[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]




                       HOW DATA MINING THREATENS 
                            STUDENT PRIVACY

=======================================================================

                             JOINT HEARING

                               before the

                     SUBCOMMITTEE ON CYBERSECURITY,

                       INFRASTRUCTURE PROTECTION,

                       AND SECURITY TECHNOLOGIES

                                 of the

                     COMMITTEE ON HOMELAND SECURITY

                        HOUSE OF REPRESENTATIVES

                           Serial No. 113-76

                                and the

                    SUBCOMMITTEE ON EARLY CHILDHOOD,
                  ELEMENTARY, AND SECONDARY EDUCATION

                                 of the

                         COMMITTEE ON EDUCATION
                           AND THE WORKFORCE
                        HOUSE OF REPRESENTATIVES

                           Serial No. 113-61

                               __________

                    ONE HUNDRED THIRTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             JUNE 25, 2014

                               __________

   Printed for the use of the Committee on Homeland Security and the 
                Committee on Education and the Workforce
                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________




                  U.S. GOVERNMENT PRINTING OFFICE
91-448                    WASHINGTON : 2015
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001




                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Paul C. Broun, Georgia               Yvette D. Clarke, New York
Candice S. Miller, Michigan, Vice    Brian Higgins, New York
    Chair                            Cedric L. Richmond, Louisiana
Patrick Meehan, Pennsylvania         William R. Keating, Massachusetts
Jeff Duncan, South Carolina          Ron Barber, Arizona
Tom Marino, Pennsylvania             Dondald M. Payne, Jr., New Jersey
Jason Chaffetz, Utah                 Beto O'Rourke, Texas
Steven M. Palazzo, Mississippi       Filemon Vela, Texas
Lou Barletta, Pennsylvania           Eric Swalwell, California
Richard Hudson, North Carolina       Vacancy
Steve Daines, Montana                Vacancy
Susan W. Brooks, Indiana
Scott Perry, Pennsylvania
Mark Sanford, South Carolina
Vacancy
                   Brendan P. Shields, Staff Director
                   Joan O'Hara, Acting Chief Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY 
                              TECHNOLOGIES

                 Patrick Meehan, Pennsylvania, Chairman
Mike Rogers, Alabama                 Yvette D. Clarke, New York
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Jason Chaffetz, Utah                 Filemon Vela, Texas
Steve Daines, Montana                Vacancy
Scott Perry, Pennsylvania, Vice      Bennie G. Thompson, Mississippi 
    Chair                                (ex officio)
Michael T. McCaul, Texas (ex 
    officio)
               Alex Manning, Subcommittee Staff Director
                    Dennis Terry, Subcommittee Clerk
                COMMITTEE ON EDUCATION AND THE WORKFORCE

                    John Kline, Minnesota, Chairman
Thomas E. Petri, Wisconsin           George Miller, California, 
Howard P. ``Buck'' McKeon,               Senior Democratic Member
    California                       Robert C. ``Bobby'' Scott, 
Joe Wilson, South Carolina               Virginia
Virginia Foxx, North Carolina        Rubeen Hinojosa, Texas
Tom Price, Georgia                   Carolyn McCarthy, New York
Kenny Marchant, Texas                John F. Tierney, Massachusetts
Duncan Hunter, California            Rush Holt, New Jersey
David P. Roe, Tennessee              Susan A. Davis, California
Glenn Thompson, Pennsylvania         Rauul M. Grijalva, Arizona
Tim Walberg, Michigan                Timothy H. Bishop, New York
Matt Salmon, Arizona                 David Loebsack, Iowa
Brett Guthrie, Kentucky              Joe Courtney, Connecticut
Scott DesJarlais, Tennessee          Marcia L. Fudge, Ohio
Todd Rokita, Indiana                 Jared Polis, Colorado
Larry Bucshon, Indiana               Gregorio Kilili Camacho Sablan, 
Lou Barletta, Pennsylvania               Northern Mariana Islands
Joseph J. Heck, Nevada               Frederica S. Wilson, Florida
Mike Kelly, Pennsylvania             Suzanne Bonamici, Oregon
Susan W. Brooks, Indiana             Mark Pocan, Wisconsin
Richard Hudson, North Carolina       Mark Takano, California
Luke Messer, Indiana
Bradley Byrne, Alabama
                    Juliane Sullivan, Staff Director
                Megan O'Reilly, Minority Staff Director
                                 ------                                

  SUBCOMMITTEE ON EARLY CHILDHOOD, ELEMENTARY, AND SECONDARY EDUCATION

                     Todd Rokita, Indiana, Chairman
John Kline, Minnesota                David Loebsack, Iowa, 
Thomas E. Petri, Wisconsin               Ranking Minority Member
Virginia Foxx, North Carolina        Robert C. ``Bobby'' Scott, 
Kenny Marchant, Texas                    Virginia
Duncan Hunter, California            Carolyn McCarthy, New York
David P. Roe, Tennessee              Susan A. Davis, California
Glenn Thompson, Pennsylvania         Rauul M. Grijalva, Arizona
Susan W. Brooks, Indiana             Marcia L. Fudge, Ohio
Bradley Byrne, Alabama               Jared Polis, Colorado
                                     Gregorio Kilili Camacho Sablan, 
                                         Northern Mariana Islands


                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Patrick Meehan, a Representative in Congress From 
  the State of Pennsylvania, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies, Committee on Homeland Security:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Todd Rokita, a Representative in Congress From the 
  State of Indiana, and Chairman, Subcommittee on Early 
  Childhood, Elementary, and Secondary Education, Committee on 
  Education and the Workforce:
  Oral Statement.................................................     6
  Prepared Statement.............................................     8
The Honorable Yvette D. Clarke, a Representative in Congress From 
  the State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies, Committee on Homeland Security:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5
The Honorable David Loebsack, a Representative in Congress From 
  the State of Iowa, and Ranking Minority Member, Subcommittee on 
  Early Childhood, Elementary, and Secondary Education, Committee 
  on Education and the Workforce:................................
  Oral Statement.................................................     9
  Prepared Statement.............................................    10
The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas:
  Prepared Statement.............................................    12
The Honorable Jared Polis, a Representative in Congress From the 
  State of Colorado:
  Prepared Statement.............................................    14

                               Witnesses

Mr. Joel R. Reidenberg, Stanley D. and Nikki Waxberg Chair and 
  Professor of Law, Founding Academic Director, Center of Law and 
  Information Policy, Fordham University School of Law:
  Oral Statement.................................................    16
  Prepared Statement.............................................    18
Mr. Mark MacCarthy, Vice President, Public Policy, Software and 
  Information Industry Association:
  Oral Statement.................................................    22
  Prepared Statement.............................................    23
Ms. Joyce Popp, Chief Information Officer, Idaho State Department 
  of Education:
  Oral Statement.................................................    26
  Prepared Statement.............................................    28
Mr. Thomas C. Murray, State and District Digital Learning Policy 
  and Advocacy Director, Alliance for Excellent Education:
  Oral Statement.................................................    30
  Prepared Statement.............................................    33

                             For the Record

The Honorable David Loebsack, a Representative in Congress From 
  the State of Iowa, and Ranking Minority Member, Subcommittee on 
  Early Childhood, Elementary, and Secondary Education, Committee 
  on Education and the Workforce:
  Statement of Aimee Rogstad Guidera, Executive Director, Data 
    Quality Campaign.............................................    42

 
                       HOW DATA MINING THREATENS 
                            STUDENT PRIVACY

                              ----------                              


                        Wednesday, June 25, 2014

   U.S. House of Representatives,          
    Committee on Homeland Security,        
       Subcommittee on Cybersecurity,      
         Infrastructure Protection, and    
               Security Technologies, and  
             U.S. House of Representatives,
          Committee on Education and the Workforce,
                     Subcommittee on the Early Childhood,  
                       Elementary, and Secondary Education,
                                                    Washington, DC.
    The subcommittees met, pursuant to call, at 11:02 a.m., in 
Room 311, Cannon House Office Building, Hon. Patrick Meehan 
[Chairman of the Cybersecurity, Infrastructure Protection, and 
Security Technologies subcommittee] presiding.
    Present from Subcommittee on Cybersecurity, Infrastructure 
Protection, and Security Technologies: Representatives Meehan, 
Rogers, Clarke, and Vela.
    Present from Subcommittee on Early Childhood, Elementary, 
and Secondary Education: Representatives Rokita, Roe, Brooks, 
and Loebsack.
    Also present: Representative Bonamici.
    Mr. Meehan. The Subcommittee on Cybersecurity, 
Infrastructure Protection, and Security Technologies of the 
Committee on Homeland Security and the Subcommittee on Early 
Childhood, Elementary, and Secondary Education of the Committee 
on Education and the Workforce will now come to order. The 
subcommittees are jointly meeting today to examine data 
collection and privacy concerns in education.
    I will recognize myself for an opening statement. I would 
like to thank Ranking Member Clarke, as well as Chairman Rokita 
and Ranking Member Loebsack from the Education and the 
Workforce Subcommittee on Early Childhood, Elementary, and 
Secondary Education, for coming together with us today to hold 
this joint hearing on what is a very important issue, which is 
the privacy and security of our students' Personally 
Identifiable Information. We call it PII. Today marks the first 
joint hearing between these two committees, and I am looking 
forward to working with Chairman Rokita and Ranking Members 
Clarke and Loebsack on this issue.
    In recent years, the number of school districts using 
educational software and cloud services has just exponentially 
increased. Today, nearly 95 percent of school districts are 
using these services. These services can provide numerous 
advantages to school administrators and educators, including 
individualized learning, State examination assessments and 
administrative functions such as attendance records. While 
these services can be helpful to our students' development, it 
is vitally important that we understand the privacy and 
security concerns of sharing such sensitive information.
    A report by the Fordham Law School found that cloud 
services used by school districts are poorly understood and 
have a lack of transparency, finding 20 percent of school 
districts do not have proper policies in place for the use of 
these services. Fewer than 7 percent restrict the sale of 
student information by vendors. Let me repeat that line: Fewer 
than 7 percent restrict the sale of student information by 
vendors. Security of student information must be paramount. As 
this subcommittee has examined in recent hearings, cyber 
criminals have become more sophisticated in their tactics and 
techniques, evidenced by the increasing number of cyber 
breaches at universities, schools, and retailers. The more 
convenienced our lives become with on-line services the greater 
risk these criminals can exploit it.
    Over the past year, three major universities and one school 
district became victims of cyber breaches affecting hundreds of 
thousands of students' personally identifiable information. But 
it is not just the identifiable information. It is also 
information about the students and their performance itself. 
Much like health records, a lot of the things that is being 
able to be tracked includes the mental processes of students as 
they are working through equations. There has to be an 
appropriate form of protection of that, an appropriate form of 
parental consent, before that kind of information is utilized.
    Greater transparency is needed on behalf of the school 
districts and the vendors with which they contract. Parents 
enrolling their children in school should have a clear 
understanding of what information is collected, stored, and 
shared. The Family Educational Rights and Privacy Act, which we 
call FERPA, is the Federal law that governs the privacy of 
student records. FERPA establishes when, and what type, of 
information school districts can share with private vendors. 
However, there are concerns that because FERPA was enacted in 
1974, long before the advent of these technologies, it doesn't 
reflect the current reality in the classroom and changes in how 
data is collected and shared.
    I think we will also hear testimony about gaps that exist 
in the laws that oversee the protection of student information. 
Today's hearing will seek to examine the sharing of student 
information with educational software and cloud service 
vendors, and the laws and guidelines that govern them. The 
subcommittees will hear testimony from a distinguished panel, 
including representatives from the Fordham Law School, Software 
and Information Industry Association, the Idaho State 
Department of Education, and the Alliance for Excellent 
Education.
    Transparency on behalf of the school districts and the 
educational companies is vitally important. Parents should have 
a clear understanding of what schools are sharing and what 
rights they have. I appreciate the opportunity to work with my 
colleagues in Education and the Workforce to examine this 
important issue.
    [The statement of Chairman Meehan follows:]
                  Statement of Chairman Patrick Meehan
                             June 25, 2014
    I would like to thank Ranking Member Clarke as well as Chairman 
Rokita and Ranking Member Loebsack from the Education and the Workforce 
Subcommittee on Early Childhood, Elementary, and Secondary Education 
for corning together with us to hold this joint hearing on a very 
important issue, the privacy and security of our students' Personally 
Identifiable Information (PII). Today marks the first joint hearing 
between these two committees, and I'm looking forward to working with 
Chairman Rokita and Ranking Member Loebsack on this issue.
    In recent years the number of school districts using educational 
software and cloud services has greatly increased; today nearly 95% of 
school districts are using these services. These services can provide 
numerous advantages to school administrations and educators including 
individualized learning, State examination assessments, and 
administrative functions such as attendance records. While these 
services can be helpful to our student's development, it is vitally 
important that we understand the privacy and security concerns of 
sharing such sensitive information. A report by the Fordham Law School 
found that cloud services used by school districts are poorly 
understood and have a lack of transparency, finding 20% of school 
districts do not have proper policies in place for the use of these 
services and fewer than 7% restrict the sale of student information by 
vendors.
    Security of student information must be paramount, as this 
subcommittee has examined in recent hearings cyber criminals have 
become more sophisticated in their tactics and techniques, evidenced by 
the increasing number of cyber breaches at universities, schools, and 
retailers. The more interconnected our lives become with on-line 
services the greater the risk these criminals can exploit it. Over the 
past year three major universities and one school district have become 
victims of cyber breaches affecting hundreds of thousands of students' 
Personally Identifiable Information.
    Greater transparency is needed on behalf of the school districts 
and the vendors with which they contract. Parents enrolling their 
children in school should have a clear understanding of what 
information is collected, stored, and shared. The Family Educational 
Rights and Privacy Act (FERPA) is the Federal law that governs the 
privacy of student records. FERPA establishes when and what type of 
information school districts can share with private vendors. However, 
there are concerns that because FERPA was enacted in 1974, long before 
the advent of these technologies, it does not reflect the current 
reality in the classroom and the changes in how data is collected and 
shared.
    Today's hearing will seek to examine the sharing of student 
information with educational software and cloud service vendors and the 
laws and guidelines that govern them. The subcommittees will hear 
testimony from a distinguished panel including representatives from the 
Fordham Law School, Software and Information Industry Association, 
Idaho State Department of Education, and the Alliance for Excellent 
Education. Transparency on behalf of the school districts and the 
educational companies is vitally important; parents should have a clear 
understanding of what schools are sharing and what rights they have. I 
appreciate the opportunity to work with my colleagues at Education and 
the Workforce to examine this important issue.

    Mr. Meehan. The Chairman now recognizes the Ranking Member 
of the subcommittee, the gentlelady from New York, for any 
statements she may have.
    Ms. Clarke. Thank you, Mr. Chairman. I want to thank you 
for holding today's hearing. I want to welcome our colleagues 
from the Education and the Workforce Committee, especially 
Ranking Member Loebsack and his fellow Members from the Early 
Childhood, Elementary, and Secondary Education Subcommittee.
    Today's hearing reminds me of the work we have done on this 
subcommittee in developing authorities for the Department of 
Homeland Security to create a robust cyber workforce. In 
developing my bill, Cybersecurity Boots on the Ground, we 
thought carefully about how we must learn to improve the 
readiness and capacity of DHS' cybersecurity current workforce. 
But more importantly, how to engineer systems and devices that 
earn parents, schools, and policymakers' trust and confidence 
to train students for future careers. Our goal was to encourage 
innovation in education to help create cyber-capable citizens 
and help sustain a cyber-capable workforce.
    Today's hearing is specifically about the use of technology 
in learning that could open up countless opportunities for 
students from the personalization of learning to the concept of 
learning any time, anywhere. From visiting the schools in my 
district, I have seen how advanced technology is being rapidly 
deployed in all grades and can offer benefits that support a 
number of distinct functions, from data analytics to student 
reporting requirements to basic productivity, functions such as 
e-mail, data storage, and document editing. Advances in 
information technology have led to many new ways to collect 
data, analyze and use data, in ever-expanding volumes.
    Big data holds tremendous potential to benefit society and 
contribute to economic growth. Researchers have told us that it 
will soon be possible to create and maintain longitudinal data 
about the abilities and learning styles of millions of 
students. Early adopters of these technologies have 
demonstrated their potential to transform and advance 
educational tools. But these same technologies also called 
attention to serious policy questions. In particular, the 
information-sharing web hosting and telecommunication 
innovations that have enabled these new educational 
technologies raise questions about how best to protect student 
privacy and about the security of student information.
    In this committee's work on cybersecurity legislation, we 
have seen that rapidly-developing technology like data mining 
often outpaces the capacities and legal requirements that 
institutions and businesses need to manage and make use of big 
data and information sharing.
    However, data mining has emerged as one of the few--the key 
features of many Homeland Security programs involving the use 
of sophisticated data analysis tools to discover previously-
unknown valid patterns and relationships and learning enlarged 
data sets. In the context of homeland security, data mining is 
viewed as an essential means to identify terrorists and 
criminal activities, such as money transfers and communications 
screens and to identify and track terrorists themselves through 
travel and immigration records.
    However, the concept of data mining in education has 
witnessed dramatic world-wide growth both in academia and in 
the business sector as a process that can provide useful data 
necessary for decision making in institutions and for the 
development of educational tools. While States and local 
communities are the core of our education systems, much of the 
software that supports on-line learning tools, on-line courses, 
and school system productivity tools is provided by for-profit 
firms. This raises complicated questions about who owns the 
data streams coming off on-line education platforms and how 
they are used.
    Applying priority safeguards to educational records can 
create unique tasks. Today, we will hear how the use of school-
based student data has gained more attention in recent months 
and how it has seen increased scrutiny by parents and advocates 
and resulted in new State and local laws.
    I know that my colleagues on the Education and the 
Workforce Committee, Mr. Polis and others, are working with a 
variety of stakeholders to find the right balance for 
educational settings. I also know that the technology industry 
is already engaged, working on best practices and policies, 
along with a number of expert and academic organizations, to 
move these discussions along.
    I look forward to the testimony of our distinguished 
panelists today, Mr. Chairman, and I yield back.
    [The statement of Ranking Member Clarke follows:]
              Statement of Ranking Member Yvette D. Clarke
                             June 25, 2014
    Today's hearing reminds me of the work we have done on this 
subcommittee in developing authorities for the Department of Homeland 
Security to create a robust cyber workforce. In developing my bill, 
``Cybersecurity Boots on the Ground'', we thought carefully about how 
we must learn to improve the readiness and capacity of DHS's 
cybersecurity current workforce, but more importantly, how to engineer 
systems and devices that earn parents, schools, and policy maker's 
trust and confidence, to train students for future careers. Our goal 
was to encourage innovation in education to help create ``cyber-
capable'' citizens, and help sustain a ``cyber-capable'' workforce.
    Today's hearing is specifically about the use of technology in 
learning that could open up countless opportunities for students, from 
the ``personalization of learning'', to the concept of ``learning 
anytime and anywhere''. From visiting the schools in my district, I 
have seen how advanced technology is being rapidly deployed in all 
grades, and can offer benefits that support a number of distinct 
functions, from data analytics, to student reporting requirements, to 
basic productivity functions such as email, data storage, and document 
editing.
    Advances in information technology have led to many new ways to 
collect data, analyze, and use data in ever-expanding volumes. Big data 
holds tremendous potential to benefit society and contribute to 
economic growth. Researchers have told us that it will soon be possible 
to create and maintain longitudinal data about the abilities and 
learning styles of millions of students. Early adopters of these 
technologies have demonstrated their potential to transform and advance 
educational tools, but these same technologies have also called 
attention to serious policy questions. In particular, the information 
sharing, web-hosting, and telecommunication innovations that have 
enabled these new education technologies raise questions about how best 
to protect student privacy, and about the security of student 
information.
    In this committee's work on cybersecurity legislation, we have seen 
that rapidly-developing technology, like data mining, often outpaces 
the capacities and legal requirements that institutions and businesses 
need to manage and make use of ``big data'' and information sharing. 
However, data mining has emerged as one of the key features of many 
homeland security programs, involving the use of sophisticated data 
analysis tools to discover previously unknown, valid patterns and 
relationships in large data sets. In the context of homeland security, 
data mining is viewed as an essential means to identify terrorist and 
criminal activities, such as money transfers and communications 
sources, and to identify and track terrorists themselves, through 
travel and immigration records.
    However, the concept of data mining in education has witnessed 
dramatic world-wide growth, both in academia and in the business 
sector, as a process that can provide useful data necessary for 
decision making in institutions, and for the development of educational 
tools. While States and local communities are the core of our education 
systems, much of the software that supports on-line learning tools, on-
line courses, and school system productivity tools, is provided by for-
profit firms.
    This raises complicated questions about who owns the data streams 
coming off on-line education platforms and how they are used. Applying 
privacy safeguards to educational records can create unique tasks. 
Today, we will hear how the use of school-based student data has gained 
more attention in recent months, and how it has seen increased scrutiny 
by parents and advocates, and resulted in new State and local laws.
    I know that my colleagues on the Education and the Workforce 
Committee, Mr. Polis and others, are working with a variety of 
stakeholders to find the right balance for educational settings, and I 
also know that the technology industry is already engaged--working on 
best practices and policies, along with a number of expert and academic 
organizations to move these discussions along.

    Mr. Meehan. I want to thank the Ranking Member, and I also 
want to express my deep appreciation to my colleague--my good 
friend and colleague, the gentleman from Indiana. This is one 
of those opportunities where we have the occasion in which our 
work overlaps. We had a shared interest, and I was very 
grateful for not only his agreement, but encouragement, to find 
a way in which we could jointly explore this so that we may 
learn a great deal and perhaps share in the resolution of the 
matter. So I am very grateful for your participation.
    The Chairman now recognizes the Chairman of the 
Subcommittee on Early Childhood, Elementary, and Secondary 
Education, the gentleman from Indiana, Mr. Rokita, for any 
statement he may have.
    Mr. Rokita. Thank you, Chairman Meehan. Good morning and 
welcome. Let me begin by thanking you, Chairman, for 
approaching me and my committee Members about the idea for this 
morning's hearing. I am pleased that our two subcommittee teams 
came together for this important and relatively new issue. So 
again, thank you for your leadership. Collaboration across 
committees is very important, and I hope not only these two 
committees, but others, are able to do more of it.
    As we draw from the knowledge and expertise of our House 
colleagues, I believe we become more effective policymakers. So 
I look forward, No. 1, from hearing from our witnesses and 
having an informative discussion.
    We are dealing with an issue today that is both critically 
important and exceptionally complex. First, why is it so 
important? As we fight for all Americans looking to build 
better lives for themselves and their families, we know that a 
cornerstone of that is a quality education. It is the route of 
a better life. With very few exceptions, a worker will not 
succeed in the workforce if they failed as a student in the 
classroom. A strong education system is essential to a strong 
and exceptional America. That is why we should engage 
innovative solutions to raise achievement, and embrace new 
technologies that allow us to teach children in more effective 
ways.
    We often see how acquiring data on student performance can 
revolutionize student learning. For starters, data can provide 
an early warning to teachers, alerting them to students who are 
falling behind and need that extra help. It can also awaken 
parents to the challenges their child is facing so they can 
step in with additional support at home. Additionally, data on 
student achievement can equip local communities with the 
information needed to hold their schools accountable as well as 
enable schools to share information on what is working in their 
classrooms. Sometimes even more importantly, what is not 
working.
    So on to the next question: Why is this so complex? Well, I 
think we have learned by now that modern technology is anything 
but a simple concept. The science and ingenuity behind each new 
smartphone app, computer, or piece of software is tough to 
comprehend. Yet, these products have become an integral part of 
our everyday lives. Even though we surely got along before 
them, still it is hard to imagine what our daily lives would be 
like if we never heard the names such as Google, Apple, 
Microsoft, Facebook, and Amazon. With each new technology comes 
risk and responsibility.
    That is certainly the case when it comes to the technology 
we bring into our schools and the data we collect on our 
students. Protecting student privacy is a shared 
responsibility. Parents have to be informed and engaged about 
what technologies and practices are used in their schools and 
what data is actually collected on their children, who has 
access to that data, and the safeguards in place to protect our 
children's privacy. What is the role of the local school board, 
local school leaders, and staff? Should State and local 
education leaders have to ensure they are limiting the data 
collected to only information truly needed to improve classroom 
instruction?
    Who gets to define what ``truly needed'' means? Should 
access to student data be limited to only individuals who are 
working with schools to improve classroom instruction? Should 
there be strict security protocols in place, while ensuring 
parents are fully informed about the data use policies of the 
particular school or district? Then there are the technology 
providers, who I expect would agree, have an equally important 
role in protecting student privacy and securing student data to 
which they have access. These companies must remain vigilant 
and remember that students are in the classroom first and 
foremost to learn.
    Finally, there is also a role for Federal policymakers that 
is Constitutionally-based. For example, for 40 years the Family 
Educational Rights and Privacy Act that Chairman Meehan 
mentioned has been in place to protect the privacy of student 
education records. I look forward to discussing with our 
witnesses today whether that law is up to the challenges that 
we face today, or whether changes need to be made so that the 
law better reflects the realities of modern technology, also as 
Chairman Meehan alluded to. Or is it simply a matter of all the 
stakeholders self-policing?
    I am fighting for all people so that they can build better 
lives for themselves and their families. Strengthening 
education is a goal we all share, and one the Education and the 
Workforce Committee has spent a great deal of time working on. 
As I noted earlier, the gathering and sharing of student data 
can improve achievement, but let's make sure we are doing it in 
a way that doesn't have unintended consequences like losing 
student privacy.
    Chairman Meehan, again thank you for your leadership and 
your help with this joint hearing.
    [The statement of Chairman Rokita follows:]
                   Statement of Chairman Todd Rokita
                             June 25, 2014
    Let me begin by thanking Chairman Meehan for hosting today's joint 
subcommittee hearing. Promoting collaboration across committees is 
important. As we draw from the knowledge and expertise of our House 
colleagues, I believe we become more effective policymakers. I look 
forward to hearing from our witnesses and to an informative discussion.
    We are dealing with an issue today that is both critically 
important and exceptionally complex.
    Why is it so important? As we fight for all Americans looking to 
build better lives for themselves and their families, we know that a 
quality education is at the root of that better life. With very few 
exceptions, a worker will not succeed in the workforce if they failed 
as a student in the classroom. A strong education system is essential 
to a strong America. That is why we should encourage innovative 
solutions to raise achievement and embrace new technologies that allow 
us to teach children in more effective ways.
    We all can see how acquiring data on student performance can 
revolutionize student learning. For starters, data can provide an early 
warning to teachers, alerting them to students who are falling behind 
and need extra help. It can also awaken parents to the challenges their 
child is facing so they can step in with additional support at home. 
Additionally, data on student achievement can equip local communities 
with the information needed to hold their schools accountable, as well 
as enable schools to share information on what's working in their 
classrooms and what's not.
    Why is it so complex? Well, I think we've learned by now that 
modern technology is anything but a simple concept. The science and 
ingenuity behind each new smart phone, app, computer, or piece of 
software is tough to comprehend, yet these products have become an 
integral part of our everyday lives. It's hard to imagine what life 
would be like if we never heard of names such as Apple, Microsoft, 
Google, and Amazon.
    With each new technology comes risk and responsibility. That is 
certainly the case when it comes to the technology we bring into our 
schools and the data we collect on our students. Protecting student 
privacy is a shared responsibility.
    Parents have to be informed and engaged about what technologies and 
practices are used in their schools, what data is actually collected on 
their children, who has access to that data, and the safeguards in 
place to protect their child's privacy.
    State and local education leaders have to ensure they are limiting 
the data collected to only information truly needed to improve 
classroom instruction. That means they must limit access to student 
data to only individuals who are working with the schools to improve 
classroom instruction. They must also ensure there are strict security 
protocols in place while ensuring parents are fully informed about the 
data use policies of the school and district.
    And then there are the technology providers, who have an equally 
important role in protecting student privacy and securing student data 
to which they have access. These companies must remain vigilant and 
remember that students are in the classroom first and foremost to 
learn. Data and student information should be placed in the hands of 
educators so they can leverage those resources to further student 
achievement.
    Finally, there is also a role for Federal policymakers as well. We 
should oppose any information sharing or data mining on students 
intended to serve interests outside of the classroom. For 40 years the 
Family Educational Rights and Privacy Act has been in place to protect 
the privacy of student education records. I look forward to discussing 
with our witnesses today whether that law is up to the challenges we 
face today, or whether changes need to be made so that the law reflects 
the realities of modern technology.

    Mr. Meehan. Let me thank Chairman Rokita. I would like to 
also express my deep appreciation to the Ranking Member, the 
gentleman from Iowa from the subcommittee, Mr. Loebsack.
    You are recognized for any statement you may have.
    Mr. Loebsack. Thank you, Chairman Meehan. It is great to be 
here with you and with Chairman Rokita and Ranking Member 
Clarke, as well. I do thank you for holding today's hearing, 
and I thank our witnesses for being here, as well.
    More than ever before, technology plays an essential role 
in educating our children. I think we can all agree to that. 
Technology-based educational tools and platforms offer 
important new capabilities for students and teachers at both 
the K-12 and university levels. The increasing number of 
educational iPad and iPhone apps, on-line study tools and 
engagement programs illustrate the growing abundance of tech 
resources that are being used to meet students' individual 
learning needs. These educational tools generate tremendous 
amounts of data that are instrumental in improving a student's 
learning experience.
    Data allow teachers to quickly identify and address gaps in 
student understanding before they fall behind. By making data 
available to parents, they can track their child's progress and 
participate more fully in their education. Beyond addressing 
the needs of individual students, data aids schools and their 
institutional and administrative functions. School and district 
leaders rely on data to drive improvement and decision making 
around curriculum, technology infrastructure, and staffing. The 
availability of new types of data also improves researchers' 
ability to learn about learning.
    Data from a student's experience, and technology-based 
learning platforms, can be precisely tracked, opening the door 
to more accurately understanding how students move through a 
curriculum, and at greater scale than traditional education 
research is able to achieve. As data systems become more 
integrated into the learning and teaching process, we are 
seeing the impact that they can have on students, teachers, 
administrators, and policy makers. These systems enable 
teachers, schools, and districts to make more informed 
decisions to enhance student learning.
    Meanwhile, a growing number of on-line educational services 
have the ability to enhance learning within the classroom and 
extend it beyond the school day. Edmodo, for example, which is 
used by more than 20 million teachers and students world-wide, 
allows teachers to set up virtual classrooms and then post 
homework assignments and other content to extend lessons. Khan 
Academy has more than 5,000 instructional videos and 
assessments which allow students of all ages to learn at their 
own pace in subject areas ranging from pre-algebra to 
differential equations, from art history to computer science.
    With this explosion in on-line resources, there is a large 
amount of new data being generated by children using these 
services which do raise valid privacy concerns. The privacy of 
student education records, as we know, is protected under 
FERPA, the Family Educational Rights and Privacy Act. When 
those student education records are hosted or analyzed by 
private companies that are helping districts build data systems 
to drive improvement, those same FERPA protections still apply, 
and we have to keep that in mind. However, when students use 
on-line services like Khan Academy in school or at home, or 
when teachers use grade and behavior-tracking software on their 
iPads, all of that data are not necessarily covered by FERPA.
    In those direct interactions between students and software 
companies, data are being collected to build user profiles, 
individualize the learning experience, and track progress. But 
in the cases where FERPA does not apply, it is not always clear 
what protections exist to guarantee the privacy of those data 
and ensure companies are not using them to target 
advertisements at children, for example. This committee will 
hear important testimony today about the value that these 
tailored technological resources provide the students 
themselves, and the importance of ensuring access to data for 
teachers and researchers to improve education.
    We will also hear about the need for consistent privacy 
policies, and current efforts to generate the security and 
privacy of student data. As we examine the privacy concerns 
prompted by the rapidly-growing education technology sector and 
the information it collects, it is clear that we must strive to 
find a proper balance between privacy and innovation. We must 
ensure that companies involved in collecting and analyzing 
student data are not exploiting students' private information 
for marketing purposes or financial gain. Data are an 
invaluable tool. Data empower teachers, guide individualized 
learning, and inform policy.
    As we consider where improvements are needed in privacy 
regulations, we must be sure that we do not compromise the 
value of student data. I look forward to hearing from the 
witnesses today.
    Thank you, again, Chairman Meehan and Chairman Rokita and 
Ranking Member Clarke for this hearing. Thank you.
    [The statement of Mr. Loebsack follows:]
                    Statement of Hon. David Loebsack
                             June 25, 2014
    Good morning, Chairman Rokita, Chairman Meehan, and Ranking Member 
Clarke. I'd like to thank you for holding today's hearing and thank our 
witnesses for being here.
    More than ever before, technology plays an essential role in 
educating our children. Technology-based educational tools and 
platforms offer important new capabilities for students and teachers at 
both the K-12 and university levels.
    The increasing number of educational iPad and iPhone apps, on-line 
study tools, and engagement programs illustrate the growing abundance 
of tech resources that are being used to meet students' individual 
learning needs.
    These educational tools generate tremendous amounts of data that 
are instrumental in improving a student's learning experience. Data 
allows teachers to quickly identify and address gaps in student 
understanding before they fall behind. And by making data available to 
parents, they can track their child's progress and participate more 
fully in their education.
    Beyond addressing the needs of individual students, data aids 
schools in their institutional and administrative functions. School and 
district leaders rely on data to drive improvement and decision making 
around curriculum, technology infrastructure, and staffing.
    The availability of new types of data also improves researchers' 
ability to learn about learning. Data from a student's experience in 
technology-based learning platforms can be precisely tracked, opening 
the door to more accurately understanding how students move through a 
curriculum, and at greater scale, than traditional education research 
is able to achieve.
    As data systems become more integrated into the learning and 
teaching process, we are seeing the impact that they can have on 
students, teachers, administrators, and policymakers. These systems 
enable teachers, schools, and districts to make more informed decisions 
to enhance student learning.
    Meanwhile, a growing number of on-line educational services have 
the ability to enhance learning within the classroom and extend it 
beyond the school day. Edmodo, which is used by more than 20 million 
teachers and students world-wide, allows teachers to set up virtual 
classrooms and then post homework assignments and other content to 
extend lessons. Khan Academy has more than 5,000 instructional videos 
and assessments, which allow students of all ages to learn at their own 
pace in subject areas ranging from pre-algebra to differential 
equations, from art history to computer science.
    With this explosion in on-line resources, there is a large amount 
of new data being generated by children using these services, which 
raises valid privacy concerns.
    The privacy of student education records is protected under FERPA, 
the Family Educational Rights and Privacy Act. When those student 
education records are hosted or analyzed by private companies that are 
helping districts build data systems to drive improvement, those same 
FERPA protections still apply.
    However, when students use on-line services like Khan Academy--in 
school or at home--or when teachers use grade and behavior tracking 
software on their iPads, all of that data are not necessarily covered 
by FERPA. In those direct interactions between students and software 
companies, data are being collected to build user profiles, 
individualize the learning experience, and track progress, but in the 
cases where FERPA does not apply, it is not always clear what 
protections exist to guarantee the privacy of those data and ensure 
companies are not using them to target advertisements at children.
    This committee will hear important testimony today about the value 
that these tailored technological resources provide to students 
themselves and the importance of ensuring access to data for teachers 
and researchers seeking to improve education. We'll also hear about the 
need for consistent privacy policies and current efforts to guarantee 
the security and privacy of student data.
    As we examine the privacy concerns prompted by the rapidly growing 
education technology sector and the information it collects, it's clear 
that we must strive to find a balance between privacy and innovation. 
We must ensure that companies involved in collecting and analyzing 
student data are not exploiting students' private information for 
marketing purposes or financial gain. Data are an invaluable tool. Data 
empowers teachers, guides individualized learning, and informs policy. 
As we consider where improvements are needed in privacy regulations, we 
must be sure that we do not compromise the value of student data.
    I look forward to hearing from our witnesses.
    Thank you very much.

    Mr. Meehan. Let me thank Ranking Member Loebsack for his 
opening statement and for his insights. I am also very--oh, let 
me also remind other Members of the committee that opening 
statements may be submitted for the record.
    [The statements of Ranking Member Thompson, Hon. Jackson 
Lee, and Hon. Polis follow:]
             Statement of Ranking Member Bennie G. Thompson
                             June 25, 2014
    There is considerable controversy about how we treat the vast 
amounts of student data created in the education field. Education's 
large-scale data sets--what scientists refer to as ``big data''--are 
troves of potential knowledge about our students. From education's 
``big data'', teachers can learn instructional methods; textbook 
writers can adapt their content; and policy makers can make decisions 
on curriculum guidelines. However, the information technology involved 
in storing the big data is outpacing the infrastructure and the 
contractual agreements that school districts currently have in place. 
Educational data contains sensitive, Personally Identifiable 
Information about our students. Parents are justifiably concerned about 
schools' use of their children's student data.
    The Family Educational Rights and Privacy Act, or FERPA, was 
written and has been amended to protect the privacy of student 
education records. The law applies to all schools that receive funds 
under an applicable program of the U.S. Department of Education. FERPA 
gives parents certain rights with respect to access to their children's 
education records. While the Department of Homeland Security does 
identify Education as a sub-sector in the National Infrastructure 
Protection Plan, most of the planning and coordination between the two 
agencies exists because of physical security and emergency response 
planning needs in the event of natural or man-made disaster or 
terroristic events.
    What we will hear today is testimony on the implications of the 
collection, storage, and use of in-depth student data, as managed by 
local and State school systems, and the Department of Education. The 
Department of Homeland Security is considered the leader among civilian 
agencies in developing privacy-protective technologies and policies for 
handling personal data, and has initiated pilot programs for developing 
a Federal Department-wide capability to analyze the large sets of data 
that DHS agencies collect.
    As part of this ``big data'' effort, DHS has brought together 
stakeholders to find ways to incorporate privacy protections in the 
management of big data strictly in the dot-gov arena. And DHS has been 
involved in Federal research efforts as part of the Networking and 
Information Technology Research and Development program, on data 
privacy technologies in general, efforts promoted by the White House 
Office of Science and Technology.
    It is possible that the Department's leadership role in the Federal 
Government's cyber R&D efforts can help provide advanced IT 
capabilities for the education sector, and other sectors concerned with 
privacy. There is a huge body of study already underway by academia, 
educational advocacy, and industry groups to develop and enable a 
common language for security and privacy policies tailored to students 
and parents, as well as to organizations and entities that underpin the 
education environment.
    This could potentially help school systems, and parents, that are 
struggling with contractual or technological or procedural privacy 
concerns associated with educational ``big data''. Like with all 
critical infrastructure networks, we must find a way to work together 
with schools, nonprofits, and industry to enable parents and educators 
to make informed decisions and maximize the opportunities that come 
with rapidly-advancing technology, without comprising our students and 
learners' privacy and safety.
                                 ______
                                 
                  Statement of Hon. Sheila Jackson Lee
                             June 25, 2014
    My thanks to Chairman Meehan and Ranking Member Clarke of the 
Committee on Homeland Security Subcommittee on Cybersecurity, 
Infrastructure Protection, and Security Technologies as well the 
Education and the Workforce Committee's Subcommittee on Early 
Childhood, Elementary, and Secondary Education for holding today's 
joint hearing ``How Data Mining Threatens Student Privacy.''
    Today's hearing is an opportunity to receive testimony on the issue 
of student kindergarden through 12th grade data privacy, data mining, 
confidentiality, and security practices related to cyber-based student 
and educational IT systems. Members will have the opportunity to hear 
testimony about how cloud-based databases and other IT technologies, 
used in K-12 schools are becoming increasingly complex and expansive, 
prompting an examination of the approaches that protect private student 
data, who may have access to it, and where and how it is stored.
    As the founder member and chair of the Children's Caucus the topic 
of today's hearing is of great interest to me.
    Children often do not enjoy the same rights as adults--they cannot 
consume alcohol, vote, nor can children enter into contracts.
    However, children also have a level of protections in law that are 
greater than those of adults such as the Children's Online Privacy 
Protection Act, child labor laws, laws to prevent abuse and neglect and 
laws regarding education such as the Family and Educational Rights and 
Privacy Act of 1974 (FERPA).
    These laws are is intended to facilitate children having safe and 
happy childhoods, which means the freedom to make mistakes and learn 
from those mistakes.
    Many children do not grow up the most ideal circumstances and those 
circumstances should not influence the course of their lives without 
due cause.
    In recent years there have been a number of incidents where the 
privacy of children has been violated by school districts that are of 
great concern.
    Primary of which is the incident involving the Lower Merion County 
Pennsylvania School District.
    That School District became internationally known when it was 
disclosed that it deployed spyware to take thousands of images of 
student while using their school-issued laptops.
    Images were taken of students while off school grounds, often went 
they were at home. Images were captured of not only students, but 
family members while in intimate settings.
    The case was a very emotional and situation for both families and 
school officials who were unaware of the activities of the technology 
department that deployed the surveillance system.
    Privacy violations of this type have most often occurred in 
domestic abuse or predator cases. This is the first known case to rise 
from an incident of a non-judicial decision by a domestic government 
institution to use this type of surveillance technology in this manner.
    Because Federal and State laws had not kept pace with technology 
there were no laws that address that type of privacy invasion that 
relied upon still pictures and not full motion video.
    Privacy is central to the health and strength of many other rights 
that we enjoy. Specifically, the First, Fourth, and Fifth Amendments to 
the Constitution rests on a foundation of privacy protection that allow 
us to speak as we wish, associate with other and hold our own beliefs 
free of fear or threats.
    Privacy should not nor has it been viewed as a partisan issue.
    So the topic of today's hearing is of great concern to me. There 
cannot be privacy without security, although we can have security 
without privacy. The digital information age requires that Federal 
agencies must have cybersecurity for any system that collects, retains, 
or uses personal information.
    Privacy protection and cybersecurity are linked in the work I have 
done on the topic of privacy. The ability to control who, when, why, 
and how someone else can gain access to personal information requires 
security for this reason attention to this issue is central to my 
strong support for Federal privacy laws.
    Although the Homeland Security Committee has no jurisdiction over 
general education issues there are aspects of today's hearing which do 
touch upon some our work of the Committee on Homeland such as questions 
regarding data security.
    Each of these children will be part of the workforce which will 
include the Department of Homeland Security. To the extent data 
security and privacy is compromised in education settings this may have 
an impact on the future ability of workers and employers to rely upon 
Department of Homeland Security programs like e-Verify, TWIC, or air 
travelers to trust PreCheck programs.
    Each of these data collection and use programs requires data non-
repudiation.
    Data non-repudiation very simply establishes that a person is who 
they claim to be.
    Further, we know from the work of intelligence and National 
security agencies that adversaries and friends seek as much detailed 
information on key persons in the Federal Government and influential 
private-sector business leaders.
    Data collection practices regarding student records on children:
   At least 38 States collecting some type of longitudinal 
        student data at the State level, five others are in various 
        stages of development, and the rest are insufficiently 
        transparent to determine.
   At least 32 percent of States collect children's social 
        security numbers.
   At least 22 percent of States record student pregnancies.
   At least 46 percent of States have a mechanism in place to 
        track children's mental health, illnesses, and jail sentences.
   At least, 72 percent of States collect children's family 
        wealth indicators.
   Only 6 States appear to use a third party who restricts the 
        State's access to the student ID numbers, i.e. prevents State 
        access to individual student data.
   Only 18 States have detailed access and use restrictions.
   Only 18 States require database users to enter into 
        confidentiality agreements.
   Only 10 States have data retention policies.
   Forty-nine States make FERPA information accessible on the 
        internet, but for many the information is hard to find, vague, 
        or incomprehensible.
    The change in the Family and Educational Rights and Privacy Act of 
1974 (FERPA) rule regarding what entities can have access to student 
records is troubling.
    In April 2011, the U.S. Department of Education (ED) issued a 
notice of proposed rulemaking (NPRM), inviting public comments on its 
proposed regulations amending the Family and Educational Rights and 
Privacy Act of 1974 (FERPA).
    The final rule removed limitations prohibiting educational 
institutions and agencies from disclosing student Personally 
Identifiable Information, without first obtaining student or parental 
consent.
    The change in FERPA regulations redefined FERPA definitions 
regarding ``authorized representative,'' ``education program,'' and 
``directory information.'' The new definition gave non-governmental 
actors increased access to student personal data.
    I am not opposed to the collection data on students regarding their 
lives, education or well-being for education purposes.
    I am however, strong object to use of student record information 
outside of the purpose of the collection and the lack of control over 
those records that parents may have in limiting access and use for non-
official purposes.
    Student record data should be limited to education purposes with 
the exception of uses related to the protection of the well-being of 
the child and their family.
    Data brokers a new business model that buys and sells a wide range 
of personal information would find great value in have unlimited 
control and use of personal identifiable information--the more 
sensitive that information--the more value that information.
    Too often the opportunity to limit additional uses of personal 
information on students requires a parent or guardian to act, when 
allowed to control the use of their child's education records.
    This will mean that students whose families are not as equipped or 
knowledgeable of the data collection, use, and retention polices 
regarding student records will likely have their information retained 
and used, which can have serious consequences for the opportunities 
they may have in the future.
    Personal Identifiable Information should be protected by fair 
information practices no matter the age of the person whose information 
is collected.
    I strongly believe that our children are our Nation's most precious 
resource and their futures should not be limited or influenced by a 
permanent government record that contains unprotected information from 
their earliest years throughout their work like.
    I yield back.
    Thank you.
                                 ______
                                 
                     Statement of Hon. Jared Polis
                             June 25, 2014
    Recently, concerns about the increasing collection and use of 
student data in schools have come to the forefront in local education 
debates. The fall of the nonprofit education database, inBloom, as well 
as the hearing today titled, ``How Data Mining Threatens Our Children'' 
are evidence of widespread consternation from the left and the right.
    I believe that security and privacy are critical, yet manageable 
concerns. We should not dismiss the power of using data to improve 
classroom instruction; simply develop best practices to ensure that 
data is used responsibly. Data can be a powerful tool to provide 
parents with meaningful information about their child's progress, 
connect students and families with personalized learning opportunities, 
and create high-quality materials and tools that can bring our 
education system into the 21st Century.
    InBloom's demise raised important concerns about the appropriate 
privacy and security precautions necessary to protect beneficial 
student data in an increasingly technological school environment. 
That's why I am urging industry, parents, and teachers to come together 
to address these concerns with a set of expectations and commitments on 
how to best protect and secure our children's data, while enjoying the 
benefits of more personalized learning.
    When I am back home in Colorado, I hear from parents who are 
rightly concerned about data security, but optimistic about improving 
their children's educational opportunities. They worry about where 
their student data is stored, whether it is secure, and who it is 
shared with. They worry about a pervasive ``permanent record.'' They 
worry that advertising companies may inappropriately target their 
children and somehow profit on their decisions in what should be a safe 
and secure school environment. At the same time, they want for their 
children to succeed in an increasingly connected digital world. They 
want to know how their children are developing, and what they can do to 
help. And they want to be able to make informed choices about the best 
schooling options for their children.
    Parents want what is best for their children, and deserve 
transparency about what is happening in their schools. Unfortunately, 
the intersection of the Family Educational Rights and Privacy Act 
(FERPA), Children's Online Privacy and Protection Act (COPPA), a 
growing number of State laws, district policies, vendor contracts, and 
privacy policies make it very difficult for them to have confidence 
that their children's data is being used solely to advance their 
education. Lately, these concerns have moved from hesitation to 
outright opposition to the collection and use of student data.
    While opposition is mounting for valid reasons, we must recognize 
the promise of digital learning and the opportunities that collecting, 
analyzing, and utilizing student data, appropriately, presents to 
personalized education. I have experienced the power of digital 
learning as the former chair of the State board of education in 
Colorado, and know that timely, relevant, and private information about 
student performance can be an important tool to ensure that our 
education system is able to identify student's strengths and challenges 
and intervene appropriately.
    I am concerned that a purely political reaction to legitimate 
privacy concerns threatens to derail the potential of digital learning 
and years of progress in personalizing education. Federal legislation 
is an option, but may not be able to provide a nuanced solution in such 
a complex and emerging field.
    That's why I, along with Representative Luke Messer are calling on 
industry leaders, parents, and teachers to come together around a set 
of effective and appropriate expectations and commitments on data 
privacy in schools. These standards should be rigorous, but adaptable; 
comprehensive, yet easily comprehensible for parents to understand what 
is occurring in their schools. That is why a few weeks ago, we were 
honored to convene a group of industry and educational leaders to 
discuss the topic, and are pleased with the group's progress during the 
first meeting. We are calling on these groups to develop a transparent 
set of expectations and commitments in time for back-to-school.
    Ensuring the right balance between privacy and innovation in 
education is a critical, bipartisan issue that will pave the way for 
the next generation of students to thrive. I am looking forward to 
working with industry, parents, and teachers to achieve this balance, 
and make a promise of which we can all be proud.

    Mr. Meehan. I am also very grateful for what is a very 
distinguished panel of some real experts who understand and 
have spent a great deal of time looking at this issue from 
multiple factors. So what we really hope we are able to do is 
encourage the kind of insight and give and take to help us best 
understand how we might both understand the challenges in this 
issue and act accordingly to protect appropriately the privacy 
of our students.
    Ms. Clarke. Mr. Chairman.
    Mr. Meehan. Yes.
    Ms. Clarke. Before you proceed, I would like to request 
unanimous consent for Ms. Bonamici of the Education and the 
Workforce Committee to join us in the hearing today.
    Mr. Meehan. Without objection, so ordered.
    Ms. Clarke. Thank you.
    Mr. Meehan. Thank you for being here, Ms. Bonamici.
    I will briefly introduce each of the distinguished panel 
members today. First, to my left, is Mr. Joel Reidenberg. He is 
the Stanley D. and Nikki Waxberg chair, and professor of law 
and founding academic director at the Center on Law and 
Information Policy at Fordham University School of Law. Mr. 
Reidenberg is an expert on information technology law and 
policy, and his current research examines privacy in public 
information surveillance, privacy in cloud computing in 
purchase schools, and the impact of patents on the smartphone 
industry.
    Next to Mr. Reidenberg is Mr. Mark MacCarthy. Mr. MacCarthy 
is a vice president of public policy for the Software and 
Information Industry Association. Mr. MacCarthy directs SIIA's 
public privacy initiatives in the areas of intellectual 
property enforcement, information privacy, cybersecurity, cloud 
computing, and the promotion of education technology. The 
Software and Information Industry Association is the principle 
trade association for the software and digital content 
industry, providing global services in Government relations, 
business development, corporate education, and intellectual 
property protection.
    Next is Ms. Joyce Popp. Ms. Popp is the chief investment 
officer for the Idaho Department of Education. One of her key 
focuses since joining the State department of education in July 
2009 has been the design management and security of the data 
collection process and the use of data. Prior to joining the 
State department of education, Ms. Joyce had over 30 years 
experience in management within the high-tech industry, leading 
large teams in the creation, design, and support of data 
systems and information exchange.
    Last is Mr. Thomas Murray. Mr. Murray is the State and 
district digital learning policy advocacy director for the 
Alliance for Excellent Education. The Alliance for Excellent 
Education is a D.C.-based National policy and advocacy 
organization dedicated to ensuring that all students graduate 
from high school. Mr. Murray works alongside State education 
departments, corporations, and school districts around the 
country to implement digital learning. As a former school 
principal, Mr. Murray has been invested regarding proper 
technology in fusion and personalized professional learning. He 
is the founder of #Edchat, a weekly educational technology 
twitter-forum, and has a weekly radio show on the BAM Radio 
Network.
    I want to let each of the witnesses know that your full 
written statements will appear in the record. We are limited, 
or try to stay as closely as we can, to 5 minutes to testify. 
You are dealing with a weighty, a meaty, and important subject, 
so I will ask. You all have impressive backgrounds and resumes, 
and I will take official notice of your impressive 
qualifications. So with the time that you have, if you can, I 
would like to ask if you would dig right into the substance of 
your observations on this issue because you have a great deal 
to share with us in time that we make available to you.
    So at this point in time, the Chairman recognizes Mr. 
Reidenberg for your comments.

 STATEMENT OF JOEL R. REIDENBERG, STANLEY D. AND NIKKI WAXBERG 
CHAIR AND PROFESSOR OF LAW, FOUNDING ACADEMIC DIRECTOR, CENTER 
OF LAW AND INFORMATION POLICY, FORDHAM UNIVERSITY SCHOOL OF LAW

    Mr. Reidenberg. Good morning, Mr. Chairman, Ranking Members 
and distinguished Members of the subcommittees. Thank you very 
much for inviting me to testify this morning. It is truly an 
honor and a privilege to be able to address these issues. My 
testimony is going to draw on the Fordham study, that the 
Chairman mentioned, that I directed addressing privacy in cloud 
computing in public schools. I hope that this study might be 
included with the record of the committee hearing today.
    I am joined today by two of my co-authors from the study, 
Cameron Russell and Tom Norton. But I am giving my own views as 
an academic expert and I am not representing those of any 
organization. I am gonna spend my time summarizing four of the 
key points from the written statement. The first is that 
schools--essentially, every school district in the United 
States is outsourcing student information. Our study found 
there were--95 percent of the school districts did this.
    Schools are sending data to third parties for a whole 
series of very positive reasons: Data-driven educational goals; 
reporting obligations; cost savings; instructional 
opportunities. We found in our study that there was a 
tremendous diversity in type of services and the service 
providers themselves. The services ranged from classroom 
instructional functions, reporting functions, data mining, 
guidance for college and career counseling, IT hosting, special 
services like transportation and cafeteria management. The 
number of vendors are staggering.
    It is a very wide range from large companies to small 
companies. There is an enough quantity of information that is 
being transferred by school districts. It is not simply the 
traditional school record, the grades or the transcripts. It 
includes things like homework assignments, essays, fitness 
profiles, family financial records and financial status, 
lunchroom purchases, whether a child blinks while he is 
reading. All of these sorts of things are being transferred as 
children use on-line services in schools and as schools rely on 
third parties to perform some of their functions.
    The second point is that Federal educational privacy law 
fails to protect the student information. There are essentially 
three statutes that I believe are relevant in this context. 
FERPA is one, a 40-year-old statute; the Children's Online 
Privacy Protection Act that requires parental consent when data 
is gathered directly from children on-line under the age of 13; 
and the Pupil Privacy Protection Amendment that addresses 
taking surveys of children in schools. FERPA is essentially the 
baseline that everyone speaks of. But FERPA only applies to 
educational institutions. It is a funding statute.
    It does not apply to the vendors. It only applies narrowly 
to what are defined as educational records. The Supreme Court, 
in its one decision interpreting that provision of FERPA, seems 
to think an educational record is only the type of data that 
would have been held in a principal's file cabinet. So when you 
look at the statute itself from 1974, it is a pre-computer era 
statute. COPPA has some application if children are on-line in 
schools. The school districts can, in certain instances, 
consent as though they were parents. But then what happens when 
the child moves from school to home and works on the same 
application? It has been an instructional tool.
    States are beginning, across the country, to look to fill 
some of these gaps. But contracts would be the only source of 
true protection. What our study shows is that schools 
essentially routinely relinquish their students' privacy when 
they contract with outside vendors, and parents are kept in the 
dark. We heard from the Chairman's opening statement, 20 
percent of the schools have no policies on adopting 
technologies. Seventy-five percent of the districts failed to 
inform parents that they are outsourcing their children's data.
    The contract practices, on the whole, are terrible. Many of 
the contracts allow vendors to unilaterally change the terms. 
They don't block the sale or marketing of data. Forty percent 
of the hosting agreements fail to require any data security. 
Twenty-five percent of the classroom programs are free 
programs; they don't charge school districts money. Instead, 
the school districts essentially pay with the student's 
privacy. The data is being monetized.
    My fourth point is that strong and effective privacy 
protections are essential. Because without them, if we persist 
with the status quo, all of the educational policies that we 
want to achieve based on data-driven decision-making, they will 
fail. Parents will object to the use of these technologies. 
There will be scandals, there will be problems that will shut 
down rather than carefully nuance how to treat the data privacy 
issues. We have seen this in New York State, for example, with 
the inBloom project. InBloom is a $100 million project, it is a 
platform that would enable data sharing between schools and 
vendors. It shut down over the privacy concerns.
    In my prepared statement, I make four recommendations for 
Congress to consider. I see my time has expired so I will 
perhaps leave those recommendations for you to see in a written 
statement, and we can answer--I will answer any questions on 
them during the following period.
    Thank you.
    [The prepared statement of Mr. Reidenberg follows:]
                Prepared Statement of Joel R. Reidenberg
                             June 25, 2014
    Good morning Chairman Meehan, Representative Clarke, Chairman 
Rokita, Representative Loebsach, and distinguished Members of the 
subcommittees. I would like to thank you for the invitation to testify 
today on this critical privacy issue for our Nation's school children.
    My name is Joel Reidenberg. I am here today as an academic expert 
on student information and privacy. I hold the Stanley D. and Nikki 
Waxberg chair at Fordham University where I am a professor of law and 
the academic director of the Center on Law and Information Policy 
(``Fordham CLIP''). I am also just finishing my term as the inaugural 
Microsoft Visiting Professor of Information Technology Policy at 
Princeton University.
    As a law scholar, I have written and lectured extensively on data 
privacy law and policy. I am a member of the American Law Institute 
where I serve as an adviser to the Restatement of the Law Third on 
Information Privacy Principles. I am a former chair of the Association 
of American Law School's Section on Defamation and Privacy and have 
served as an expert adviser on data privacy issues for the Federal 
Trade Commission, the European Commission and during the 103rd and 
104th Congresses for the Office of Technology Assessment. I have also 
served as a special assistant attorney general for the State of 
Washington in connection with privacy litigation.
    Of relevance to today's hearing, I directed the research study 
``Privacy and Cloud Computing in Public Schools'' (Dec. 2013) 
[``Fordham CLIP Study''] that provides a benchmark analysis of the 
processing of student information by on-line vendors and that also 
documents the current legal risks surrounding student privacy.\1\ Two 
members of the Fordham CLIP research team, N. Cameron Russell, Fordham 
CLIP's executive director, and Thomas B. Norton, Fordham CLIP's privacy 
fellow, accompany me here today.
---------------------------------------------------------------------------
    \1\ Joel R. Reidenberg, N. Cameron Russell, Jordan Kovnot, Thomas 
B. Norton, Ryan Cloutier, Daniela Alvarado, Privacy and Cloud Computing 
in Public Schools (Dec. 2013) available at http://law.fordham.edu/
k12cloudprivacy [hereinafter ``Fordham CLIP Study'']. I also directed 
an earlier study, Children's Educational Records and Privacy: A Study 
of Elementary and Secondary School State Reporting Systems (Fordham 
CLIP: Oct. 28, 2009) http://law.fordham.edu/childrensprivacy and 
testified on that work in a hearing before the House Committee on 
Education and Labor during the 111th Congress.
---------------------------------------------------------------------------
    In appearing today, I am testifying as an academic expert and my 
views should not be attributed to any organization with which I am or 
have been affiliated.
    My testimony today draws specifically from the Fordham CLIP Study. 
I will address a number of our key findings.

1. Schools are uniformly transferring vast amounts of student 
information to on-line third parties for many varied purposes.

    School districts across the country are rapidly embracing evolving 
on-line technologies to meet data-driven educational goals, satisfy 
reporting obligations, realize information technology cost savings, and 
take advantage of new instructional opportunities.
    The Fordham CLIP Study found that 95% of public schools in the 
United States use on-line services that involve the transfer of student 
information to third parties. Schools use these services for a myriad 
of purposes that the Fordham CLIP Study categorized as follows:
   Data analytics functions
   Student reporting functions
   Classroom functions
   Guidance functions
   Special school functions (e.g., transportation services)
   Hosting, maintenance, and back-up functions. \2\
---------------------------------------------------------------------------
    \2\ Fordham CLIP Study, at pp. 17-18.
---------------------------------------------------------------------------
    These on-line services involve the collection and transfer of 
enormous quantities of student information to third-party commercial 
organizations including school records, homework essays, fitness 
profiles, and even lunchroom purchases.

2. Federal education privacy law fails to protect student information 
in a vast range of commercial computing services used by schools.

    Three Federal privacy statutes address student information that may 
be collected by and from schools: The Family Educational Rights and 
Privacy Act of 1974 \3\ (``FERPA''), the Children's Online Privacy 
Protection Act \4\ (``COPPA''), and the Protection of Pupil Rights 
Amendment \5\ (``PPRA'').
---------------------------------------------------------------------------
    \3\ 20 U.S.C.  1232g.
    \4\ 15 U.S.C.  6501-6506.
    \5\ 20 U.S.C.  1232h.
---------------------------------------------------------------------------
    FERPA is the oldest and best-known educational privacy statute. The 
statute seeks to provide confidentiality to student data, but only 
covers ``educational records'' in a very narrow sense (e.g., 
transcripts).\6\ The statute also specifically exempts ``directory 
information,'' including a student's name, address, date of birth, 
telephone number, age, sex, and weight from confidentiality 
obligations.\7\ Most significantly, FERPA was written 40 years ago 
before public schools had computers, let alone internet access. As 
acknowledged by the Department of Education, the applicability of FERPA 
to typical on-line school services is questionable at best.\8\
---------------------------------------------------------------------------
    \6\ See Owasso Independent School District v. Falvo, 534 U.S. 426 
(2002).
    \7\ 20 U.S.C.  1232g(a)(5)(A).
    \8\ Dept. of Educ., Protecting Student Privacy While Using Online 
Educational Services: Requirements and Best Practices, PTAC FAQ3 (Feb. 
2014) http://ptac.ed.gov/document/protecting-student-privacy-while-
using-online-educational-services (the Department wrote: ``Is student 
information used in online educational services protected by FERPA? It 
depends.'').
---------------------------------------------------------------------------
    The other statutes, COPPA (addressing parental consent for on-line 
collection of data directly from children younger than 13) and PPRA 
(primarily addressing the use of data collected from in-school surveys 
and some marketing activities), similarly suffer from significant 
protection gaps in the context of cloud computing, that the Fordham 
CLIP Study explains.
    Many cloud services used by schools are, thus, completely outside 
the protections of these statutes. For example, when a middle school 
uses a cloud service provider to offer young teens self-assessment 
tests that give scores to their language or math levels, those scores 
will not likely be protected by the Federal statutes: They are not 
FERPA ``educational records'' because they are not used for the middle 
schooler's transcript grade, they do not require COPPA parental 
consent, and they fall outside the PPRA categories of protection. Thus, 
there is no statutory obligation of confidentiality.
    Another example comes from special school functions: Schools are 
now using third-party on-line service providers to manage payments for 
the school cafeteria. When a child buys a meal in the school cafeteria, 
the information about the child's eating habits will not have privacy 
protection.
    Another important point to note is that FERPA does not apply to 
vendors. By its terms, FERPA only applies to educational agencies and 
institutions that are recipients of Federal funds.\9\ FERPA does not 
provide a private right of action,\10\ and the only sanction available 
under FERPA is the denial of Federal educational funds by the 
Department of Education. The Department has never issued such an order. 
Thus, under Federal law, legal protection for student privacy will only 
come from the contractual terms in agreements between schools and 
vendors.
---------------------------------------------------------------------------
    \9\ 20 U.S.C.  1232g(a).
    \10\ Gonzaga Univ. v. Doe, 536 U.S. 273 (2002).
---------------------------------------------------------------------------
    States, however, are increasingly concerned about the commercial 
sale of student information. According to recent reports, over 30 
States across the country have bills at various stages of enactment to 
address student privacy on-line. These bills do not generally address 
the full range of issues and would establish different protections for 
students in different States.

3. The Fordham CLIP study documents that schools routinely relinquish 
student privacy when they contract for on-line services and parents are 
kept in the dark.

    In the absence of statutory rights, schools can protect student 
privacy through their contracts with on-line service providers. The 
Fordham CLIP Study, however, demonstrates that contracts between 
schools and vendors often fail to establish legal rights that protect 
student information. Schools essentially relinquish their students' 
privacy in the cloud. And, at the same time, schools routinely fail to 
inform parents that their children's data is sent to third parties.
    Among the findings, the Fordham CLIP Study reported that:
   Technology governance controls are absent.--20% of school 
        districts have no policies on the vetting and adoption of 
        information technology services by teachers and staff.
   Transparency is missing.--75% of districts did not inform 
        parents that their children's data was being released to on-
        line service providers, and districts do not readily make their 
        agreements publicly accessible.
   Legal compliance is not working.--COPPA is frequently 
        ignored; FERPA notices are rare.
   Contract practices are disturbing.--Over 75% of the 
        agreements fail to specify a legitimate purpose for processing 
        student data, vendors are routinely able to modify the privacy 
        terms on a unilateral basis, and schools fail to keep adequate 
        documentation of their contracts.
   Student data may be sold for advertising and marketing.--
        Fewer than 7% of agreements explicitly prohibit the sale or 
        marketing of student information, though higher percentages of 
        agreements have general restrictions on re-disclosure. Without 
        a contractual prohibition, vendors are free to sell the student 
        information.
   Data security protections are poor.--40% of hosting 
        agreements, like many other categories, fail to require any 
        data security and, depending on the type of service, 33% or 
        more of the agreements fail to require the deletion of student 
        information at contract termination.\11\
---------------------------------------------------------------------------
    \11\ See Fordham CLIP Study, Executive Summary, pp. 1-2.
---------------------------------------------------------------------------
    These findings present a very disturbing set of risks to the 
privacy of our Nation's student information. A permanent record may now 
indeed follow a child from elementary school through adulthood. For 
example, the company ConnectEdu held data on over 20 million students 
and offered a product called K12 Early Warning Indicator.\12\ The 
product sought to label students with the goal of identifying and 
helping at-risk students. But, the lack of privacy protection means 
that the label may now follow the child indefinitely. Worse still, the 
company is now in bankruptcy and the Federal Trade Commission had to 
make a special filing in the hope that it could persuade the bankruptcy 
judge not to sell off to the highest bidder all the student data held 
by the bankrupt company.\13\
---------------------------------------------------------------------------
    \12\ See ConnectEdu, About Us http://connectedu.com/about-us 
(stating the company had data on 20 million ``registered learners''); 
ConnectEdu, What does K12 Early Warning do for you, http://
207.127.11.51/products-k12earlywarning-features.html (``locate students 
at risk'').
    \13\ See Federal Trade Commission Letter From Jessica L. Rich, 
Director of the Bureau of Consumer Protection, Filed With the 
Bankruptcy Court for the Southern District of New York--in In re 
ConnectEDU, Inc., No. 14-11238 (Bankr. S.D.N.Y.) (May 22, 2014) http://
www.ftc.gov/system/files/documents/public_statements/311501/
140523connecteducommltr.pdf.
---------------------------------------------------------------------------
    Similarly, student data becomes fuel for commercial uses. In some 
contexts, such as those involving classroom functions, 25% of the 
school contracts involved no financial payments. This likely means that 
these vendors are monetizing the student information to fund the 
services they provide. In other words, school districts are paying for 
services with their students' privacy rather than cash. This was 
dramatically illustrated by disclosures in the law suit against Google 
for its scanning of student email. Originally, Google represented to 
educational institutions that it did not scan student email for 
commercial advertising.\14\ As it turned out, Google was profiling 
students based on their email.\15\ In a policy change announced on 
April 30, 2014, Google said that it would no longer ``collect or use 
student data in Apps for Education services for advertising 
purposes.''\16\ Google remains silent, however, on scanning email and 
profiling student users for other commercial purposes and partnerships 
with education technology companies. Google is not alone. The other 
companies that offer education technology products without fees are or 
will be trading on student privacy.
---------------------------------------------------------------------------
    \14\ See Jeff Gould, Google admits data mining student emails in 
its free education apps, SafeGov.Org (Jan. 31., 2014) http://
safegov.org/2014/1/31/google-admits-data-mining-student-emails-in-its-
free-education-apps (quoting a pre-2013 Google FAQ saying ``note that 
there is no ad-related scanning or processing in Google Apps for 
Education'').
    \15\ See Michele Molnar, Google Abandons Scanning of Student Email, 
Education Week, Apr. 20, 2014, http://blogs.edweek.org/edweek/
marketplacek12/2014/04/google_abandons_scan- 
ning_of_student_email_accounts.html.
    \16\ Protecting students with Google Apps for Education, Apr. 30, 
2014 http://googleenterprise.blogspot.com/2014/04/protecting-students-
with-google-apps.html.

4. Without strong and effective privacy protections for student 
information, data-driven educational policies will fail and parents 
---------------------------------------------------------------------------
will oppose new instructional methods.

    The responsibility for placing student privacy at risk through 
these observed practices is complex. Federal laws such as the No Child 
Left Behind Act and the American Recovery and Reinvestment Act of 2009 
required schools to create and report detailed student information. 
Innovations in technology and incentives for data mining create new 
demands for student information. Yet, at the same time, education 
privacy laws have not been modernized to keep up, and our research 
revealed that schools were not equipped to address these issues 
effectively.
    Data collection and use to inform and improve student learning is 
critical to making education successful in the United States. But so is 
the long-term health of our children's privacy. More often than not, 
school districts poorly understood the data transfers and privacy 
implications of the on-line services they use.\17\ Other than the 
largest districts with legal offices, few had either the expertise or 
the ability to negotiate contract terms that were drafted by vendors.
---------------------------------------------------------------------------
    \17\ See Fordham CLIP Study, p. 15 (describing districts' lack of 
knowledge of their own agreements); Stephanie Simon, Data mining your 
children, Politico, May 15, 2014 http://www.politico.com/story/2014/05/
data-mining-your-children-106676.html (``school administra- tors . . . 
don't know which digital tools individual teachers are using in the 
classroom.'').
---------------------------------------------------------------------------
    As a result, today's status quo is an unstable and contentious 
environment for education technology. The recent failure of inBloom, a 
$100 million venture to develop a platform for education data, 
demonstrates that privacy risks will shut down programs when public 
concerns are not addressed effectively.\18\ If privacy is not 
adequately and transparently addressed, parents will oppose the use of 
education technologies for fear of their children's safety.
---------------------------------------------------------------------------
    \18\ See Benjamin Herold, inBloom to shut down amid growing privacy 
concerns, Education Week, Apr. 21, 2014 http://blogs.edweek.org/edweek/
DigitalEducation/2014/04/
inbloom_to_shut_down_amid_growing_data_privacy_concerns.html.
---------------------------------------------------------------------------
    Strong and effective privacy protections for student information 
are essential for data-driven educational policies to succeed.
                            recommendations
    There are a number of steps Congress can take to restore and assure 
the privacy of student information:
    (1) Modernize FERPA to protect and limit the use of all student 
        information whether held by schools or vendors--including a 
        prohibition on non-educational uses of student information and 
        graduated enforcement remedies such as private rights of 
        action.
    (2) Require that the processing of student data under any 
        Federally-financed educational program be prohibited unless 
        there is a written agreement spelling out the purposes for the 
        processing, restricting the processing to the minimum amount of 
        data necessary for those purposes, restricting the processing 
        to permissible educational uses, mandating data security, 
        requiring data deletion at the end of the contract, and 
        providing for schools' audit and inspection rights with respect 
        to vendors.
    (3) Require that States adopt an oversight mechanism for the 
        collection and use of student data by local and State 
        educational agencies. A Chief Privacy Officer in State 
        departments of education is essential to provide transparency 
        to the public, assistance for local school districts to meet 
        their privacy responsibilities, and oversight for compliance 
        with privacy requirements.
    (4) Provide support to the Department of Education and to the 
        research community to address privacy in the context of 
        rapidly-evolving educational technologies, including support 
        for a clearing center to assist schools and vendors find 
        appropriate best practices for their needs.
    Thank you again for the opportunity to participate in this hearing 
and for your consideration of my testimony.

    Mr. Meehan. Yes, you will have an opportunity to elaborate, 
I think, on some of those in response to the questions, or to 
open the door to some of those in responses to any questions 
you may have.
    The Chairman now recognizes Mr. MacCarthy.
    Mr. MacCarthy, I am gonna ask that you push your button so 
that we can pick up your voice.
    Mr. MacCarthy. Now do you have it?
    Mr. Meehan. I have it.

 STATEMENT OF MARK MAC CARTHY, VICE PRESIDENT, PUBLIC POLICY, 
         SOFTWARE AND INFORMATION INDUSTRY ASSOCIATION

    Mr. MacCarthy. Excellent. Thank you. My name is Mark 
MacCarthy and I am with Software and Information Industry 
Association. On behalf of SIIA and our member companies--many 
of whom are involved in providing educational services to 
schools--I want to thank you for having me here to testify on 
this important topic. I want to thank you for your thoughtful 
opening statements on this topic.
    Mr. Chairman, Ranking Members, the effective use of 
educational technology and student information is essential for 
improving student learning, for empowering parents and, 
ultimately, for ensuring the competitiveness of the United 
States in a global environment. Let me take a few minutes to 
explain some of the uses of technology and student information, 
and how it is transforming American education.
    They are enabling multiple approaches to learning to 
address each individual student's individual learning style, 
their abilities, their pace, their interests. Data-powered 
course-ware helps teachers deliver customized lessons to each 
individual student. Predictive analytics are allowing students 
and teachers to identify students at risk of failing in a 
particular course or even of dropping out of school entirely. 
Data-driven technology is empowering parents, allowing them to 
access information about their children's educational progress 
and communicating more effectively and actively with their 
teachers.
    Cloud computing is enhancing school capacity by providing 
more data access, enhanced data management, powerful analytics, 
and improved security. The scale of cloud computing enables 
greater expertise and more investment in information security. 
The list goes on but, in sum, educational technology is 
allowing schools to identify students at risk, to personalize 
learning, to improve communication with parents, to modify 
their operations better and more efficiently, and to inform 
their decision making.
    Now, of course, we recognize that there are important 
questions being asked about data privacy. I would like to 
address three essential ways in which student data is being 
protected. First is Federal law. Federal law establishes a 
strong framework that restricts the use of student information 
to educational purposes. FERPA requires that identifiable 
information shared with service providers without parental 
consent or without student consent, must be used solely for 
institutional services and functions that would otherwise be 
performed by school officials. It must be used only for 
educational purposes.
    Now, FERPA covers educational records. But educators and 
service providers treat all identifiable student information 
with the same high level of privacy protection. While FERPA is 
40 years old, its regulations have been updated for the digital 
age, including student privacy guidance for on-line services 
released just this year. The Children's Online Privacy 
Protection Act offers further protections for children under 
the age of 13.
    The bottom line is that if an outside party wants to use 
student information for non-educational purposes, it is 
required by law to get the consent of the parent or the student 
to do so.
    So that is the first level of protection, Federal law. The 
second level is contracts. Student data is also protected by 
contract. Service providers are bound by the contracts they 
enter into with schools. Here, frankly, we owe Professor 
Reidenberg a debt of gratitude, both the industry and the 
educators, for drawing attention to the limitations on those 
contracts and the need to work together to improve them.
    The third level of protection is the efforts by SIIA and 
other stakeholders to enhance student data protection. Service 
providers are continuously reviewing and improving data 
policies, procedures, and technologies, and are guided, in 
part, by SIIA's recently-released best practices. The 
Consortium for School Networking, representing school 
technology officers, has released a tool kit for protecting 
student privacy. We appreciate the recent leadership from 
Representatives Polis and Messer in assembling stakeholders to 
engage in collective efforts to improve student privacy.
    While it makes sense for public policies to be reviewed, we 
do not think that new Federal student privacy legislation is 
necessary at this time. The current legal framework and 
industry practices maintain local decision-making and 
adequately protect student privacy. New legislation creates 
substantial risks of harm to the innovative use of information 
that is essential for improving education for all students, and 
ensuring that U.S. economic strength in an increasingly global 
competitive environment is maintained.
    I would be happy to answer any questions you might have.
    [The prepared statement of Mr. MacCarthy follows:]
                  Prepared Statement of Mark MacCarthy
                             June 25, 2014
    On behalf of the Software & Information Industry Association (SIIA) 
and our member high-tech companies, thank you for inviting me to 
testify today. I am Mark MacCarthy, SIIA's vice president of public 
policy. SIIA commends Chairman Meehan and Rokita, Ranking Members 
Clarke and Loebsack and your respective committees for holding this 
hearing to examine student privacy in the digital age.
    SIIA is the principal trade association for the software and 
digital content industry. Many of SIIA's 800 member high-tech companies 
partner with schools and universities across the country to develop and 
deliver learning software applications, digital content, web services 
and related technologies and services that meet teaching, learning, and 
enterprise management needs. All SIIA members depend on the Nation's 
schools for a skilled, high-tech workforce.
    Modern information technologies play an increasingly essential role 
in our education system. SIIA agrees that the effective use of student 
information to improve learning is concomitant with the obligation to 
safeguard student data privacy and security. This will require a 
continued and enhanced trust framework between the triad of 
stakeholders--parents and schools; schools and service providers; and 
service providers and parents.
    My testimony today will address three questions:
   What are some of the ways students, teachers, and schools 
        use technology and leverage data to improve education?
   What are the current policies and evolving practices 
        protecting student privacy and data security?
   Is there a need for new Federal student privacy legislation?
        i. use of technology and student information in schools
    As we move from an industrial-age era model to a customized 
education model, technology is increasingly mission-critical to making 
certain all students receive a world-class education, and our Nation 
competes in the global economy. International assessment results and 
high-tech job openings demonstrate the challenge of ensuring students 
are college- and career-ready, including with the STEM (science, 
technology, engineering, and math) and other 21st Century skills needed 
to succeed in this knowledge-based economy.
    From adaptive learning software to class scheduling applications to 
on-line learning, technologies are enhancing student access and 
opportunity and enabling administrative operations. Many of these 
technologies are based on the effective use of student information for 
educational purposes. As such, technology and data systems are 
increasingly essential to supporting students, families, and 
educators--providing operational efficiencies, informing practice, and 
personalizing student learning.
    Some of the ways the use of educational technology and student 
information can enable school operations and improve student learning 
include:
    1. Help Meet the Needs of All Students.--Technology enables 
        multiple approaches to learning to effectively address each 
        student's individual learning style, abilities, pace, and 
        interests. Through embedded assessment and adaptive content, 
        today's data-powered courseware helps teachers deliver lessons 
        and content in the modality, complexity, and representation to 
        meet every student's unique needs, rather than teaching to the 
        mean. Predictive analytics can also identify students at risk 
        of dropping out of school. Timely identification enables 
        schools to intervene early in the process.
    2. Facilitate Communication and Collaboration.--Participation in a 
        variety of controlled virtual and learning communities with 
        peers and experts inspires students and teachers to discover, 
        explore, guide, and collaborate. Parents can access information 
        and curriculum, and communicate with teachers in more 
        convenient and powerful ways to support their children's 
        learning.
    3. Manage the Education Enterprise.--Like businesses, schools are 
        harnessing technology to manage core organizational tasks from 
        accounting to human resources to scheduling. Through data 
        management and analysis tools, administrators can identify 
        performance gaps and effective practices, thus enabling more 
        informed decisions to operate the school more efficiently and 
        effectively.
    The recent Obama White House report on data and privacy highlights 
two complementary main benefits of data in education: Personalized 
learning and research to enhance understanding about learning. It 
reads, in part: ``Data from a student's experience . . . can be 
precisely tracked, opening the door to understanding how students move 
through a learning trajectory with greater fidelity, and at greater 
scale . . . ''. The opportunity is to use this data-driven 
understanding to customize student instruction and curriculum based on 
each student's unique needs.
    As outlined above, an essential part of the technology-enabled 
changes to practices in our schools is the collection, use, and sharing 
of student information for educational purposes. Our educational system 
has long collected and used student data to operate and inform 
educational practices, and has routinely done so by using third-party 
service providers.
    Today, new technologies like cloud computing are enhancing school 
capacity in ways not otherwise possible by providing anytime/anywhere 
data access, enhanced data management functionality, powerful data 
analytics, and improved security. The scale of cloud computing enables 
great expertise and investments in security, which includes predicting 
and identifying against external threats such as hackers or malware and 
putting in place the most sophisticated data security technologies. In 
addition, cloud security guards against more traditional threats such 
as fire or unlocked file cabinets whereby the technology provides a 
protection not possible through traditional methods. These tools and 
techniques allow educators to manage more data in more cost-effective, 
secure, and sophisticated ways to inform instruction and enhance school 
productivity.
    We can think of these cloud data systems like a safety deposit 
box--your valuables are in a bank, but only you have the key and decide 
who gets access. For many data systems, the provider houses the data 
and provides data tools, but access is controlled by education 
administrators with the digital key.
    The result of advanced data management and analysis tools is the 
ability for school systems to better identify students at risk of 
failure, identify the lessons that best meet each and every student's 
unique needs, inform decision making, and enhance operations. The goal 
is to translate data into actionable information so we can be smarter 
as an educational system about how to meet the needs of each student 
based on understanding of what is most effective with students like me. 
We should want our students, families, and educators to have all the 
relevant information, while making sure it is used appropriately for 
educational purposes and that student data privacy is protected.
   ii. current framework of student privacy practices and protections
    Schools and service providers have a shared responsibility to 
safeguard the privacy and security of student information. One way they 
do this is by limiting the collection and uses of student personal 
information to legitimate educational purposes. They have policies and 
procedures in place to prevent unauthorized use.
    Federal law establishes a framework that restricts the collection 
and use of student information to what is necessary to accomplish 
legitimate educational purposes.
    The Family Educational Rights and Privacy Act (FERPA) requires 
that:
   personally identifiable information shared with service 
        providers be limited to uses otherwise performed by the 
        school's own employees,
   the provider be under direct control of the school, and
   the information can only be used for educational purposes.
    In addition, the Children's Online Privacy Protection Act (COPPA) 
requires consent for child-directed on-line and mobile collectors of 
personal information from children under the age of 13, both inside and 
outside of schools, and prohibits the use of information for behavioral 
advertising. COPPA requires the operator to provide the school with 
full notice of its collection, use, and disclosure practices.
    FERPA and COPPA require parental consent if the school shares 
personal student information with third parties for non-educational 
purposes. These laws also require parental consent if the operator 
wants to use or disclose the information for its own commercial 
purposes beyond those related to the provision of services to the 
school.
    In addition, the Protection of Pupil Rights Amendment (PPRA) 
requires parental notice and opportunity to opt out of activities 
involving the use of personal information collected from students for 
marketing and advertising purposes unrelated to the educational purpose 
for which it was collected.
    The U.S. Department of Education has provided some examples of how 
these rules work in practice to protect student privacy. In its 
recently-released guidance on protecting student privacy while using 
on-line educational services, the Department of Education advised that 
a service provider such as a provider of email service or cafeteria 
service is not permitted to use student information to target ads to 
students because this use does not ``constitute a legitimate 
educational interest.''
    Service providers are also bound by contract and are subject to 
significant penalties for unauthorized disclosure of personal student 
information, including a ban on providing services for up to 5 years. 
And there's a market incentive: If service providers do not live up to 
their responsibilities, they will lose the confidence of their 
customers.
    In short, school service providers do not have an independent role 
in the school system. They cannot just use personal student information 
as they see fit. School service providers collect personal student 
information only with the explicit approval of the schools and agencies 
that they work for. They use this information only for the purpose 
authorized by those educational institutions.
    SIIA recognizes questions and concerns raised by some parents, 
educators, and policy makers. SIIA agrees that the obligation to 
safeguard student data privacy and security means that continued review 
and enhancements are needed in the framework of our policies, 
practices, and technologies.
    Stakeholders are responding to recent questions and concerns:
   Service providers continuously review and improve data 
        policies, procedures, and technologies.
   SIIA has released industry ``Best Practices for the 
        Safeguarding of Student Information Privacy and Security for 
        Providers of School Services'' that address educational 
        purpose, transparency, school authorization, data security, and 
        data breach notification (http://bit.ly/SIIAstudentPrivacyBP).
   The Federal Government recently updated regulations and 
        guidance for FERPA and COPPA specific to on-line educational 
        services.
   The Consortium for School Networking (CoSN), representing 
        school CTOs, recently released a toolkit for protecting 
        privacy, ``Considerations When Choosing an Online Service 
        Provider for your School System.''
   School districts are instituting supplemental agreements 
        with their vendors that further specify restrictive data use, 
        security, and confidentiality terms.
   School districts and non-profits are developing criteria for 
        the review of apps, websites, and cloud-based software, and 
        sharing the criteria and review results.
    These policies and agreements enhance a framework of laws and 
practices that has been highly effective through the years in 
safeguarding student privacy and data security.
         iii. the need for federal student privacy legislation
    SIIA and our member companies agree with the need to review and 
improve public policies as needed. However, we do not think that new 
Federal legislation is needed at this time. The current legal framework 
and industry practices adequately protect student privacy. Moreover, 
new legislation creates substantial risks of harm to the innovative use 
of information that is essential to improving education for all 
students and ensuring U.S. economic strength in an increasingly 
competitive global environment. These risks include:
   New legislative requirements would not provide local 
        communities and school officials with sufficient flexibility, 
        and Government actions intended to create a privacy and 
        security floor would instead unintentionally create a digital 
        learning ceiling.
   Policies that are overly restrictive or make impractical 
        requirements would have a chilling effect on schools and 
        service providers that would stifle the emergence of 
        personalized learning environments and the effective use of 
        predictive analytics to improve student learning.
    SIIA agrees with the Obama administration's May 2014 report on data 
and privacy, which called for ``Responsible Educational Innovation in 
the Digital Age,'' including that ``Students and their families need 
robust protection against current and emerging harms, but they also 
deserve access to the learning advancements enabled by technology that 
promise to empower all students to reach their full potential.''
    Similarly, the Aspen Institute Task Force on Learning and the 
internet's recent report, ``Learner at the Center of a Networked 
World,'' cautions that ``Approaches to providing safety online that are 
defensive and fear-based are often ineffective and can have the 
unintended consequence of significantly restricting learning 
opportunities for young people.'' SIIA agrees with the Aspen Institute 
that technology ``can be part of the solution by helping create trusted 
environments.''
    SIIA recently issued ``Policy Guidelines for Building a Student 
Privacy Trust Framework'' (http://bit.ly/
SIIAStudentPrivacyPolicyGuidelines) that I ask be included in the 
record of the hearing.
    Finally, while this hearing is focused on student data privacy, I 
would be remiss without encouraging the committees to provide 
additional leadership, regulatory innovation, and investment needed to 
support the Nation's educational system in updating its teacher skills, 
infrastructure, and practices for the digital age.
    I would be happy to answer any questions you might have.

    Mr. Meehan. Thank you, Mr. MacCarthy.
    The Chairman now recognizes Ms. Popp for your opening 
comments.

STATEMENT OF JOYCE POPP, CHIEF INFORMATION OFFICER, IDAHO STATE 
                    DEPARTMENT OF EDUCATION

    Ms. Popp. Thank you, Chairman, Ranking Members, and 
committee Members for allowing me time to address you on the 
important issue of student data privacy. In education, all 
teachers should have access to meaningful data to support their 
instructional practices. We will continue our efforts, with the 
understanding the student-level data must be respected and 
protected, while also acknowledging that student information is 
a vital resource for teachers and school staff in their 
educational planning.
    In Idaho, we have been working diligently to find the 
proper balance of strong data security policies while also 
supporting the stakeholders. Data stewardship has been a 
talking point for quite some time, teaching and encouraging 
school district leaders to adopt equally as strong data 
collecting and management policies. I have been with the Idaho 
State Department of Education for 5 years. My background is 
largely in the private sector, working in senior management for 
several Fortune 500 companies, dealing with information systems 
and information technology areas where infrastructure, e-
commerce, data systems, and data security was a key focal 
point.
    Data usage and security of information in the private 
sector is of the utmost importance, just as it is in the 
educational world. Through this experience, I have a working 
knowledge of data systems, and how essential it is to protect 
student-level data and ensure student data privacy. We live in 
a world where cyber threats and a chance to breach data systems 
are preventive, and we must make every effort to protect this 
data, but also to be vigilant in our data use efforts. As we 
all understand, however, students' data security is not the 
same as data privacy.
    Idaho collects student-level data for reporting purposes, 
while also supporting State and Federal programs. We do not 
want to be collecting data for data's sake. However, we want to 
be collecting only data that is clearly needed to improve 
educational outcomes for the students of Idaho. We collect data 
at the student level, as all data must be repeatable, 
defensible, and auditable. All of the data elements that have 
been are currently being collected in Idaho have been published 
through our public website. We are constantly auditing and 
evaluating the data we collect and how we collect it to ensure 
that technology best practices are employed.
    Through this, we have improved our efforts in supporting 
teachers and school administrators with quality, timely data. 
For years, school districts and State agencies have diligently 
followed the guidelines of the Family Educational Rights and 
Privacy Act, which provides guidance on disclosure of 
personally-identifiable information from educational records. 
Educational stakeholders and their elected officials in Idaho 
continue their efforts to work together in order to ensure 
student data is protected. This is evidenced by the crafting of 
our Senate Bill 1372 during the 2014 legislative session, a 
student data privacy bill.
    The intent of Senate Bill 1372, known as the Student Data 
Accessibility, Transparency, and Accountability Act of 2014, is 
to ensure that student information is safeguarded and privacy 
is honored, respected, and protected, while also acknowledging 
that student information is a vital resource for teachers and 
school staff in their educational planning. The bill also 
includes language addressing a monetary penalty if anyone fails 
to protect the data and a breach of student-level data occurs 
or it is released without proper authorization.
    Policies have also been adopted to ensure that any 
contractors or vendors who receive student-level data for 
specific purposes do not use the data outside of the specified 
use that is clearly called out in the contracts. All contracts, 
in addition to data use, are required to have specific data 
destruction and proof of data destruction dates. In a review of 
a prior contractual agreement made with vendors that were up 
for renewal, Idaho became aware of verbiage that stated vendors 
owned the data that it was provided. This verbiage is no longer 
allowed in any of the Idaho State Department of Education 
contracts.
    Awareness is a key component to the adoption of this new 
law, and the district personnel have been notified and made 
aware of their responsibilities. The bill also calls for the 
Idaho State Board of Education to develop a model policy for 
school districts and public charter schools that will govern 
data collection, access, security, and use of such data. The 
model policy will be available this summer. We employee 
cybersecurity experts to constantly monitor and review 
processes and procedures, including the types of hardware and 
software programs purchased and deployed within our data 
center.
    Data privacy, however, is not as easily addressed. It is 
everyone's responsibility. To close, Idaho has and will 
continue to take the proper steps in implementing data security 
and policies to protect the student-level data. It is our 
responsibility to continually strive to adapt to the 
constantly-changing world of technology and cyber threats. 
Adequate is not enough when dealing with student data privacy. 
We will continue to better our systems and policies to ensure 
that student data privacy is not just a hope in Idaho, but it 
is a reality.
    Chairman, Ranking Members and committee Members, thank you 
again for this opportunity.
    [The prepared statement of Ms. Popp follows:]
                    Prepared Statement of Joyce Popp
                             June 25, 2014
    Thank you Chairmen, Ranking Members, and committees Members for 
allowing me time to address you on the important issue of student data 
privacy. It is truly an honor to have this opportunity to discuss 
Idaho's practices around collecting and protecting student data. In 
education, all teachers should have access to meaningful data to 
support their instructional practices; data that is collected is now 
available to all educators, both administration and teachers in Idaho 
to support them in making data driven decisions to impact student 
achievement. We will continue our efforts with the understanding that 
student-level data must be respected and protected while also 
acknowledging that student information is a vital resource for teachers 
and school staff in their educational planning. In Idaho, we have been 
working diligently to find the proper balance of strong data security 
policy while also supporting stakeholders. Data stewardship has been a 
talking point within the Idaho State Department of Education for quite 
some time, teaching and encouraging school districts leaders to adopt 
equally as strong data collecting and management policies. This process 
must not only happen at the State level, but also at the school 
district and down to the individual teacher level.
    I have been with the Idaho State Department of Education for 5 
years and in the capacity of Chief Information Officer for the past 
several years. My background is largely in the private sector, working 
in Senior Management for several Fortune 500 companies, dealing in the 
Information Systems and Information Technology area where 
infrastructure, eCommerce, data systems, and data security was a key 
focal point. Data usage and security of information in the private 
sector is of the upmost of importance just as it is in the education 
world. Through this experience I have a working knowledge of data 
systems and how essential it is to protect student-level data and 
ensure student data privacy. All companies in the private sector secure 
their customer's data and likewise, State and local educational 
institutions must make the same or greater efforts to protect student 
data. We live in a world where cyber threats and attempts to breach 
data systems are prevalent, and we must make every effort to protect 
this data but also to be vigilant in our data use efforts. As we all 
understand however, data security is not the same as data privacy.
    Idaho collects student-level data for reporting purposes while also 
supporting State and Federal programs. We do not want to be collecting 
data for data sake, however we want to be collecting only data that is 
clearly needed to improve educational outcomes for the students of 
Idaho. Currently, the State of Idaho collects attendance data for each 
day or portion of a day a student is in class as this is used for 
funding purposes and program participation; yet the State does not 
collect a specific reason for an absence as this is currently not a 
data element necessary for program or funding calculations. We collect 
data at the student level as all data must be repeatable, defensible, 
and auditable. All of the data elements that have been, and that are 
currently being collected have been published on the public website and 
made available for district personnel and patrons. Along with this 
information our department publishes why we collect this data, down to 
each individual data element. Over the past 4 years we have been 
receiving data from our school districts via secure measures. We are 
constantly auditing and evaluating the data we collect, and how we 
collect it to ensure that technology best practices are employed. 
Through this refinement process, we have improved our efforts in 
supporting teachers and school administrators with quality, timely 
data. Also in this process, we worked with our Idaho legislators and 
other stakeholders to create a piece of legislation that ensures that 
our educational institutions not only have the policies and protocols 
to ensure data security but also data privacy. Included in the 
legislation, individuals are held accountable for improper handling and 
use of student-level data.
    For years, school districts and State agencies have diligently 
followed the guidelines of the Family Educational Rights and Privacy 
Act (FERPA) which provides guidance on disclosure of Personally 
Identifiable Information (PII) from educational records. Not only has 
Idaho followed these guidelines, but we have taken a conservative 
approach in the interpretation of FERPA to safeguard student-level 
data. Educational stakeholders and their elected officials in Idaho 
continue their efforts to work together in order to ensure student data 
is protected. This is evident by the crafting of Senate Bill 1372 
during the 2014 legislative session, a student data privacy bill. Idaho 
utilized information and recommendations put out by the Privacy 
Technical Assistance Center (PTAC) through the U.S. Department of 
Education. As stated within the Data Governance and Stewardship 
document provided by PTAC, ``successful data management requires a 
proactive approach to addressing stakeholders' needs for high-quality 
data, while protecting the privacy of individual respondents.''
    The intent of Senate Bill 1372, known as the Student Data 
Accessibility, Transparency, and Accountability Act of 2014, is to 
ensure that student information is safeguarded and that privacy is 
honored, respected, and protected while also acknowledging that student 
information is a vital resource for teachers and school staff in their 
educational planning. This bill also provides specific definitions and 
guidelines authorizing access to student data systems and to individual 
student data, hence our continued focus on data stewardship. The bill 
also includes language addressing a penalty not to exceed $50,000 if 
anyone within the agencies, districts, or public charters fail to 
protect the data and a breach of student level data occurs or is 
released without proper authorization. In addition to addressing use, 
protection and breaches of data, each public school district or charter 
school is required to adopt data protection and privacy policies and 
guidelines. Awareness is a key component to the adoption of this new 
law, and district personnel have been notified and made aware of this 
responsibility. Presentations are being conducted around the State to 
emphasize the details and importance of the new law.
    We are also aware that not all school districts have the capacity 
to write data security policy; in knowing this, the bill also calls for 
the Idaho State Board of Education to develop a model policy for school 
districts and public charter schools that will govern data collection, 
access, security, and use of such data. The Idaho State Board of 
Education is currently working on the model policy and will have it 
available for all school districts and public charters this summer.
    I have made a concerted effort to provide awareness meetings to all 
staff within the Idaho State Department of Education. In these meetings 
I discuss the intent of Senate Bill 1372, and the level of 
accountability, roles, and liabilities that State employees will be 
required to adopt as well as our obligation to educate our districts 
and schools of their responsibilities. Divisions within the agency 
handle different types of data; however an example that has been used 
is Child Nutrition Programs. The United States Department of 
Agriculture (USDA) requires a specific ``need to know'' basis to access 
free and reduced price meal eligibility information. Under the rule of 
the USDA, State agencies, districts, and public charters must ensure 
that data systems, records, and other means of accessing a student's 
eligibility status are limited. The ``need to know'' thought process is 
being adopted by the Idaho State Department of Education for all 
employees who handle or might have access to student-level data.
    As Idaho has many rural and even remote school districts, we also 
take into consideration the population size whenever aggregating data. 
We have methods to mask small cell size and ensure that data is not 
personally identifiable even when aggregated.
    Along with this thought process is also gaining the knowledge of 
proper transfer of student-level data. For example, we have adopted 
policies for data governance that prohibits student-level data being 
passed by email. Employees and districts have received training on 
encryption and other methods of data privacy and security. Sensitive 
information is more properly transferred using password and data 
encryption, through a Secure File Transfer Protocol (SFTP), again on a 
``need to know'' basis. Policies have also been adopted to ensure that 
any contractors or vendors who receive student-level data for specific 
purposes do not use the data outside of the specified use clearly 
called out in the contract. All contracts, in addition to data use, are 
required to have specific data destruction and proof of data 
destruction dates. In a review of prior contractual agreements made 
with vendors that were up for renewal, Idaho became aware of verbiage 
which stated the vendor ``owned'' the data it was provided. This 
verbiage is no longer allowed on Idaho State Department of Education 
contracts and as previously stated we require proof of destruction and 
the associated dates of the destruction.
    The Idaho State Department of Education receives many public 
records requests and researcher requests to supply student-level data. 
Idaho has put together policies which provide the ability to decline 
all such requests for student-level data. To the individual making the 
public records request, only aggregate data will be made available. 
This means data collected or reported at the group, cohort of 
institutional level only and will not include any Personally 
Identifiable Information once again taking into consideration small 
cell sizes within the aggregate data.
    Idaho Department of Education has hired cybersecurity experts to 
constantly monitor and review processes and procedures, including the 
types of hardware and software programs purchased and deployed within 
our data center. Data privacy however is not as easily addressed, as it 
is everyone's responsibility.
    To close, Idaho has and will continue to take the proper steps in 
implementing data security and policies to protect student-level data. 
It is our responsibility to continually strive to adapt to the 
constantly-changing world of technology and cyber threats; adequate is 
not enough when dealing with student data privacy. We will continue to 
better our systems and policies to ensure that student data privacy is 
not a hope in the State of Idaho, but a reality.
    Chairmen, Ranking Members, and committees Members, again thank you 
for this opportunity and I would stand for any questions you may have.

    Mr. Meehan. Thank you, Ms. Popp.
    The Chairman now recognizes Mr. Murray for your opening 
comments.

   STATEMENT OF THOMAS C. MURRAY, STATE AND DISTRICT DIGITAL 
 LEARNING POLICY AND ADVOCACY DIRECTOR, ALLIANCE FOR EXCELLENT 
                           EDUCATION

    Mr. Murray. Thank you, Mr. Chairman. I began this morning 
with a call from a school principal asking if I was nervous to 
testify in front of Congress. I said, ``Sir, when you have 
stood in front of a thousand middle school students that are 
completely hormonal, that is pressure.''
    Thank you for having me.
    Chairman Meehan, Chairman Rokita and Ranking Member Clarke, 
Ranking Member Loebsack and Members of the subcommittees, it is 
an honor to testify before you today. My goal is to illustrate 
how student data can be used effectively to strengthen student 
achievement and personalize the learning for each individual 
student, while simultaneously maintaining high levels of 
student privacy. Although I am now a State and district digital 
learning director at the Alliance for Excellent Education, I 
come to you first and foremost as an educator.
    I have spent my life serving children, first as an 
elementary and middle school classroom teacher, then as a 
middle school assistant principal, an elementary principal and, 
most recently, as the director of technology and cyber 
education in the Quakertown Community School District, located 
in Bucks County, Pennsylvania. In each of these roles, I have 
balanced the use of data and its tie to student achievement, 
while ensuring privacy on a daily basis. Although I could share 
countless stories of how data-driven decision making has 
forever changed the lives of students, I will take a moment to 
just give one example.
    I knew Susan, whose name has been changed for protection, 
as a fourth grader. Susan had struggled tremendously in her 
previous school and never had much support at home. Dad left 
early, and Mom struggled to get by. It was evident that at home 
her education was never a priority. Having bounced from school 
to school, she had little consistency and rarely had the home 
support needed to be successful, always playing catch-up, with 
skills sometimes years behind. Life was dealing her a tough 
hand.
    During her first few weeks in my classroom, we were able to 
collect a tremendous amount of data on levels of performance. 
For example, we looked at the various aspects of her reading, 
from fluency to comprehension. We found that Susan struggled 
with accurate and fluent word recognition, and often originates 
with the weaknesses in recognizing patterns of speech. It was 
through data collection and analysis that we were able to come 
to the conclusion of her exact reading needs. Based on Susan's 
specific needs, we were able to develop a personalized plan for 
success.
    For example, we utilized a multifaceted approach that was 
digital in nature. These various software programs were 
overseen by, and used in connection with, dynamic instruction 
from her well-trained teacher. Over time, her achievement was 
tracked and personalized, her plan modified. Year-over-year, 
her performance steadily improved and she was ultimately able 
to cross the stage at graduation not only receiving, but truly 
earning, her high school diploma.
    As an educator who has witnessed a myriad of stories just 
like Susan's, I know that her success is attributed to the 
data-driven personalized education that she received. There are 
countless students like Susan sitting in virtually every one of 
our Nation's classrooms. It is critical that we understand the 
Nation's context for today's hearing. In many ways, the 
effective use of data is not just an educational strategy, it 
is an economic strategy.
    By 2018, two-thirds of the Nation's jobs will require at 
least some post-secondary education, and estimates indicate 
that the Nation will be 3 million college degrees short because 
too few students graduate from high school on time and prepared 
for post-secondary education.
    Our students need and deserve an effective, world-class 
education to be competitive in a global economy. In the 21st 
Century, that means using data and technology effectively in 
the classroom. Just like doctors evaluate your medical history, 
current condition, and records from other physicians to 
diagnose, care, and treat patients, teachers and administrators 
need access to data in order to best personalize the learning 
for each student. Today, the alliance released a paper that I 
have submitted for the record describing how this is happening 
across the country.
    In Quakertown, I was able to witness first-hand the power 
of data, and saw our graduation rates increase 10 percentage 
points over a 2-year period. Data is used at all levels to 
support student success. Teachers collect and analyze data on a 
regular basis to inform their instruction, whether it is data 
on reading comprehension, fluency, or math facts, teachers 
collect, organize, and analyze data in order to personalize 
instruction for each student. At the building level, I use this 
information as a principle to analyze trends in curriculum, 
strengths, and weaknesses in our academic program, and teacher 
effectiveness.
    Tracking this data at the building level allowed me to 
properly allocate resources and modify schedules, from reading 
specialists and special ed support to a systemic response to 
intervention model. At the district level, our leadership team 
would analyze district-wide trends to make sure--make decisions 
about curriculum renewal, standardize assessments, professional 
learning, budgets, and more.
    As the director of technology in Quakertown, it was my 
team's job to oversee the security of such data. Like other 
districts, we utilized the necessary firewall, security 
certificates, and other limitations of access to ensure that 
only those people with the need to know had the needed 
information.
    For instance, only two people in the district would have 
access to the student information: Me, and the data specialist 
who would work alongside the Pennsylvania State reporting 
system. Teachers were only able to see information that was 
legally permissible for students who they taught, and they each 
signed a confidentiality agreement each year. We ensured 
compliance with SIPA as well as FERPA. For example, we utilized 
128-byte encryption for instances of data transfer outside our 
own firewall, the same level of security used in on-line 
banking.
    Educators across this country demonstrate every day that 
they know how to use this data responsibly. I offer several 
recommendations in my written testimony and, in closing, would 
like to highlight two of them. First, educators need support in 
how to effectively use data to improve instruction, while 
protecting sensitive student data. Funds from Title II of the 
Elementary and Secondary Education Act should be utilized for 
this purpose.
    My second recommendation is a simple request for caution as 
you explore policy in this area. Privacy concerns are real. At 
the same time, education in the 21st Century must take 
advantage of all that technology has to offer. This precise 
sentiment was expressed yesterday in a bipartisan op-ed by two 
of your colleagues on the committee, Representatives Polis and 
Messer, in which they eloquently stated security and privacy 
are critical, yet manageable, concerns.
    We must not dismiss the power of using data to improve 
classroom instruction. Simply develop best practices to ensure 
that data is used responsibly. We must not let fear of data 
prevent us from realizing the promise of technology. The 
Nation's students, their parents, and our economy deserve 
nothing less.
    Thank you for the opportunity to share a school and 
district perspective on this important matter.
    [The prepared statement of Mr. Murray follows:]
                 Prepared Statement of Thomas C. Murray
                             June 25, 2014
                              introduction
    Chairman Meehan, Chairman Rokita, Ranking Member Clarke, Ranking 
Member Loebsack, and Members of the U.S. House of Representatives 
Subcommittee on Cybersecurity, Infrastructure Protection, and Security 
Technologies and the Subcommittee on Early Childhood, Elementary, and 
Secondary Education: It is an honor to testify before you today to 
discuss the critical role that the effective and safe use of data can 
play in supporting success among America's students.
    My goal today is to illustrate how student data can be used 
effectively to strengthen student achievement and personalize the 
learning for each individual student while simultaneously maintaining 
high levels of student privacy.
    Today, I come to you first and foremost as an educator. I've spent 
my life serving children, first as an elementary and middle school 
classroom teacher, then as a middle school assistant principal, an 
elementary principal, and most recently as the director of technology 
and cyber education in the rural Quakertown Community School District 
located in upper Bucks County, Pennsylvania. In each of these roles, I 
balanced the use of data and its tie to student achievement, while 
ensuring privacy on a daily basis.
    I am now pleased to serve as the State and district digital 
learning director at the Alliance for Excellent Education. The Alliance 
is a Washington, DC-based National policy and advocacy organization 
dedicated to ensuring that all students, particularly those 
traditionally underserved, graduate from high school ready for success 
in college, work, and citizenship. The Alliance focuses on America's 6 
million most-at-risk secondary school students--those in the lowest 
achievement quartile--who are most likely to leave school without a 
diploma or to graduate unprepared for a productive future. The 
Alliance's mission is to promote high school transformation to make it 
possible for every child to graduate prepared for success in life.
    A chief part of the Alliance's mission is using technology and 
digital learning to provide innovative and effective ways to ensure 
that all students--especially those most at risk and disadvantaged--
graduate from high school prepared for success.
    The Alliance held the first National Digital Learning Day in 2012, 
an annual celebration with participation from more than 26,000 teachers 
and millions of students from every State in the Nation. In 2013, the 
Alliance announced Project 24, a new effort to assist school districts 
in developing a plan to use technology and high-quality digital 
learning, including the collection of proper and secure student 
learning data, to help drive new twenty-first-century student-centered 
instruction models leading to improved college and career readiness for 
all students. Currently, 1,300 school districts are participating in 
some way.
    Although I could stand before you and share countless stories of 
how data-driven decision making--both in the classroom by teachers and 
at the district level by school administrators--has forever changed the 
lives of students, I'll take a moment to give just one example.
    I knew Susan (name has been changed for protection) as a fourth 
grader. When I met her she was 9. Susan had struggled tremendously in 
her previous school and never had much support at home. Having bounced 
from school to school, she had little consistency and rarely had the 
home support needed to be successful. Life was dealing her a tough 
hand.
    During her first few weeks in my classroom, we were able to collect 
a tremendous amount of data on her levels of performance. For example, 
we looked at the various aspects of her reading, from fluency to 
comprehension, etc. Based on Susan's exact needs, and due to the large 
amounts of data we were able to collect, we were able to develop a 
personalized plan to meet her needs. Over time, I watched as these 
interventions, implemented based on data-driven decisions, helped to 
build her confidence, and ultimately her academic skill level. As Susan 
moved through other data-based, personalized instructional 
environments, she was able close the achievement gap, and ultimately 
cross the stage at graduation, receiving her high school diploma. As an 
educator who has witnessed myriad stories like Susan, it is without a 
shadow of a doubt that I know that her success is attributed to her 
teachers and schools being able to utilize a vast amount of real-time 
data to develop personalized instruction to meet her needs. There are 
countless students just like Susan, sitting in virtually every one of 
our Nation's classrooms.
                       need for education reform
    In order for the United States to sustain its position as the 
world's leading economic power, its system of education must be rapidly 
and dramatically improved. By 2018, two-thirds of the Nation's jobs 
will require at least some post-secondary education, and estimates 
indicate that the Nation will be 3 million college degrees short.\1\ 
Approximately 30 percent of African American and Hispanic students do 
not graduate on time, if at all,\2\ and 20 percent of students who do 
make it to college need at least one remedial course,\3\ meaning that 
they are paying college prices for the high school education they 
should have already received.
---------------------------------------------------------------------------
    \1\ A. Carnevale, N. Smith, J. Strohl, Help Wanted: Projections of 
Jobs and Education Requirements Through 2018 (Washington, DC: 
Georgetown University Center on Education and the Workforce, 2010).
    \2\ R. Stillwell and J. Sabel: Public High School Four-Year On-Time 
Graduation Rates and Event Dropout Rates: School Years 2010-11 and 
2011-12 (First Look) (NCES 2014-391) (Washington, DC: U.S. Department 
of Education, National Center for Education Statistics, 2014).
    \3\ D. Sparks and N. Malkus, Statistics in Brief: First-Year 
Undergraduate Remedial Coursetaking: 1999-2000, 2003-04, 2007-08 (NCES 
2013-013) (Washington, DC: U.S. Department of Education, National 
Center for Education Statistics, 2013), http://nces.ed.gov/pubs2013/
2013013.pdf (accessed February 11, 2014).
---------------------------------------------------------------------------
    This poor preparation is taking place at a time when the economic 
demand for a highly educated workforce has never been greater. Over the 
past 40 years, the percentage of jobs requiring post-secondary 
education has doubled (from 28 percent to 59 percent).\4\ The demands 
of the knowledge-driven economy are far outpacing the production of 
students who are prepared for the workforce. To respond to this rapidly 
rising demand for a higher-skilled workforce, every State has raised 
its academic standards to require that every student graduate from high 
school ready for college and a career.
---------------------------------------------------------------------------
    \4\ A. Carnevale et al., Help Wanted.
---------------------------------------------------------------------------
    While States are working to strengthen education in order to meet 
the demand for a highly-educated workforce, the Nation's demographics 
are rapidly changing. Students of color make up more than half of the 
K-12 population in 12 States and comprise between 40 and 50 percent of 
the student population in an additional 10 States.\5\ The Nation's 
fastest-growing student populations are those that the traditional 
education system is least equipped to serve.
---------------------------------------------------------------------------
    \5\  W. DeBaun, Inseparable Imperatives: Equity in Education and 
the Future of the American Economy (Washington, DC: Alliance for 
Excellent Education, 2012).
---------------------------------------------------------------------------
    This seismic tremor in education means that the Nation must provide 
a higher-quality educational experience to more students than it ever 
has before. Only the effective use of data and technology supporting 
teachers will accomplish this major objective.
         effective use of data is critical to education reform
    Data can be a powerful tool for personalizing learning for each 
student and increasing achievement in the highest-need schools. Just 
like doctors evaluate your medical history, current condition, and 
records from other physicians to diagnose, care, and treat patients, 
teachers, and administrators need access to data in order to best 
personalize learning for each student, for they too are assessing, 
diagnosing, and treating the various needs of our Nation's students.
    Today, the Alliance released a paper--Capacity Enablers and 
Barriers for Learning Analytics: Implications for Policy and Practice--
that describes how learning analytics initiatives are helping States 
and districts move from being data collectors to data analyzers.\6\ The 
full paper is included in my complete testimony submitted for the 
record. Learning analytics applies techniques from science, sociology, 
psychology, and statistics to analyze student information. It enables 
the effective use of data to improve instruction in meaningful ways, 
such as those that adapt instructional content, intervene with at-risk 
students, and provide feedback.
---------------------------------------------------------------------------
    \6\ M.A. Wolf, R. Jones, R. Wise, Capacity Enablers and Barriers 
for Learning Analytics: Implications for Policy and Practice 
(Washington, DC: Alliance for Excellent Education, 2014).
---------------------------------------------------------------------------
    When student data is collected properly and used effectively, it 
can be an integral part of personalizing instruction to improve 
learning. Data can guide digital learning to target instruction. It can 
provide real-time feedback on student progress that allows teachers to 
tailor instruction, resources, and time.
    Throughout my time in Quakertown, I was able to witness this first-
hand. As the district implemented a personalized approach to 
instruction, with decisions predicated on data-driven decision making, 
we were able to create an environment where student learning and growth 
was at the forefront. Through this technology-infused, data-driven 
environment, we saw high school graduation rates increase 10 percentage 
points over a 2-year period. Upon my recent departure from the 
district, we had more students taking rigorous courses than ever 
before, the State standardized test scores were the highest they've 
ever been, and results on tests such as the SAT showed significant 
growth over time.
    Our Nation, schools, and leaders must be careful not to let fear of 
data thwart progress toward the best learning strategies for all 
students. At the same time, teachers, principals, and district and 
State leaders must be mindful and purposeful about the appropriate 
collection and use of data. Overly restricting data because of the 
fears of some will be devastating to modern, innovative teaching 
practices. There must be support for policies that effectively address 
privacy, safety, and security concerns related to digital learning and 
other ways that data is stored including antiquated paper file storage. 
In doing so, it is important to differentiate between real and 
perceived threats so that we can take advantage of the real potential 
to improve learning outcomes for students through the proper use of 
data.
    Pulling from my 14 years of school district service, I'd like to 
share a few examples of how the use of data transforms and personalizes 
instruction for students and how school districts use data to 
systemically plan and problem solve to meet the needs of their student 
population.
    Having been a classroom teacher for 6 years, and supervising 
classrooms for 5 years as a principal thereafter, data played and 
continues to play a vital role in the daily instructional process. 
Teachers collect and analyze data on a regular basis to inform their 
instruction. Whether it's specific data regarding reading levels, 
comprehension, fluency, math facts, or information surrounding a 
specific academic standard, teachers collect, organize, and analyze 
data in order to personalize instruction for each student. Without such 
collection, teachers would lose the ability to pinpoint the exact needs 
of each child and would lose the ability to treat each need with 
precision. Best practices indicate that meeting each student where they 
are will push them to their highest levels of achievement. But this is 
only feasible through personalized learning and instruction, which can 
only occur when up-to-date data is readily available so that teachers 
can make real-time instructional decisions, allowing them to put their 
students' needs at the heart of teaching and learning.
    At the building level--and as both a middle school and elementary 
principal--this data was used to analyze grade levels, trends in 
curriculum, strengths, and weaknesses in our academic program, and 
grade level and teacher effectiveness. Tracking this data on a large 
scale at the building level allowed me to properly allocate resources, 
from reading specialists and special education support, to a systemic 
response to intervention model. On a weekly basis, Quakertown's teacher 
and specialists would meet in data teams to discuss every child and 
what we could do better or differently to meet their individual needs--
both for those needing additional support and those who needed high 
levels of enrichment. We would then use this information to design 
schedules for support and intervention for all students, both at the 
classroom and building levels.
    As I moved to Quakertown's district office, the ability to collect, 
analyze, and dissect student data on a large scale was even more 
important. At the highest levels, our leadership team would analyze 
district-wide trends, which allowed us to identify and plan for needs 
moving forward. These areas of need would help us formulate district 
goals, and over the long term, strategic plans. Without objective 
academic data on the large scale, the ability to make district-wide 
decisions about curriculum renewal, standardized assessments, 
professional learning, budget, etc. would be jeopardized.
    As it relates to special education, very specific achievement data 
would be used to build an Individualized Education Program (IEP) for 
each child, as required under the Individuals with Disabilities 
Education Act. These goals would then be measured throughout the course 
of each year and revised on a year-over-year basis to chart growth and 
achievement and ensure that our Nation's students with disabilities 
receive both what they need and deserve.
    As both a principal and cabinet-level member at the district 
office, part of my role was to ensure high-quality teaching in the 
classroom, which was monitored through the teacher supervision process. 
As such, supervisors had access to student data and were able to 
longitudinally track performance of teacher effectiveness over time. In 
order to prepare students for their tomorrow, there must be high-
quality teachers in the classroom today; and being able to objectively 
assess effectiveness, over time, is imperative.
    As the director of technology at Quakertown, it was my team's job 
to oversee the security of such data, including data stored in our data 
warehouse and student information system. Like other districts, we 
utilized the necessary firewalls, security certificates, and 
limitations on access to ensure that only those people with a need to 
know had the needed information. For instance, only two people in the 
district would have access to all student information; me and the data 
specialist who would work on the district's Pennsylvania State 
Reporting System. Teachers were only able to see information that was 
legally permissible for students who they taught, and principals and 
specialists would be granted access to their building-level data. This 
information was treated with the highest levels of security and 
accountability, even going as far as having every staff member sign a 
confidentiality agreement, every year, which clearly delineates the 
expectations of how they were to handle the student data to which they 
had access.
    On the educational technology front, the Quakertown district would 
partner with various companies on tools and resources from on-line 
registration, ranging from our student information system and gradebook 
to various assessment and testing tools. For each company, we'd work to 
ensure compliance with the Family Educational Rights and Privacy Act 
(FERPA), and with instances of data transfer--such as that of on-line 
registration--there was a 128-bit encryption in place, the same level 
of security used in on-line banking. When it came to various web tools, 
we'd work to ensure compliance with the Children's Internet Protection 
Act, paying special attention and giving extra precautions to those 
students under 13 years of age. It was the district's legal obligation 
to ensure that the highest levels of security for this data were in 
place, and something that was always at the top of our priority list.
                       other examples of success
    In my role at the Alliance, I have seen States and districts across 
the country using data effectively. In Kentucky, for example, K-12 and 
post-secondary data is linked in order to provide feedback reports to 
high schools on matters such as college readiness and ACT scores. This 
data can be used to reduce the large number of students who need 
remediation when they leave high school. In Oregon, professional 
development on instructional strategies is paired with technical 
training so that educators can use data regularly to improve 
instruction.
    A particularly powerful example of the effective use of data comes 
from Chicago Public Schools (CPS), the Nation's third-largest school 
district. In 2007, CPS initiated a reform to utilize data in order to 
prevent students from dropping out. Evidence shows that students who 
end their 9th-grade year on track to graduation are almost 4 times more 
likely to graduate from high school than those who are off-track. 
Therefore, CPS promoted the use of data to monitor students' 
performance, help teachers intervene before students fell too far 
behind, and implement a variety of interventions to address the 
specific needs facing students as identified by the data. At the center 
of this effort were monthly data reports given to each high school that 
allowed educators to respond when students were heading in the wrong 
direction.
    As a result of this effort to effectively use data to keep students 
in school, the percentage of 9th-grade students who are on-track to 
graduation has risen 25 points, from 57 to 82 percent, and graduation 
rates have increased 13 percentage points.\7\
---------------------------------------------------------------------------
    \7\ M. Roderick, T. Kelley-Kemple, D. Johnson, and N. Beechum, 
Preventable Failure: Improvements in Long-Term Outcomes When High 
Schools Focused on Ninth Grade Year: Research Summary (Chicago: 
University of Chicago Consortium on Chicago School Research, 2014), 
https://ccsr.uchicago.edu/sites/default/files/publications/On-
Track%20Validation%20RS.pdf (accessed June 23, 2014).
---------------------------------------------------------------------------
                            recommendations
    Whether in rural Quakertown, or urban Chicago, the power of data to 
improve student achievement is real. Data can and must be used 
responsibly, and educators across the country demonstrate every day 
that they are able to effectively use student data while maintaining 
student privacy. On behalf of the Alliance for Excellent Education, I 
offer recommendations for your consideration in order to improve the 
ability of our Nation's teachers and schools to use data to strengthen 
student achievement.
    (1) Professional development.--Educators need support in how to 
        effectively use data to improve instruction while protecting 
        sensitive student data. Funds from Title II of the Elementary 
        and Secondary Education Act should be utilized for this 
        purpose.
    (2) Early warning indicator and intervention systems.--Schools and 
        districts across the country are implementing early warning 
        indicator and intervention systems in order to identify 
        struggling students and provide support that is tailored to 
        their individual needs. There are many ways in which Federal 
        policy can support the implementation of early warning 
        indicator and intervention systems, including requiring them as 
        a component of Federal School Improvement Grant program.
    (3) Data transparency.--Parents and the public must know what data 
        is being used to support students, and they must be given 
        access to this information.
     It is imperative that the public, and parents in 
            particular, know what student data is being collected and 
            why. States and school districts should each provide 
            readily and publicly accessible information on the types of 
            individual student data they maintain and how it is 
            collected and used, who has access to protected data, and 
            what safeguards are in place to protect it. School 
            districts must ensure that their individual schools are 
            meeting the district requirements.
     The Family Educational Rights and Privacy Act, or FERPA, 
            currently gives parents and eligible students aged 18 or 
            older access to their education records. Following the 
            example set in health care through the Health Insurance 
            Portability and Accountability Act, or HIPAA, access should 
            be expanded so that data is also available for parents and 
            eligible students in an electronic and cost-efficient 
            format. School districts should explore creating encrypted 
            and password-protected websites to make this information 
            readily accessible to parents and eligible students in a 
            safe and protected manner while protecting it from exposure 
            to unauthorized individuals.
    (4) Data protection.--Strong policies and plans are vital in data 
        collection to safeguard privacy. States, districts, and schools 
        must have a data protection infrastructure to ensure that 
        personally identifiable student data is protected. States 
        should designate a chief privacy officer who is responsible and 
        held accountable for the implementation of sound privacy 
        policy. Duties would include monitoring data collection 
        practices, insuring compliance with Federal and State laws, 
        overseeing a data security compliance plan and emergency data 
        breach response plan, and tracking the latest technological 
        improvements and best practices in data collection and privacy. 
        Districts should designate a single point of contact who 
        focuses on privacy issues. Some districts may consider 
        exploring whether they should designate a district chief 
        privacy officer depending on their size, individual needs, and 
        cost feasibility of implementation.
    (5) Policy for learning in the 21st Century.--Privacy protection 
        policies must be updated and modernized to ensure student 
        privacy is protected. Simultaneously, legislative bodies must 
        be cautious to avoid creating policies that hinder learning. 
        Education in the 21st Century must take advantage of all that 
        technology has to offer, recognizing that learning takes place 
        in and outside of the classroom. To this end, the bipartisan 
        Aspen Institute Task Force on Learning and the Internet 
        recently issued the report Learning at the Center of a 
        Networked World, which offers recommendations for policymakers 
        at all levels for consideration and action.\8\
---------------------------------------------------------------------------
    \8\ Aspen Institute Task Force on Learning and the Internet, 
Learning at the Center of a Networked World (Washington, DC: Author, 
2014), http://aspeninstitute.fsmdev.com/documents/
AspenReportFinalPagesRev.pdf (accessed June 23, 2014).
---------------------------------------------------------------------------
                               conclusion
    There is a difference between rhetoric and reality. Privacy 
concerns are real, and school leaders and policy makers must continue 
to deal with these very real concerns systemically and transparently. 
At the same time, it is imperative that this policy debate serves as a 
mechanism for spurring innovation, rather than stifling it. The U.S. 
Congress and State legislative bodies should explore modernizing 
privacy protection through proactive laws that encourage data use while 
protecting it to better reflect today's world, thus avoiding sudden 
reactionary policies that create unnecessary and undue constraints on 
learning. The Nation's students, their parents, and its economy deserve 
nothing less.

    Mr. Meehan. Thank you, Mr. Murray. I thank all of our 
panelists for their opening comments. and before I recognize 
myself for questions, I would like to ask unanimous consent to 
enter in the record the Fordham Law School report on privacy 
and cloud computing in public schools, authored by Mr. Joel 
Reidenberg.
    Mr. Meehan. Without objection, so ordered.*
---------------------------------------------------------------------------
    * The information has been retained in committee files.
---------------------------------------------------------------------------
    Mr. Meehan. I now recognize myself for opening questions. 
Mr. Reidenberg, let me begin with you. I think we all 
appreciate the points so eloquently made by Mr. Murray in his 
commentary about the opportunities for individualized education 
that can now be realized by virtue of technology. Nobody wants 
to try to inhibit that personalized development. But I brought 
with me here the perspective of us dealing with issues like the 
NSA, and simple concern on the part of American people because 
the Government was aware of who you called, what telephone 
number was called by another telephone number.
    As I began to look at this issue, I appreciated that the 
courts themselves have determined things like homework 
assignments or other kinds of in-class work which is now 
available for exactly that personalized information. Every 
keystroke may be being recorded. So you are learning a vast 
amount about that student's analysis and ability to deal with 
an issue. But we are also gathering that forever. The concern 
is that that information, you are seeing 95 percent of it. Or 
big percentages of it are no longer being held within the 
school itself, oftentimes going off somewhere in the cloud and 
becoming the property of third-party vendors.
    This is where the rubber meets the road for me, in my 
concern about this issue. How much not just private 
information, but like a health care record. There is some 
party--third-party vendor, I don't even know who it is--they 
know a lot more about my child than I know. Worse yet, is there 
the possibility that information lives otherwise? So a point 
that was made by one of the panelists that identifies a 
learning disability or difficulty that somebody may have. 
Suppose that information continues and gets purchased or sold 
by the very same company that many want to hire somebody some 
day.
    So where are the gaps and where are the limitations on the 
utilization of this very personal, private information that 
gets moved into a public sector ownership? Then how do we 
contain it so that it doesn't get abused?
    Mr. Reidenberg. Mr. Chairman, I think you have put your 
finger on the precise problem that we are facing today. It 
isn't just the parents who don't know where the information is, 
it is also the schools. In our research, the irony of that 95 
percent statistic, we know that the school that reported they 
didn't outsource to the cloud actually does. We learned that 
after we completed the students. So if we take a school 
districts that responded, it turns out it is, in fact, 100 
percent, not 95. We found, in asking school districts what they 
were doing in calls to school districts, it was very difficult 
to find anyone on the staff who even knew what kinds of 
outsourcing arrangements they had.
    When we look at how FERPA applies to this, FERPA is a 
funding statute. FERPA conditions the receipt of Federal funds 
by educational agencies to those agencies adhering--it is 
essentially confidentiality. It exempts out, though, a 
substantial amount of information, directory information, which 
includes a student's age, height, weight. It is exempted, it is 
not covered by the confidentiality unless the families opt out. 
So it is a very complex statute. But it was designed 
essentially as a hook on Federal financing.
    It doesn't apply directly to any of these third parties. 
The third parties can get data from school districts under, in 
this context, the school official exception, which is an 
exception essentially written into the statute by the 
Department of Education. It is not spelled out, in fact, in the 
statute. It is not challengeable. The court challenges to 
recent Department of Education regulations were thrown out on 
standing issues. Families who feel that they have been 
aggrieved have no remedies because the Supreme Court has ruled 
there are no private rights of action in the context of FERPA.
    The Department of Education, in the 40-year history, has 
never issued any sanction to a school district for violating 
FERPA. So if you look at the statute itself, even for what it 
covers it has some shortcomings that are quite significant. But 
in this context, what is so hard is that the kinds of 
outsourcing that take place are so complex that it is very 
difficult, as you pointed out in your question--it is very 
difficult to figure out exactly what is going on with this use 
of information and where to put the control.
    I don't think it is the vendors' own data in a true 
property sense. What we find is, it is transferred pursuant to 
some sort of contract. That contract can spell out what the 
vendors' usage rights are. We don't see those contracts 
actually spelling out that the district truly controls the 
data, their kids' data. There are school districts all across 
the country, so there could be multiple different forms of 
contracts all across the country. Well, you touched an awful 
lot.
    My time has expired. I know we will get into it. Mr. 
MacCarthy, I will ask it, I hope, in the context if we do not 
get a chance for you to speak to some of those very same 
issues, then I will come back to you and ask you some of those 
questions. But I think my colleagues will get to a lot of that 
as we move forward.
    So at this point in time, I turn it over to Ranking Member 
for her questioning. Thank you.
    Ms. Clarke. Thank you, Mr. Chairman. I thank our panelists 
for lending their expertise to this very important subject 
matter today.
    One of the issues that sort of dawned on me as I heard you 
discuss this was just the level of complexity and the myriad of 
circumstances under which data breaches actually occur. There 
are a whole host of bad actors out there seizing opportunities 
to assume identifies through identity theft. It just begs the 
question as to whether you have observed sort-of systemic 
protocols that are in place for reporting data breaches. Most 
companies, you know, they are looking to assert their brand as 
the best brand. It is somewhat, you know, scary for them and 
their bottom line to have to admit any vulnerability within 
their systems, the systems that they are trying to sell that 
they have multiple customers for.
    Have any of you raised that question or encountered the 
type of protocols that would alert the users from the school 
systems themselves to be actual subjects of the usage of data 
breaches? I would be interested in that.
    Mr. Reidenberg. We found that almost no contracts required 
vendors to tell the school districts if there has been a 
breach. The State breach notification laws might apply, but 
there is wide variety of the scope of those breach notification 
rules. We found that notifications of parents of the existence 
of these third-party on-line services being used by the school 
districts was quite rare. So we saw no indication of any 
district informing its parents that there had been a breach.
    Ms. Clarke. Parents trust schools to safeguard their 
children's confidential and sensitive data. Can you tell us how 
education officials should be seeking ways to protect students' 
personal identifiable information? What are the contractual 
pressures that exist when school systems hire, or use tools 
from, for-profit companies to manage their students data?
    Mr. Reidenberg. So there are a variety of basic security 
practices that the school districts certainly need to be 
engaging in. If they are transferring data it has to be 
encrypted. They should be minimizing the identifying data. They 
shouldn't be using Social Security numbers, for example, that 
some districts around the country still do. Their contracts 
need to have stringent security requirements on their outside 
vendors. That is nonexistent right now. We saw an appalling 
number of districts that--vendor contracts that did not include 
obligations to secure the data.
    It is not to say that the vendors are treating the data 
with abandon. We don't know. What we do know is that there is 
no legal protection that is being imposed on the vendors 
through the contracts.
    Ms. Clarke. The other element of vulnerability within 
systems is the age of the system. I would wonder whether, in 
your experience--particularly in school districts that are not 
as wealthy--whether the systems they are using to transmit 
data, you know, have reached their shelf life, if you will, in 
terms of vulnerabilities. What challenge that can place.
    Mr. Reidenberg. I think that is quite likely. I mean, the 
kinds of school districts, the sizes of the school districts 
across the country will range from the large cities that may 
have a million students in the district to places that have 
300. The district that has 300 students in it, if it is using a 
well-designed cloud service that is gonna be more secure than 
the district's own IT system, most likely. So there is an 
advantage to using professional hosting services that a 
district couldn't do. The downside is, if that hosting service 
is now hosting data on 20 million students it becomes a honey 
pot for cyber attackers.
    Ms. Clarke. Very well.
    Mr. Chairman, I yield back the balance of my time. Thank 
you.
    Mr. Meehan. I thank the Ranking Member.
    The Chairman now turns to the Chairman of the Education 
Committee, Mr. Rokita.
    Mr. Rokita. I thank the Chairman. I also thank the Ranking 
Members. Excellent testimony from everyone. I have really 
learned a lot, and will continue to learn as this issue goes 
forward.
    Ms. Popp, I would like to start with you. I am always 
encouraged, as a former State-wide elected official, when we 
have solutions that come from the States. Now that is how this 
was set up, and I am particularly pleased with your testimony. 
To make sure I understood it right, are you saying that the 
1372, or whatever number it was, prescribes contractual terms 
that have to be used when districts contract? Or by virtue of 
the statute alone, it is saying what is prohibited and what is 
allowed under district's usual procedures?
    Ms. Popp. Thank you, Chairman. Senate Bill 13----
    Mr. Meehan. Ms. Popp, I am gonna ask if you speak into the 
microphone and make sure that you push the button.
    Ms. Popp. Yes, the red button is on.
    Mr. Meehan. Okay, great. Thanks.
    Ms. Popp. Thank you. Senate Bill 1372 was very clearly 
outlined what data and how data can be collected. It also 
addresses the fact that there is a monetary penalty for any 
breaches. It does not get into some of the very specifics on 
some of the policies that the Department of Education, however, 
has adopted. One of the things being the contractual component. 
It does, in the Senate bill address some of the information on 
contracts with third-party vendors, such as testing the 
agencies and student information. It actually calls out those 
two particular vendors directly in the Senate bill.
    Mr. Rokita. Thank you very much.
    Mr. MacCarthy, what do you think of Idaho's approach? What 
would your members think?
    Mr. MacCarthy. Thank you for your question, Mr. Chairman. 
We like the approach.
    Mr. Rokita. Good.
    Mr. MacCarthy. I think it sets up the proper sort of 
framework for the inclusion of the appropriate issues within 
school contracts. As many of you have heard in previous 
testimony, transparency is a key element. We need to tell 
parents what information is being collected by the school and 
school vendors, what is done with it, who it is transferred to, 
who it is shared with, what the data security requirements are, 
what the data breach notification requirements are. That 
information should all be provided to parents, and model 
policies at the State level that--make sure that those issues 
are covered in contracts are something that the industry would 
support. They are part of the SIAA best practices that we put 
out in February of this year. So we would encourage that level 
of involvement by State and local and school districts.
    Mr. Rokita. Thank you.
    Mr. Reidenberg, what do you think of Idaho's approach?
    Mr. Reidenberg. I think it is very encouraging. I think it 
is very encouraging, Mr. Chairman. I also think it is extremely 
positive that the Department--I know Department of Education is 
spelling out what the contracting practices need to be for the 
districts. I do think that, though, that kind of approach needs 
to be seen on a Nation-wide basis and that it is not just the 
students of Idaho that deserve the kinds of protections that 
Idaho is enacting.
    The Federal Government is funding, in the last couple of 
years, anywhere between--it is probably between $500 million 
and a billion dollars to the States to encourage and be 
developing these kinds of information systems. I think we need 
to see approaches like that more systemically deployed across 
the country.
    Mr. Rokita. Do you think Mr. Murray has a good idea when he 
says Title II funds ought to be used in this area? Title II 
funds----
    Mr. Reidenberg. I am sorry.
    Mr. Rokita [continuing]. As your PRAP in those kinds of 
things. In fact, the Student Success Act that our whole 
committee passed and that sits on Mr. Reid's desk right now--
block grants, a lot of Title II funds to the State so that they 
could use these funds in the best way they see fit. Wouldn't 
you say States should be able to use Federal money to help 
protect, or enforce, issues in this area?
    Mr. Reidenberg. Well, I think--I mean, I think that if the 
Federal Government is going to be financing these kinds of 
programs at the State level that require the generation and 
collection of lots of student information, then there ought to 
be a commensurate requirement that the States address privacy 
as part of their infrastructure development. When the teacher 
said I am not very familiar with Title II, to the extent that 
it is involving, say, teacher training programs, that is a key 
part----
    Mr. Rokita. Sir, I am afraid my time has run out. Two short 
questions--two short remaining questions, yes or no. Do you 
know of any legal malpractice cases occurring in the United 
States that involve attorneys for school districts or schools 
in this area for their lack of preparing a contract correctly 
or anything like that?
    Mr. Reidenberg. I am not aware of any.
    Mr. Rokita. Are you aware of any school district in this 
country that doesn't have legal counsel?
    Mr. Reidenberg. Yes.
    Mr. Rokita. What percentage of the total would you think 
that is?
    Mr. Reidenberg. That, I couldn't tell you. I mean, we saw 
school districts, the smaller school districts seemed to be 
winging it when they come to these sorts of contracts.
    Mr. Rokita. Mr. Chairman, I thank you for the time.
    Mr. Meehan. I thank the Chairman.
    I now recognize the Ranking Member, Mr. Loebsack, for his 
questions.
    Mr. Loebsack. Thank you, Mr. Chairman. Before I begin my 
questions, I would request unanimous consent to submit two 
written statements if I might. One from my colleague, our 
colleague, Representative Jared Polis and another from Aimee 
Guidera. She is the executive of Data Quality Campaign.
    Mr. Meehan. Without objection, so ordered.*
---------------------------------------------------------------------------
    * The testimony of Hon. Polis has been previously included.
---------------------------------------------------------------------------
    [The information follows:]
 Statement of Aimee Rogstad Guidera, Executive Director, Data Quality 
                                Campaign
                             June 25, 2014
    Thank you for the opportunity to offer written testimony today on 
such an important topic for all of us in this country. The 
conversations parents, educators, and others are having in communities 
around the Nation about the use of data in education and the critical 
need to ensure the safeguarding of student data are important ones, and 
they will lead to solutions that assure all of us student data are 
being used safely by those we entrust with the responsibility of using 
them to improve student achievement. This conversation about data 
privacy and security is not unique to education: As a society, we are 
dealing with the unprecedented need to adapt to the increasing role of 
data in helping us make better-informed decisions and attain better 
services and outcomes in every aspect of our lives. Integral to this is 
a need to also discuss how we safeguard data and protect our personal 
privacy.
    The Data Quality Campaign, a nonpartisan, nonprofit advocacy 
organization, works with policymakers and other stakeholders to 
highlight the power of effective data use at all levels to support 
families and educators in their efforts to improve student achievement.
    This hearing provides an excellent public forum for having these 
vital discussions about the value, use, and protection of data. Thank 
you for allowing the Data Quality Campaign to submit written testimony.
   using data effectively can improve education decision making and 
                                outcomes
    Like every other sector focused on getting better results, 
education is using data in new and game-changing ways. We are using 
data to inform decision making in education and improve outcomes to the 
level that every parent expects, every child deserves, and the future 
health and well-being of this Nation requires. Because of the 
investment the Federal, State, and local governments have made in 
increasing the quality, availability and use of education data, 
teachers and parents have better access to information that helps them 
tailor learning to the needs of each student in real time, and more 
students are walking across the graduation stage prepared for post-
secondary education and the workforce. At the same time, Americans are 
raising legitimate questions about how we safeguard data while using 
them for this important purpose.
    Empowered with the right data, teachers can better track their 
students' progress and tailor teaching to each child's needs, and 
parents can have a more substantive, timely account of how their kids 
are doing.
    When education stakeholders are using data to inform their judgment 
at all levels, student achievement grows. States' efforts to support 
the effective use of data have yielded many positive developments. 
Parents, educators, and policymakers in Kentucky can now review high 
school feedback reports to get a richer picture of how well-prepared 
graduates from a specific high school are for college-level work, and 
then make changes in policy and practice to better align high school 
course-taking and graduation requirements with post-secondary 
expectations. Data coaches in Delaware can help teachers pinpoint what 
interventions students need most. And an early warning system in 
Massachusetts gives educators information that, when acted upon in a 
timely manner, can mean the difference between a student graduating or 
dropping out.
    To fully leverage data to inform decisions and improve outcomes, 
its collection and uses must be aligned to the needs of teachers, 
parents, students, and policymakers. Equally important, the privacy, 
security, and confidentiality of the data must be safeguarded. People 
will not use data that they do not find useful and trustworthy. There 
can be no effective data use without building trust that the data will 
help and that it will be kept safe and secure.
    All of us in education must do more to make sure that we are 
transparent--especially with parents about what data are collected, who 
has access to them, how they are used, and what policies and practices 
are in place to protect privacy and keep the data secure.
                 all education data require protection
    Part of the rising concerns around the security, and privacy of 
education data stems from the need to better clarify how current laws 
apply to the different types of data collected; this includes if and 
when data may be used commercial purposes and what limits are placed on 
access to students' Personally Identifiable Information.
    The Family Education Rights and Privacy Act (FERPA) defines the 
types of data that are collected in an education record (Authority: 20 
U.S.C. 1232g[a][4]) as those that are ``maintained by an educational 
agency or institution or by a party acting for the agency or 
institution.'' This includes both the information traditionally 
collected by an education agency like grades, test scores, gender, age, 
and attendance, as well as information collected by a third-party 
service provider which has been contracted by the education agency to 
provide explicit educational services.
    Privacy and legal experts continue to debate whether or not data 
that is collected and maintained by third-party software providers, and 
not on behalf of an education agency is governed by FERPA. These third-
party solutions provide learning apps and other technology and web-
based services to inform and improve student learning. The data 
collected directly from a user (generally a student or parent) through 
these services are collected and maintained by the company providing 
the service and not at the request of an educational agency.
    Some of these services not governed under FERPA, (for children 13 
and under), however, are covered in the latest guide for businesses, 
parents, and small entities regarding the Children's On-line Privacy 
Protection Act (COPPA) released by the Federal Trade Commission this 
spring.
    Because these data are collected for different purposes and involve 
different parties, it is necessary to create policies addressing 
specific concerns and ensure that data are used and maintained in a 
secure and effective manner. The concerns currently being raised by 
parents and other education stakeholders are legitimate and must be 
addressed in policy and practice to build understanding of their 
purpose and trust in their protection.
                state actions to safeguard student data
    In response to these tremendous opportunities and advancements in 
the uses of data, many States and education agencies are also thinking 
about the governance and privacy responsibilities associated with data 
use. To support these efforts, Education Counsel released Key Elements 
for Strengthening State Laws and Policies Pertaining to Student Data 
Use, Privacy, and Security: Guidance for State Policymakers. The 
report, which highlights relevant Federal laws, State practices, and 
emerging best practices, serves as a helpful guide for policymakers at 
the Federal, State, and local levels seeking to ensure policies include 
foundational elements:
    1. Statement of the purposes of the State's privacy policies, 
        including an acknowledgment of the educational value of data 
        and the importance of privacy and security safeguards.
    2. Selection of a State leader and advisory board responsible for 
        ensuring appropriate privacy and security protections, 
        including for developing and implementing policies and for 
        providing guidance and sharing best practices with schools and 
        districts.
    3. Establishment of a public data inventory and an understandable 
        description of the specific data elements included in the 
        inventory.
    4. Strategies for promoting transparency and public knowledge about 
        data use, storage, retention, destruction, and protections.
    5. Development of State-wide policies for governing Personally 
        Identifiable Information.
    6. Establishment of a State-wide data security plan to address 
        administrative, physical, and technical safeguards.
    Since January 2014, 36 State legislatures have introduced 108 bills 
directed at ensuring the privacy, security, and confidentiality of 
education data. Many of these States recognize that FERPA is a strong 
foundation for student privacy, but that they should tailor additional 
laws to address the specific concerns of their citizens.
    Several States have passed legislation this session to proactively 
and publicly ensure that education data are used effectively and 
ethically. Colorado's recently passed H.B. 1294 provides definitions of 
key data terms and describes permissible uses of education data. The 
law also requires the provision of supports needed to ensure the 
privacy and transparency of the State's education data use, including a 
public data inventory, data privacy training for Department staff, 
breach notification processes, and contracting guidelines for working 
with service providers. In addition to describing when data can be 
shared and calling for new privacy and security policies, West Virginia 
H.B. 4316 delineates State, district, and school responsibilities in 
creating and maintaining a student data inventory; the law also 
provides for a data governance officer and describes his or her 
responsibilities.
    Some new State laws seek to establish stronger mechanisms for 
determining how student data will be used through the creation of data 
governance bodies with decision making or investigatory authority. 
Indiana's H.B. 1003 establishes the Indiana Network of Knowledge (INK), 
a group charged with data governance and making the State's data 
transparent and accessible to the public. Maine L.D. 1194 creates a 
Joint Standing Committee on Judiciary to study student privacy 
(especially with regard to social media and cloud computing services), 
concerns of parents about on-line education data service providers 
using data to build student profiles or target on-line advertising, and 
how other States address student privacy with social media and cloud 
computing services. South Carolina H.B. 3893 describes permissible 
State data collections and calls for security and access rules, but it 
also provides for the implementation of a Data Governance Committee to 
make decisions about data disclosures.
    While most of the student data privacy bills introduced this 
session have focused on the student data collected by districts, some 
bills have begun to address data collected through the use of on-line 
programs and services, such as content programs and classroom apps, 
which fall into the category of data collected by service providers. A 
currently active bill in California (S.B. 1177) is one of the few bills 
which seek to explicitly govern data collected through education 
technology providers. The bill would prohibit on-line K-12 service 
providers from selling student data or from using, sharing, or 
disclosing certain types of student data for any purpose other than the 
contracted purpose or for ``maintaining, developing, and improving the 
integrity and effectiveness of the site, service, or application.'' 
Other bills, such as Idaho S.B. 1372, Massachusetts H.B. 331, and 
Tennessee H.B. 1549/S.B. 1835, prohibit the collection or use of 
student data for commercial purposes. The Tennessee bills, which have 
been signed into law, also prohibit the collection of student data for 
product development.
                               conclusion
    While the above examples highlight the work that States and others 
have done to protect the privacy and security of education data and 
promote data being used effectively to improve student achievement, it 
is important to note that this is only part of the work the field must 
undertake to address the concerns around education data collected by 
service providers. This hearing and others like it at the Federal and 
State levels will raise awareness of the need to address public 
concerns about the use of data in education.
    It is important for privacy and legal experts to continue to debate 
the solutions as we continue to gather information. Equally important, 
Congress should continue to lead these discussions among all 
stakeholders to review existing laws including how they apply to the 
use of continuously changing technology to collect data and determine 
what gaps may exist and if necessary, how they should be addressed 
through new laws. Efforts like the one led by Congressmen Jared Polis 
(D, CO-2) and Luke Messer (R, IN-6) to encourage leaders in the 
education service provider field to develop standards of conduct are a 
promising start, and can lead to further conversations.
    In addition to clarifying how existing law protects data and how it 
can be strengthened, there are many actions that the sector must 
prioritize: Building the understanding of the need for every school, 
district, State, and vendor to prioritize the safeguarding of education 
data; increasing capacity of the field through training around data 
security and privacy; increasing tailored communications around the 
value, use, and protection of data with parents and citizens; adapting 
emerging best practices from other sectors; and creating standards of 
conduct for the field to use.
    It is important that these conversations, like this Congressional 
hearing, are not just about the ``risks'' of using data in education. 
We must all help the American public better understand the promising 
uses of this data to improve the performance of our schools and to 
ensure that every child in this country graduates prepared for success 
in post-secondary education and the workforce.

    Mr. Loebsack. Thank you, Mr. Chairman. Thank you. This is 
an exciting time in education, there is no question. Students 
and teachers really have never before had so much information 
at their fingertips. You know, we can all recognize clearly 
that, through the internet, students have access to a world of 
multimedia educational resources. With the use of data, 
teachers and school leaders today have a clearer sense, I 
think, of individual strengths and needs of each of their 
students.
    I want to step back just a moment from sort-of what we have 
been talking about up to this point. We all recognize, you 
know, what the problem is, potentially, out there and we have 
got to do something about it. But if I could ask Mr. Murray 
just to sort-of give us a sense--you already did a little bit. 
But, you know, because I am concerned about throwing the baby 
out with the bath water, if you will. But what can be done 
today with data to support student learning that couldn't be 
done 20 years ago, for example?
    Mr. Murray. Sure, and that is a great question. I 
appreciate you asking that. The classroom has changed 
dramatically in the past 20 years. When I think back 20 years 
ago, I think back to a one-size-fits-all approach. All students 
were reading the same thing. If you were high up, you helped 
the kids that were struggling. If you were struggling, you kind 
of tried to get by. Teachers might offer students--and they 
may, at the end of a quarter, say your child earned a B because 
the average was an 86 percent because here is the average of 
everything that your kid did over the marking period.
    Fast forward 20 years and look at a parent conference. When 
I am a parent, and I can hear very specific standards or very 
specific information about what my child needs--not just that 
it is an 86 percent overall--and get that very specific 
concrete information there is incredible opportunity in 
communication and transparency for parents, based on what their 
child needs. Parents are incredible stakeholders in this 
process. They--we, as school districts, need to be transparent 
and need to be able to share very specific information on 
student growth.
    Let me give you another example. Much of our data is 
available on-line to our students through very secure parent 
portals that they create their own user name and passwords for. 
So no longer is it, at the end of a marking period, you get a 
report card and, as a parent, you only get to see that four 
times a year. Our parents from where I came from, they got a 
daily report card. They could log in to a secure system, see 
attendance rates, see quizzes, see anything that was up-to-date 
at a point in time, at that moment in time.
    What does that do? That helps our children be successful. 
In a classroom--one last example--if I am a teacher with access 
to real-time data I can make decisions on the fly in the 
classroom. It is no longer about planning a one-size-fits-all 
lesson. It is about looking at data through the use of 
technology inside the classroom to make decisions on the fly 
for my kids. A quick example of that would be I am giving a 
lesson, I am able to electronically receive feedback exactly 
for every child, every answer, every time, no longer just the 
kid in the back of the classroom with his hand up. Make 
decisions as a teacher, on the fly, as what to do next right 
there in the classroom. Twenty years ago, that was not 
feasible.
    Mr. Loebsack. Thank you, Mr. Murray. By the way, your 
comment about facing a thousand middle school students? That is 
a lot worse than facing us.
    [Laughter.]
    Mr. Loebsack. As somebody who is out of the college level 
for 24 years, my wife taught second grade. I understand where 
you are coming from. Given your teaching background and your 
administrative background, I think you have kind-of a unique 
perspective on all this. You mentioned some recommendations, 
couple recommendations. Practically speaking, we have to try to 
figure out a balance, if you will, between effectively using 
data to improve instruction, and ensuring the privacy 
protections that we are all concerned about. Can you elaborate 
not only on the two, but maybe some others that you have in 
mind?
    Mr. Murray. Sure, absolutely. To me, it is not an either/
or. It is not privacy or data use and data analytics. It is an 
and/and. We need to use the data, use the analytics to drive 
the instruction in the classroom, and hold it to the highest 
levels of accountability. So another example that I would give 
would be related to the professional learning. This goes back 
to the question that we were talking about a few minutes ago: 
How do we keep this safe? No. 1, we need to make sure we have 
educated teachers in the classroom, based on what can they do, 
what can they share, what is their responsibility.
    In Quakertown, where I was, they signed a confidentiality 
agreement every year of what they would do and be able to 
share. Second, we need to take a look at our contracts. I am 
okay saying that, as the person that did that for the last 
number of years--was the contractual person. I would sit with 
our district solicitor and review that contract. We would not 
engage with a large-scale data area that was not FERPA-
compliant for us. That was not highly secure with 128-byte 
encryption. Our student privacy and security was absolutely 
paramount in what we do.
    We also went through State audits. Every year, I would sit 
with a State auditor and they would ask who has information 
about your data, what companies are you partnering with, what 
security measures do you have in place, who has access and how 
do you know it is safe? They would give feedback on a yearly 
basis. So at the State level, that leadership was also 
imperative.
    Mr. Loebsack. Thank you, Mr. Murray.
    Thank you, Mr. Chairman.
    Mr. Meehan. I thank the Member.
    The Chairman now recognizes the gentleman from Tennessee, 
Mr. Roe.
    Mr. Roe. I thank the Chairman for having this hearing. Mr. 
Murray, I think Susan was successful because of great teachers 
like you. I think I would love to have my children, my three, 
had you in the classroom. You are very enthusiastic and bring a 
lot of horsepower to the classroom, I think. I think it is a 
tribute to you, not necessarily data. You know, we cured polio 
and put a man on the moon without big data. It is great 
teachers, I think, like you that have helped make this.
    Certainly data is important. I think it is critical to find 
out where you are not doing well and to improve that and use 
it. I think the concern we have, as you can hear from all the 
committee Members and from the panel is, basically, privacy. I 
think no one right now in this country, after the NSA 
revelations, believes anything is private. I mean, I am here, 
sitting in Congress. I served on the Veterans Affairs 
Committee, the Education Committee. I had no idea they were 
doing that.
    I had no earthly idea the data mining that was going on. 
Look, we data mine all the time. This is my Harris Teeter card. 
Every time I go in there they know exactly what I am buying at 
the Harris Teeter. So data is being mined on us all of the 
time. The question is, how secure and who should have it and 
who should care whether a kid blinks and how big they are. I 
mean, the concern is how is this data being used? If it is used 
like you are using it, it is very constructive. There is no 
question about it.
    But the worrisome part about me is--as Mr. Reidenberg 
points out is that many school systems don't have the ability 
to contract to get these very tight and to be sure that this 
data is being used in a proper way. My question is: How can it 
be improperly used? What should we be fearful of when this data 
is out there in the cloud? Yes, sir.
    Mr. Reidenberg. My answer would be that the data should be 
used strictly for educational benefits for particular children. 
And begin to define, what do we mean by legitimate educational 
uses? That is the way I would define it. I would define it 
quite narrowly. I am very concerned. I sat on a school board in 
my local community in New Jersey for 5 years.
    Mr. Roe. My condolences.
    Mr. Reidenberg. Accepted. One of the issues that we, as a 
board faced, dealt with commercial--you know, advertising on 
the school board, in the stadium at the school. These big data 
programs with educational data are bringing that issue into the 
classroom. It is no longer just on the sports fields. I come 
down on the side of saying that that is not appropriate for 
public education. That public education, we should be using 
this data for the specific educational benefits of the 
individual children about whom the data relates. To me, that is 
an important public policy debate we need to have in this 
country.
    Mr. Roe. I had no idea personally, as a parent of three 
children that all went to public schools, that this data was 
being shared with anybody. I had no idea that it would be out 
there for other folks to use. I think it is important that 
parents know that this data--I think that is absolutely 
critical.
    Mr. Reidenberg. Look at the case, for example--there is a 
bankruptcy proceeding, ConnectEDU is the company that is in 
bankruptcy right now. They hold data on 20 million children. 
One of the products that they offered was a K-12 early warning 
label for children. So it is not clear from the advertising. 
Does that mean they are labeling third-graders as not college 
material? They are in bankruptcy. That data can be sold off the 
to the highest bidder unless the trustee in bankruptcy decides 
to impose some restrictions on it.
    The company, its main products are college counseling. So 
it means they are holding data on family finances because of--
students were going to need student loans. The range of data 
they are gonna hold on those kids is quite striking.
    Mr. Roe. Well, can that be used to--as Harris Teeter would 
do? Next thing I know, I am gonna get some coupons in the mail 
with what I am--is that being used to market? Is that data out 
there to market--whether it is loans or whatever it may be?
    Mr. Reidenberg. It is not--well, the simple answer is 
probably yes, but it is complicated. Because at least this 
particular company says that students have to designate that 
they want their data, say, going to a prospective college. But 
once the prospective college gets that information there isn't 
a further restriction on the college then selling it to a list 
broker or it bleeding out in other ways.
    Mr. Roe. Yes, I think the concern you have is when you 
change internet service providers, you know, as I did 3 or 4 
years ago. All of a sudden now--I won't mention the spam I get 
on here, but they obviously sold that information out and now I 
am getting e-mails from everybody in the world.
    So I think that is a concern about how you can use it like 
Mr. Murray, no question it is beneficial. I think the concern 
is that it is not, or might not be, used like that.
    Mr. Reidenberg. We found that only 7 percent of the 
contracts had specific prohibitions on sale and marketing. 
Other contracts, and it ranged between 15 and 20 percent of the 
contracts, failed to restrict secondary disclosure. So some of 
them that restrict to secondary disclosure could encapsulate, 
essentially, restriction on selling it off for marketing 
purposes. But for explicitly, clearly saying you can't use this 
for marketing it is only 7 percent. You still had enormous 
percentages weren't even restricting any other secondary use.
    Mr. Roe. Okay, Mr. Chairman, thanks for your indulgence.
    Yield back.
    Mr. Meehan. I thank the gentleman.
    The Chairman now recognizes Ms. Bonamici.
    Ms. Bonamici. Thank you very much. Thank you, Chairman 
Meehan, Chairman Rokita, Ranking Member Clarke and Loebsack, 
for allowing me to participate in this fascinating discussion. 
This is actually an issue that comes up quite often in the 
district I am honored to represent out in Oregon. There have 
been a lot of conversations about this issue, and I really 
appreciate the expertise of the witnesses.
    I want to follow up on the point about the opportunities. I 
don't think anyone would disagree that there are so many 
opportunities out there with technology. Mr. Murray, what you 
describe I have witnessed in schools in the district I 
represent. The use of technology to further instruction and to 
improve instruction, there is a lot of potential there. I don't 
think anyone would disagree with that. The concern is about 
finding the balance to make sure that that data remains 
adequately protected. Mr. Roe, I appreciate your sharing your 
little story about your Harris Teeter card.
    I think the difference is that you are using that with your 
knowledge that they are keeping that information. You don't 
have to swipe that card. You were making that choice. I think 
that is very different for students when, often times, the 
parents do not understand, they do not have that same knowledge 
that you have about what is happening with the card that you 
are swiping. I have to say that whenever we are legislating 
around technology we have to make sure that the technology is 
always developing faster than policy. Policy takes a long time; 
technology is developing quickly.
    So we have to make sure, in legislation, that we do not 
inhibit the positive uses but that we do the--what it takes to 
make the data protected. So I want to follow up. Mr. 
Reidenberg, you just mentioned you--the question I was gonna 
ask. About fewer than 7 percent of contracts between school 
systems and on-line service providers explicitly prohibit the 
sale of marketing of student information. So does that mean 
that the other 93 percent of contractors are selling student 
data? Do we have any sense of the scope of the problem?
    For example, a student in my district. What are the--what 
is the likelihood that there is marketing going on if they are 
not in that 7 percent that has that prohibition?
    Mr. Reidenberg. I want to come back to the 7 percent again. 
The 7 percent are contracts that have specific restrictions on 
sale of marketing. We have other--so, for example, hosting 
contracts. Only 50--53 percent of the hosting contracts had any 
limitation on redisclosure. So that means almost half of the 
hosting contracts have no contractual restriction from the host 
service doing whatever they want with the data.
    We don't have any evidence on practice, actual practices. I 
think that would be almost impossible to come by right now. 
There is really not clear mechanism. I am sure we can all point 
to companies that will say they don't do that. I would welcome 
those companies presenting audit--you know, auditing, having 
third-party audits like they audit their financials to actually 
let the public know what, in fact, they are doing with school 
data. But there is really--other than that, there is no way to 
actually know systemically what the practices are in the 
industry.
    Ms. Bonamici. Thank you. Mr. MacCarthy, I respect the work 
of your organization very much. Appreciate your testimony. You 
did say that you do not believe that there is any new 
legislation required. I know that we have had this conversation 
about FERPA and the other existing legislation. But, Mr. 
Reidenberg, you said that the Department of Education has never 
denied Federal education funds to a school system for a 
violation. So I wonder, are the meaningful protections there?
    Ms. Popp, thank you for talking about what Idaho is doing. 
But it sounds like we are gonna have to have something that has 
a mechanism to ensure that the school systems and the vendors 
are actually complying. So I want to ask Mr. MacCarthy, you 
state that service providers already face penalties for 
inappropriately disclosing information, including, for example, 
a 5-year ban on providing services. Has a provider ever 
received that penalty?
    Mr. MacCarthy. They haven't been penalized in that way. The 
thrust of my testimony, and maybe an opportunity to talk in 
more detail about this later, is that the framework set out by 
FERPA and that is accepted by the industry and educators 
throughout the country is that student information should be 
used solely and exclusively for educational purposes. For the 
benefit of the student to improve educational products and 
services. That is the fundamental thrust of the legal and 
contractual framework that exists right now in this country.
    If we need to work for improving the contracts or to 
improve it through best practices, we are happy to step forward 
and to do that. But I want to reassure this committee that it 
is not the Wild West out there. There is not a lot of concern 
among educators and people directly involved in the business of 
educating children that a lot of information is being used for 
marketing purposes. I want you to pay attention to the comment 
that Professor Reidenberg just made. He has no evidence that 
this is actually happening.
    His evidence is that the contracts don't prohibit it. It is 
against Federal law to take student information and to use it 
for non-educational marketing purposes----
    Ms. Bonamici. I think my--I see my time has expired. I do 
see we have some work to do in, perhaps, defining educational 
purposes. Thank you.
    I yield back the balance of my time.
    Mr. Murray. Mr. Chairman, do you mind if I say something 
quickly on that topic?
    Mr. Meehan. I thank the gentlelady. No, you may finish, Mr. 
Murray, if you have a comment on that.
    Mr. Murray. Sure. I would also urge caution here. Because 
the information that we are collecting, that we are using with 
third parties is very rarely comprehensive in terms of what we 
are transferring. I can think of three cases. Student 
information system, medical information and, for instance, 
something like an on-line registration. Which are all highly 
encrypted. When I had signed a contract saying we will not sell 
and not be able to. A lot of this free stuff that are out 
there, most cases we are giving generic user names and 
passwords.
    There is not actually anybody in even my district that 
could figure out who the child is on any of this free software 
or any of those free apps. Their user name might have been 
classroom 32, student 1. You can't do anything with that data. 
I do think we need to look at contracts and how important that 
is. But school districts are adamant that they are very careful 
with the information. This is not, I would agree, the Wild, 
Wild West in that sense that teachers and districts use very 
much caution in terms of anything related to student data 
anywhere, with the exception of the student information system 
where we must have it, which is highly secure, highly 
encrypted.
    Mr. Meehan. Thank you. Thank you, Mr. Murray.
    I am just gonna recognize myself for some closing 
questions. Because I promised that I would get back to Mr. 
MacCarthy and give him a chance to address some of this issue 
if he believes he didn't have an opportunity.
    I am--I ask you, and appreciate that there are checks and 
balances on some aspects of this thing. But I am concerned, as 
well, as was identified when you said there is no need for 
future legislation. The limits, because there are places in 
which there are always smart people that find ways around the 
structure.
    So when you have, perhaps, a vendor that has information, 
the question is where--what is it--a source of that 
information. What capacities do you have to rein in that 
vendor? Because FERPA protects your right of action against the 
school district, so to speak. So I look at--the question I ask 
is, a lot of teachers are using these perhaps outside the scope 
of, you know, the direction of the traditional things, or 
getting a lesson plan or something. The students are signing, 
and then that kind of private information isn't necessarily an 
educational record.
    But the third-party vendor now owns that information. If 
you want to bring a right of action to say, hey, don't use it 
inappropriately, under FERPA the only thing we can do is punish 
the school district. So where is the--how do you address that 
issue? But I also appreciate what are the checks and balances 
that you are seeing that are working, that are controlling 
abuses of this kind of process?
    Mr. MacCarthy. So first point is that vendors, providers of 
services to school, are covered by FERPA. The statute that 
creates the school official exception reads, ``A contractor is 
subject to the requirements of FERPA's nondisclosure rules. A 
contractor that violates the FERPA rules is subject to 
suspension of its provision of services for up to 5 years.'' So 
the legal framework is there.
    Mr. Meehan. But didn't the Supreme Court itself say that 
homework assignments aren't subjected to that? Couldn't there--
what is more intimate than the ability of some third party to 
understand the calculations that my child is making on the very 
math programs they are working on that third-party vendor's 
software?
    Mr. MacCarthy. Educators and school providers are not 
looking for ways to circumvent the protections of FERPA. What 
they are looking to do is to provide good service to students 
and to teachers and to schools. They treat the Personally 
Identifiable Information they get from schools and from 
students as if it deserved and should receive the fullest 
possible privacy protection.
    Mr. Meehan. Mr. MacCarthy, that is a--I believe what you 
are saying, but that is a sweeping comment. Because we are 
talking about third-party vendors, and the fact is there is an 
awful lot of very responsible third-party vendors who 
completely share the same objectives. In fact, have invested 
in--you know, the Gates Foundation and others have invested in 
the best ways to teach. We don't want to stifle that. But we 
also know that there are third-party vendors out there who are 
looking at finding consumer information, any access they can 
get to something that helps them.
    So what is the protection against when my child is swiping 
his card to see what he eats to make sure that he doesn't get 
free--you know, free things from Coca-Cola?
    Mr. MacCarthy. On that particular point, FERPA recently 
issued some guidance. They said explicitly that a service 
provider such as a cafeteria provider or an e-mail provider is 
prohibited by Federal law from providing targeted advertising 
to the students based on the information it collects as part of 
its school service. It is currently illegal to do that, and the 
Department of Education just released that advice in February 
of this year.
    Mr. Meehan. Mr. Reidenberg, do you have any comment with 
regard to whether there are other--to that information, or 
whether there are other gaps in the system?
    Mr. Reidenberg. Yes. I think--I mean, a whole host. To that 
specific point, it is guidance, it is not regulation. The 
Department did not go through an administrative procedure act 
regulatory process. It is wrong on the law. I think that the 
gaps are astounding. Twenty-five percent of the--these kinds of 
services are offered at a premium to the school; 25 percent of 
the contracts we saw. That means they are monetizing the data 
somehow. That monetization is not going to be coming from 
educational benefits targeted to particular children.
    We have seen this with Google apps for education. They 
represented they weren't data mining e-mail, student e-mail. 
Turns out they were. That came out in a lawsuit. I think right 
now we are at a point where we need to modernize FERPA and we 
need to modernize it. There are a series of steps that have to 
take place for--has to apply to all student information. It has 
to mandate notice to parents, public disclosure, of these 
arrangements that just don't exist right now. What the 
educational uses are.
    I can give you further points, I think. That school 
districts have to have written contracts with specific 
prohibitions. I disagree quite strongly with the statement Mr. 
MacCarthy just made about the applicability of FERPA to 
vendors. I don't think that is what the statute says. If he and 
I can each disagree on something like that, I think that may 
suggest it is time for Congress to take a look at what the 
statute means. States need to have chief privacy officers. 
There are a lot of districts out there that don't have the 
resources to address these issue and these problems.
    They need guidance, they need it desperately. There need to 
be remedies. Right now, there are no remedies. We have a long 
tradition in this country that we sort out some of these 
problems through private actions. Well, today we have no 
mechanism for that. If any of the--if an irresponsible vendor 
out there does something grossly inappropriate with student 
information there is no remedy. The parents, the families, they 
have no remedy whatsoever----
    Mr. Meehan. Okay. Well, I thank you, Mr. Reidenberg.
    I just wanted to ask one thing. Ms. Popp, you have worked 
very diligently as a system, a State system, to look at the 
square of this issue and try to--have you built in protections 
against the kinds of things Mr. Reidenberg is pointing out, or 
are those gaps still there?
    Ms. Popp. From Idaho's perspective, I believe we have 
worked very diligently to build in the safeguards. I think 
awareness is absolutely the key, and training and working with 
the school districts, to Mr. Reidenberg's point. In Idaho, we 
have many rural and remote districts. They may not have the 
resources. I think this is one time that the State can step in 
at a State level and help them understand what they need to 
have in place and the safeguards. All school districts within 
the State of Idaho have school boards, and those school boards 
do have representation from their own legal counsel for the 
most part.
    There may be one or two that does not. However, again, 
doing the diligent training on what a good contract looks like, 
helping them understand the protections of the data and, to Mr. 
Murray's point, putting in the technology protections of the 
encryption any time data is transferred is key to making this 
work.
    Mr. Meehan. Well, I thank you. I think one panelist has one 
more question.
    Mr. Rokita.
    Mr. Rokita. Thank you. This will be pretty quick. In fact, 
let the record reflect that of my 5 minutes, 3 has been used 
already. So with that, let me just again thank the witnesses. 
Appreciate even more Idaho's approach. State by State, this is 
still, I think, the way to go for this. Lacking a 
Constitutional basis otherwise. There may be one, but that is 
for another hearing on another day.
    We have talked about FERPA a lot. But you, Mr. MacCarthy, 
mentioned some other pieces of legislation, some acts. The 
Children's Online Privacy Protection Act, correct? You said 
that requires parents' permission before the use of data. But 
you also said that it only applies to children up to the age of 
13. Can you reconcile the two, or what?
    Mr. MacCarthy. You stated it accurately. It is designed to 
protect children in the on-line context.
    Mr. Rokita. So after 14.
    Mr. MacCarthy. After 14 it does not apply.
    Mr. Rokita. After 13. Okay, I just wanted to clear that up. 
So it is not a--it is not a total solution either, is it?
    Mr. MacCarthy. It protects children. Its aim is to protect 
children. Teenagers are out from under its coverage. The 
remaining protections of FERPA, the FERPA protection, 
contractual protection is the best practices. Those still stay 
in place. COPPA's aimed at children 13 and under.
    Mr. Rokita. Okay, thank you. While it is acknowledged, and 
certainly came out in the testimony today, that FERPA does not 
recognize a private right of action, there still is a common 
law contractual breach right of action. Yes or no, Mr. 
Reidenberg?
    Mr. Reidenberg. Only with respect to the school district. 
If the provision is in the contract between the district and 
the vendor, the district would be able to enforce the contract. 
The victim child and family, at best, would be a third-party 
beneficiary and would very likely have great difficulty 
bringing any sort of action. Again, that is assuming the 
contract includes a protection--an underlying protection in the 
first place.
    Mr. Rokita [continuing]. Which goes to my earlier question. 
It may be a legal malpractice case, but that is a stretch, too.
    Mr. MacCarthy. Mr. Chairman, just to be clear. One of the 
reasons to work with Joel and with other people to make sure 
that the contracts contain the appropriate provisions is 
precisely to create this extra enforcement mechanism. We are 
all looking forward to that.
    Mr. Rokita. But you are not for private right of action.
    Mr. MacCarthy. I don't think a private right of action 
would be appropriate. But I do think the ability for the 
schools to go into court and enforce against vendors who do the 
wrong thing using contractual violations would be a good thing.
    Mr. Rokita. How would you measure damages?
    Mr. MacCarthy. I don't have a good answer for that.
    Mr. Rokita. See, that is a problem, too. Unless you have 
some statutory damages built in, like Idaho did, right? Which 
you support.
    Mr. MacCarthy. That would be a step in the right direction 
at the State level.
    Mr. Rokita. You being Mr. MacCarthy for the purposes of the 
record. Ten more seconds.
    Mr. Reidenberg. Mr. Chairman, I was just going to say for a 
school district to enforce a contract, as a former school board 
member if I am facing an instance where there is some sort of 
breach that takes place, and I have to decide to devote $50,000 
to $100,000 of taxpayer money to litigate that, that is gonna 
be a hard decision for local school boards to be making. So 
again, if it is total reliance on the school board protecting 
their children's privacy it may be a very difficult thing to do 
where the harm is particularized to just a couple families.
    Mr. Rokita. Mr. Chairman, thank you again for your 
leadership with this hearing.
    I yield back.
    Mr. Murray. Mr. Chairman, can I respectfully--one more--one 
last comment?
    Mr. Meehan. Go ahead, Mr. Murray.
    Mr. Murray. I heard today a lot about vendors. I have heard 
today a lot about third parties. Privacy is absolutely real. My 
encouragement is to hold the expectation high for all of them 
to build in safeguards at the State level, like Ms. Popp 
eloquently shared. School districts need to be transparent, and 
transparent with their families in what they are collecting and 
what they are doing with that data. But what we cannot have 
happen is that we cannot stifle the incredible innovation that 
is going on with personalized learning and the awesome teachers 
we have in our Nation.
    Thank you.
    Mr. Meehan. Well, thank you, Mr. Murray. You got the last 
word, and a good one it was. But I think the last word on what 
was a very invigorating presentation by the panel.
    I want to thank my colleagues for their very genuine 
interest in this particular issue. I want to thank you, the 
panelists, who I know are continuing to work out there in the 
field for your work. We will monitor your continuing work. I 
thank you for the efforts that you all put, as well, into the 
education of our next generation of children.
    The Members of the committee may have some additional 
questions for the witnesses. If, in fact, they do go we would 
ask that you would do your best to be responsive in writing. I 
thank you again for all of your testimony. Without objection, 
the subcommittee stands adjourned.
    [Whereupon, at 12:41 p.m., the subcommittees were 
adjourned.]

                                 
