In the week since the Governor of Illinois shut down Illinois public schools in response to the growing threat of coronavirus disease 2019 (COVID-19), school districts across the state have risen to the challenge of educating their students virtually by implementing creative, innovative virtual programming connecting home and school. We know from the questions we have received from clients that many of you are already thinking about the various student privacy considerations that inevitably come into play as education moves online. The U.S. Department of Education’s Student Privacy Policy Office (SPPO) recently issued guidance addressing FERPA and Virtual Learning Related Resources to assist schools with their compliance in this area. Most of the guidance is a repetition of recommendations and resources that the SPPO has had in place for years. This includes safety steps that schools should take when contracting with vendors of online educational apps and other virtual learning tools; notice that FERPA does not prohibit parents or other household members from “observing” a virtual classroom; guidance on how to best safeguard student data when communicating by email; reminders regarding recording and maintaining videos and other records in the virtual classroom; and reference to guidance on what information can be released in a health or safety emergency.  

The FERPA guidance provides the following information about student privacy in the virtual classroom:

1. Continue to follow best practices when negotiating contracts with vendors of virtual learning tools. The SPPO guidance references two longstanding resources it has made available to schools, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices and Protecting Student Privacy While Using Online Educational Services: Model Terms of Service. These resources were developed for use with online educational services and apps, but in this most recent guidance, the SPPO notes that they are equally applicable for virtual learning tools. The resources, which are part of the SPPO’s Security Best Practices webpage, can often be cumbersome to use in actual negotiations with providers. The SPPO resources also do not take into account state laws, such as the Student Online Personal Protection Act (SOPPA), which includes state-level requirements for such agreements. Nor do they address any specific issues that may arise under FERPA and other federal laws, including the Children’s Online Privacy Protection Act (COPPA), as they relate to providers such as Google Hangouts, Zoom, or Schoology. Although many platforms are providing free versions for use by teachers, it is more important than ever that school districts have a centralized agreement with vendors to safeguard student privacy. Our attorneys who negotiate e-learning agreements with vendors have prepared an addendum that allows compliance with both federal and state laws, including amendments to SOPPA that will go into effect next year. Contact us for more information. 
2. Assess requests by parents to observe a virtual classroom as you would requests for in-person observations. The guidance notes the SPPO’s longstanding position that allowing a parent or parent representative to observe a classroom does not violate FERPA as teachers do not generally disclose personally identifiable information about students during classroom instruction. Decisions about when parents and other family members can be present in a virtual classroom can and should be made on a local level. 
3. Remember best practices with respect to emails and student information. The guidance links to a 2016 SPPO video discussing safety steps to use when sending emails that include personally identifiable information about students. The video recommends considering whether it is truly necessary to send student information by email before doing so, using encryption and strong passwords to send data via attachment, and including only what information is necessary, among other tips.  
4. If photos or videos are made during distance learning, remember FERPA rules protecting such records. The guidance directs school officials to its webpage with FAQs on Photos and Videos under FERPA. That resource reminds schools that photos and videos of students can be educational records protected by FERPA if they are directly related to the student and maintained by an educational agency or institution. The designation of a photo or video as a student record has implications at both the federal and state level on how the records can be shared, what parental access must be provided to the records, and how long the records must be maintained. Administrators should familiarize teachers and other staff implementing the distance learning programming with the district’s policies and expectations for maintaining and protecting student record information, as well as expectations for communicating with students and parents, both in class-wide and individual communications. Districts should also continue to respond to any student records requests received during this time. 
5. Consider when health or safety may warrant sharing student information. Although not directly related to the issue of virtual learning, the SPPO guidance also refers to recent a recent FAQ document from the Department of Education on sharing student record information in health and safety emergencies, which we addressed in a separate alert.