoe and Louise Barkhuus, "Privacy Management in a Connected World: Students' Perception of Facebook Privacy Settings," Conference on Computer Supported Cooperative Work, 2011.

5. Katherina Glac, Dawn R. Elm, and Kirsten Martin, "Areas of Privacy in Facebook: Expectations and Value," Business & Professional Ethics Journal 33, no. 2/3 (2014); Bornoe and Barkhuus, "Privacy Management in a Connected World."

6. Kaplan, Kaplan Survey: Percentage of College Admissions Officers Who Visit Applicants' Social Media Pages on the Rise Again, January 13, 2020; Kaplan, Kaplan Test Prep Survey: Social Media Checks by College Admissions Officers Decline Due to Savvier Applicants and Shifting Attitudes, November 27, 2018; Alice Marwick, Claire Fontaine, and danah boyd, "Nobody Sees It, Nobody Gets Mad": Social Media, Privacy, and Personal Responsibility among Low-SES Youth," Social Media + Society, May 2017.

7. Bornoe and Barkhuus, "Privacy Management in a Connected World."

8. Simon Parkin, "Gamergate: A Scandal Erupts in the Video-Game Community," New Yorker, October 17, 2014; Aviva quoted in Marwick, Fontaine, and boyd, "Nobody Sees It, Nobody Gets Mad."

9. John H. Fleming and Amy Adkins, Data Security: Not a Big Concern for millennials, Gallup, June 6, 2016; 2018 Digital Future Project, Surveying the Digital Future: The 16th Annual Study on the Impact of Digital Technology on Americans, Center for the Digital Future at USC Annenberg (2018), p. 89; The Generation Lab, Youth Dems and GOP Love Tech and Want It to Stop, January 28, 2021.

10. Jones et al., "'We're Being Tracked at All Times.'"

11. Joseph Galanek and Ben Shulman, "Not Sure If They're Invading My Privacy or Just Really Interested in Me," EDUCAUSE Review, December 11, 2019; Alexander Whitelock-Wainwright et al., "The Student Expectations of Learning Analytics Questionnaire," Journal of Computer Assisted Learning 35, no. 5 (October 2019).

12. Roberts, Howell, Seaman, and Gibson, "Student Attitudes toward Learning Analytics in Higher Education.'"

13. National Center for Education Statistics, Institute of Education Sciences, Digest of Education Statistics, Table 332.10, Bachelor's degrees conferred by postsecondary institutions, by field of study: Selected years, 1970-71 through 2016-17 (August 2018).

Jasmine A-young Park is a Policy Fellow with the Youth and Education Privacy project at the Future of Privacy Forum.

Amelia Vance is Senior Counsel and Director of the Youth and Education Privacy project at the Future of Privacy Forum.

# data[].attributes.attachment_link.title
Data Privacy in Higher Education: Yes, Students Care

# data[].attributes.attachment_link.description
Many in higher education believe that students who have grown up using digital technologies ("digital natives") have little concern for the privacy of their data. Research proves otherwise. A popularly held belief is that people who have grown up using digital technologies ("digital natives," born in 1983 and later) have little concern for the privacy of their data.

# data[].attributes.attachment_link.readable_text
The purpose of this guidance is to answer questions that school officials may have had concerning the disclosure of personally identifiable information from students' education records to outside entities when addressing the Coronavirus Disease 2019 (COVID-19).

The U.S. Department of Education (ED) is working with Census to share updates on the 2020 Census.

# data[].attributes.attachment_link.title
Data Security: K-12 and Higher Education

# data[].attributes.attachment_link.description
The purpose of this guidance is to answer questions that school officials may have had concerning the disclosure of personally identifiable information from students' education records to outside entities when addressing the Coronavirus Disease 2019 (COVID-19). The U.S. Department of Education (ED) is working with Census to share updates on the 2020 Census.

# data[].attributes.headline
Higher Ed Breach (Higher Ed Dive article) through Publisher

# data[].attributes.subject
Higher Ed Breach (Higher Ed Dive article) through Publisher

# data[].attributes.attachment_link.title
McGraw Hill exposed student data and grades, online privacy firm says

# data[].attributes.attachment_link.description
VpnMentor said the data breach exposed over 117 million files filled with hundreds of thousands of grades and email addresses.

# data[].attributes.attachment_link.readable_text
The FCC's E-Rate program makes telecommunications and information services more affordable for schools and libraries. With funding from the Universal Service Fund ( fcc.gov/general/universal-service-fund), E-Rate provides discounts for telecommunications, Internet access, and internal connections to eligible schools and libraries.

The ongoing proliferation of innovative digital learning technologies and the need to connect students, teachers and consumers to jobs, life-long learning, and information have led to a steady rise in demand for bandwidth in schools and libraries. In recent years, the FCC refocused E-Rate from legacy telecommunications services to broadband, with a goal to significantly expand Wi-Fi access. These steps to modernize the program are helping E-Rate keep pace with the need for increased Internet access. (Learn more about modernization of the E-Rate program: fcc.gov/e-rate-update.)

What benefits are available under the E-Rate program?

Eligible schools and libraries may receive discounts on telecommunications, telecommunications services, and Internet access, as well as internal connections, managed internal broadband services and basic maintenance of internal connections.

Discounts range from 20 to 90 percent and are based on the poverty level of the schools. Rural schools and libraries may also receive a higher discount. Recipients must pay some portion of the service costs.

See the list of eligible services at usac.org/e-rate/applicant-process/before-you-begin/eligible-services-list/.

How does the E-Rate program work?

An eligible school or library (see eligibility definitions at usac.org/e-rate/applicant-process/before-you-begin/school-and-library-eligibility/) identifies goods or services it needs and submits a request for competitive bids to the Universal Service Administrative Company (USAC). USAC posts these requests on its website for vendors to bid on. After reviewing the vendors' bids, the school or library selects the most cost-effective eligible products and services using price as the primary factor. It then applies to USAC for approval for the desired purchases.

Next, USAC issues funding commitments to eligible applicants. When a vendor provides the selected services, either the vendor or the applicant submits requests to USAC for reimbursement of the approved discounts.

The bid request and competitive bidding processes must comply with FCC rules and also state and local procurement requirements.

How are schools and libraries in my area benefiting?

To find which schools and libraries in your area benefit from E-Rate, use USAC's search tools to view public E-rate data, including commitment and other funding tools, at usac.org/e-rate/resources/tools/.

How are requests prioritized?

If demand for E-Rate money is greater than the available funds, funding is allocated first to the highest poverty schools and libraries, then the next-highest poverty applicants, and so on.

How much funding is available?

In 2014, the FCC's the Second E-Rate Order increased the cap for the program to $3.9 billion in funding year 2015, indexed to inflation going forward. The funding cap for funding year 2021 is $4.276 billion.

Does the E-Rate program duplicate state and local efforts?

The FCC's plan complements the efforts of states and localities to bring advanced telecommunications and information services to schools and libraries. When the E-Rate program was established in 1996, only 14 percent of the nation's K-12 classrooms had access to the Internet.

Printable Version

E-rate: Universal Service Program for Schools and Libraries (pdf)

# data[].attributes.attachment_link.title
E-Rate: Universal Service Program for Schools and Libraries

# data[].attributes.attachment_link.description
The FCC's E-Rate program makes telecommunications and information services more affordable for schools and libraries. With funding from the Universal Service Fund ( fcc.gov/general/universal-service-fund), E-Rate provides discounts for telecommunications, Internet access, and internal connections to eligible schools and libraries.

# data[].attributes.attachment_link.readable_text
What is eRate?

? It is the generally used term for the Universal Service Fund's Schools and Libraries Program. It is directed by the USAC or Universal Service Administrative Company under the management of FCC or Federal Communications Commission.

The E-Rate program offers discounts in order to help most libraries and schools in the United States and to get affordable Internet access and telecommunications. It is among the four support curricula sponsored through a Universal Service bill charged to corporations which provide international and/or interstate telecommunication services.

The E-Rate program maintains connectivity through the Internet and/or the pipeline or conduit for communications through telecommunication services. Sponsorship is called for under 4 service categories: basic maintenance of inner connections, Internet access, telecommunication services, and internal connections.

The support discounts depend on one's poverty level and the rural or urban condition of the population served. These discounts range from 20 to 90 percent of the expenses of qualified services. Qualified libraries, schools, and school districts may apply as part of an association or individually. Applicants for E-Rate should provide extra resources including professional development, software, end-user equipment such as telephones and computers, and other necessary elements in using the connectivity sponsored by the E-Rate program.

What is eRate's impact? It is hard to determine the efficiency of E-Rate, which has little errors and extensive goals. Yearly appeals for E-Rate sponsorships almost tripled the FCC's limit of $2.25 billion. In year 2005, more than 100,000 schools participated in the E-Rate program. In 2003, almost half of the funds went to the schools where over half of all students receive lunches with reduced costs.

Surveys with the Department of Education showed that from years 1994 to 1999, the Internet use in public schools increased from 35 percent to 95 percent and 3 percent to 63 percent in classrooms. This phase overlaps with the increase in Internet use across the world, and briefly with the presence of E-Rate. Thus, it isn't possible to casually relate the two.

On the other hand, other facts do suggest a connection. Studies have proven that the E-Rate funds had a direct influence on classroom Internet access in 4 cities. An assessment of E-Rate in California showed a 68 percent rise in classroom Internet access for each teacher, but could not make out any influence on the students. However, another study using regression technique showed that the E-Rate program in Texas schools has a positive effect on college admission rates, graduation rates, test scores, and such.

How about eRate criticisms? Aside from the incorporation issue, E-Rate has encountered legal disputes from 11 states and 6 telecommunication corporations. A company complaint regarding the E-Rate program's contribution method was averred. Because the USF bill collection is authorized by the federal government, the OMB and CBO consider the collected bills to be federal revenues, while the funds paid for discounts are considered federal outlays. But, only the USA House of Representatives is allowed to introduce revenue-producing measure. Moreover, the authority to ascertain user bills may be passed on to executive bureaus. However, the authority to tax may not. In the end, the court concluded that the FCC collection of the USF bills did not breach any law.

Some Congress members objected to the method and level of funding supplied by the FCC to the E-Rate program. They deemed the $2.25 billion budget and the inclusion of inner connections as undue and unsupportive to the resources required to attain other features of universal service. Plenty of other parts of the legislation have been established, suggesting keeping the E-Rate program but changing its funding system in order to avert a direct effect on the local phone service.

More Erate Information

E-rate Central- The most complete resource available.

# data[].attributes.attachment_link.description
It is the generally used term for the Universal Service Fund's Schools and Libraries Program. It is directed by the USAC or Universal Service Administrative Company under the management of FCC or Federal Communications Commission. The E-Rate program offers discounts in order to help most libraries and schools in the United States and to get affordable Internet access and telecommunications.

# data[].attributes.attachment_link.readable_text
Skip to main content

Cookies on GOV.UK

We use some essential cookies to make this website work.

We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

You have accepted additional cookies. You can change your cookie settings at any time.

You have rejected additional cookies. You can change your cookie settings at any time.

Accept additional cookies Reject additional cookies View cookies

The policies and processes schools and multi-academy trusts need to protect personal data and respond effectively to a personal data breach.

This toolkit will help school staff, governors and trustees:

understand how to comply with data protection law

develop their data policies and processes

know what staff and pupil data to keep

follow good practices for preventing personal data breaches

This advice is intended for maintained schools and academies. Independent schools are welcome to use it where appropriate.

# data[].attributes.attachment_link.description
The policies and processes schools and multi-academy trusts need to protect personal data and respond effectively to a personal data breach.

# data[].attributes.attachment_link.description
We understand the importance of protecting students online, which is why we’ve built privacy, safety, and security into the Seesaw experience. We’re proud to be a signatory of the Student Privacy P…

# data[].attributes.attachment_link.description
Easily create beautiful interactive video lessons for your students you can integrate right into your LMS. Track students' progress with hassle-free analytics as you flip your classroom!

# data[].attributes.attachment_link.description
NEITHER WE NOR ANY OF OUR AFFILIATES OR LICENSORS WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, OR DATA OR OTHER LOSSES, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

# data[].attributes.headline
Bloomberg: Generative AI and Bias article

# data[].attributes.subject
Bloomberg: Generative AI and Bias article

# data[].attributes.attachment_link.title
Humans Are Biased. Generative AI Is Even Worse

# data[].attributes.attachment_link.description
Text-to-image models amplify stereotypes about race and gender — here’s why that matters

# data[].attributes.headline
National Science Foundation (Education and AI Guidance)

# data[].attributes.subject
National Science Foundation (Education and AI Guidance)

# data[].attributes.attachment_link.description
AI is transforming how students learn to engage with the world around them and use new technologies to create solutions to real problems.

# data[].attributes.attachment_link.readable_text
Your privacy is important to us.

This Privacy Policy governs how Flipgrid, Inc., a Microsoft subsidiary, ("Flip," "we," "our," or "us") collects, uses, and shares personal information about Educators, Students, and Guests, as those roles are defined below (collectively, "Users" or "you"). This Privacy Policy applies when you use our website at Flip.com, the Flip mobile app, and any associated services (collectively, the "Service").

We may make changes to this Privacy Policy from time to time. If we make changes, we will notify you by revising the "Last Updated" date above, and, in some cases, we may provide you with additional notice (such as adding a statement to our website or sending you a notification). We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

"You" may be a:
Educator
An "Educator" initiates and manages Groups and Topics and manages and sets permissions for Student and Guest videos and text within those Group(s) and Topics. Educators using the Service with an email address provided by their affiliated organization, such as an educational institution or organization or other educational business (each, a "School") are referred to as "School Educators." Except as otherwise provided herein, any User who is not a Child or Student, defined below, may use Services as an Educator.

Go  here to learn more about Getting Started as an Educator. Learn more about Topics and Groups  here.

A "Co-Lead" helps Educators manage their Group(s) by adding students, creating, and managing Topic(s), and providing student feedback. Co-Leads do not have the ability to invite other Co-Leads to the Group or delete any user generated content. Co-Leads using the Service with an email address provided by their School are referred to as "School Co-Leads."

Go  here to learn more about Getting Started as a Co-Lead. Learn more about Topics and Groups  here.

A "Student" is invited to participate in Groups and Topics via a join code provided by an Educator, such as a student invited by their school teacher. Students can create and manage their own videos and text within a Group or Topic.

Go  here  to learn more about Getting Started as a Student.
Guest
A Guest is invited to participate in Topics via a join code and guest password provided by an Educator. Guests can create and manage their own videos and text within a Topic.

Go here  to learn more about Getting Started as a Guest.
User
As used in this Privacy Policy, a "User" is any user of the Service, including Educators, Co-Leads, Students, and Guests.

# data[].attributes.attachment_link.description
Read our Privacy Policy to learn how personal information is collected and used across our digital properties.

# data[].attributes.headline
TikTok Privacy Policy (NOT RECOMMENDED for use in Educational settings)

# data[].attributes.subject
TikTok Privacy Policy (NOT RECOMMENDED for use in Educational settings)