Going Beyond Legal Requirements for Community Engagement on Student Privacy

by CDT intern Bex Montz

As schools become more reliant on technology, and districts wrestle with how to engage community members, comprehensive community engagement around data privacy and technology is increasingly important. In education, community engagement is the inclusion of stakeholders in addition to school and district employees in the decision-making process. 

While legislation sets out some requirements for community engagement around data privacy and technology, research by CDT found that 1 in 3 parents said that they had very little say, no say, or were unsure about how much say they had in how their child’s data was collected. 

Although fulfilling legal requirements is important, compliance alone does not create a robust community engagement program around data privacy and technology. The following best practices (based on previous guidance by CDT) can help support meaningful connections with those who have the most at stake. 

Engage Students and Families Early

First, education agencies should engage students and families early in the decision-making process on data and technology. Currently, legislation requires education agencies to engage communities early in that process only for a narrow set of issues. For example, the Protection of Pupil Rights Amendment requires education agencies to consult with parents when developing and adopting policies, but it is limited to student surveys covering eight specific areas. Parental consultation is not required when an education agency is adopting many other data collection policies. 

Community members should be included early in the decision-making on a wide range of policies, because they have more buy-in and trust in an organization’s policies when they are included in policy-making decisions, and early engagement may help identify potential problems with data sharing.

Proactively Communicate with Families

Second, education agencies should proactively communicate with families by providing them with accurate, accessible information upon which to base their input. Doing so holds agencies accountable for communicating their plans, and builds capacity among communities to constructively engage as they are made aware of the school’s data and technology initiatives. 

Although legislation requires proactive communication with families, that communication is not required by those laws to be understandable or accessible. Some laws, such as the Family Educational Rights and Privacy Act (FERPA), require education agencies to notify parents about their rights and obligations. Others, including the Children’s Internet Protection Act, require education agencies to inform parents about their policies or practices. However, these policies might be written in dense legalese, in languages the parents do not read, or in an inaccessible format. Information that is shared with students and families should be accessible and easily understood. For instance, education agencies should explain their policies in plain language and should post their policies on a page of the agency’s website which is easy to locate. 

Build Capacity

A third — and related — best practice is for education agencies to help build capacity for students and families to fully understand certain aspects of how data and technology may be used while protecting student privacy. However, data privacy and technology legislation often fails to require capacity-building among communities. For instance, a Texas law passed this year requires Texas school districts to provide cybersecurity training to some of their employees, but not students or family members. Building capacity among community members allows them to meaningfully engage in an education agencies’ policymaking, which can broadly increase faith in an organization. 

Prioritize Inclusivity

Finally, practitioners should prioritize inclusivity within community engagement efforts. To be inclusive, community engagement practices should accommodate all parents by offering multiple modalities of engagement (e.g., in-person meetings, surveys, committee membership), ensuring accessibility to speakers of multiple languages, addressing barriers to participation (e.g., meals, childcare), and honoring different cultures. 

Laws that require engagement with particularly vulnerable communities around data and technology initiatives can help make community engagement efforts more inclusive, and in turn help education agencies create policies that are less likely to perpetuate existing inequities. Nonetheless, requiring engagement for some demographics does not guarantee engagement for all families and students, even within that demographic. 

For example, under the Individuals with Disabilities Education Act (IDEA), education agencies are required to engage students with disabilities and their parents on policies for students with disabilities, including development of evaluations and reporting data. However, advisory roles can be time- or resource-intensive, and IDEA does not address barriers to participation such as lack of childcare or language barriers. Parents are diverse, so different forms of outreach are critical for full inclusivity. 

Overall, existing legislation requires some community engagement around data privacy and technology laws, but falls short of best practices. To reap the benefits of community engagement, practitioners should strive to go above and beyond legislative compliance.