COVID-19 Updates

Selecting an Online Platform for Student Services

If a school plans to use an online platform for distance learning, the school first needs to consider whether the platform will have access to student information during the provision of services or behind the scenes.

Direct Control over Student Data

A school needs to have direct control over any third-party provider it uses to provide services that involve student data. Direct control can be established either through a contract or other agreement, or through a relationship that qualifies as a school official with legitimate educational interest.

Direct control probably exists if:

  • The school retains ownership of information.
  • The platform does not collect or retain personal information.
  • If it does collect information, data access, collection, and use limited to what is needed for the service.
  • The platform has appropriate security guidelines.
  • Data is protected and not shared or sold.

Best practice is to secure a written agreement that addresses:

  • Security and data management
  • Data collection
  • Data use, retention, disclosure, and destruction
  • Data access
  • Modification, duration, and termination
  • Indemnification and warranty

If the platform uses a click-thru or terms of service (TOS) agreement, which requires only a click agreement (e.g., an I Accept button), always read the terms to determine if an appropriate level of direct control exists.

Other Best Practices

  1. Have policies and procedures for evaluating and approving proposed services (educators should all follow the same guidelines).
  2. Be transparent: Tell parents your processes, and your vendor’s processes, who has access, etc.
  3. Consider parental consent (can solve many issues).
  4. Use a written agreement with your providers. Have guidelines for acceptable providers with a TOS-only agreement arrangement.
  5. Review procedures and agreements on a periodic basis.

Where to Go for More Information

The U.S. Department of Education has guidance for schools that work with online providers and its studentprivacy.ed.gov site has additional privacy guidance.

Schools should seriously consider consulting their legal counsel for additional guidance about working with a third-party online service provider.