How to Protect Students’ Data when building Educational Apps

Apps collect a lot of data on us, but we can make our own decisions on what is and isn’t acceptable. When it’s the data collection of students however, the stakes are much higher. When you’re building educational apps, you need to take extra care with any date you collect from students. Let’s take a look some concerns with collecting data from students, and how to best protect the privacy and security student data.

What makes student data collection different

There are two main factors that make data collection of students different from individuals. They are: mandatory use and data about a higher-risk demographic.

Students often don’t have a say on what platforms their school makes them to use. It is usually state departments, school districts or education institutions that make these decisions, often without talking to the school community. This takes the privacy and security of students’ data out of their hands. Parents especially often have a different idea on what is ‘okay’ in these situations. So even if a school approves the use of an app, it doesn’t mean families will be happy. This can potentially lead to students missing out on key learning experiences if they refuse to use a platform.

While some users may be in postsecondary education, most are not. Educational app users are generally younger, usually in primary or high school. Their low age puts them in a higher-risk demographic, both legally and ethically.

Young users often cannot understand the consequences of data collection, with their family or teachers often making decisions.

They are also at a much higher risk in situations where their personal information ends up in data breaches or if their personal data is misused. Younger students have not yet built knowledge and experience in things like detecting fraudulent messages or harmful content. This makes them especially susceptible to poor influences or starting risky behaviour.

Ultimately, what schools need is safe learning environments. Collecting data shouldn’t get in the way of the educational context any services are in. Both parents and students need to feel safe and be protected from harm. So how should you go about protecting the privacy and security of student data?

Tips to protect the privacy and security of student data

Data Collection

The first stage to any data workflow is collection. There are four key pieces of advice to consider when collecting data from students:

1. Don’t collect any more data than you need to. While platforms usually collect a lot of user data, educational apps shouldn’t collect any more than necessary. It can be good to give institutions or students themselves the tools to fine-tune what data they share. Having the default for any data that isn’t strictly necessary can also built trust with your users.
2. Don’t use any information for dubious reasons. The data you collect should have a clear purpose, and that should be to provide students and educators the best experience you can. Data should not be collected to track or profile students. If in doubt, consider whether the use gives any tangible benefit to your users.
3. Be transparent and upfront about why you are collecting data. This gives peace-of-mind to educators, students and their parents, which is always a good thing. It also gives you a clear line between what is and isn’t acceptable use into the future. Being transparent is more than just hiding information in a privacy policy; consider how you can clearly display information to educators, students and parents the first time data is collected.
4. Anonymise as much as you can. This can be done a few different ways, but the easiest is to only collect anonymised data. It’s common to collect usage information to improve software, so if you are doing this, don’t collect any identifiable information. Try collecting less specific data, such as age groups instead of specific ages, and never have this data linked to any students.

Data Transmission and Storage

Once you know what data you are collecting and the purposes, you need to take great care when transmitting and storing the information. Consider the following four tips when doing this:

1. Never transmit or store any unencrypted data. This may seem like common sense, but many companies still fall short here. Take the time to ensure your systems are robust and meet modern security standards. As technology evolves, so do the threats you will face, so keep everything up-to-date and follow best practices.
2. Implement strict access control policies. The best way to ensure data isn’t misused is to control who can access to it. Keep access logs and implement strict need-to-know and least-privilege rules to make sure any attack surfaces are small.
3. Be extremely cautious sharing any information you have collected. Always get explicit permission from the relevant parties (educators, students and parents) before sharing anything. As soon as you send any data anywhere, you lose control over what happens to it. Even if you have the best security and follow best practices, if you can’t be certain where their data ends up, that could be all for nothing. Often, the easiest way to protect the confidentiality of student data is by not sharing it at all.
4. Implement short data retention policies. Some information is not required forever, such as any data required for verification. So don’t hold data for any longer than you need to, and when you’re done, make sure it’s destroyed and not just hidden.

Governmental Regulations

Depending on the regions you operate in, you will need to follow certain regulations. These are always a good starting point to build your privacy and security practises, so it’s vital you are compliant with them.

1. Make sure you know about all regulations that apply to you. This can be those where you base your business, store your data, or in any regions you operate. Different regions have their own data privacy regulations, such as the COPPA or the GDPR, or those specific to education such as FERPA.
2. Keep up-to-date on new laws and changing regulations. Governments are constantly passing new laws, so there will always be something new. It is critical to stay informed as, if you don’t, you may be non-compliant, face fines or worse.

Conclusion

Protecting the privacy and security of student data should be your #1 priority. When building educational apps, your focus should be on making the app as useful and informative as possible while leaving the poor practices and excessive data collection at the door. With useful tools such as the Student Privacy Pledge going away, it’s becoming harder to know who to trust.