Parents alarmed after hearing about California student data transfer

Parents across California have grown concerned after learning that a Sacramento-based federal judge ordered the state Department of Education to release sensitive records for more than 10 million schoolchildren to lawyers and consultants representing special education advocates.

The records include names, some Social Security numbers, home addresses, disciplinary records, medical information and progress reports for students who have attended a California public school since Jan. 1, 2008. Under U.S. District Judge Kimberly J. Mueller’s order, access to the data would be tightly controlled by a special master with expertise in cybersecurity.

Parents can register an objection to having their child’s records released but not electronically or by phone. Instead, they must print out a form and send it by mail to Mueller’s office by April 1.

The order has elevated a little-known court case that began when the Morgan Hill Concerned Parents Association alleged in December 2011 that special needs students in the Santa Clara County community have not received a legally required level of public education.

But the scope of the data release has infuriated many parents. Nancy Griffin said she is sympathetic to the interests of the plaintiffs. But she believes the judge’s order involves too much sensitive information, including records belonging to her daughter, who graduated from Rio Americano High School in 2008.

The records pertain to 6.2 million current students and about 4 million previously enrolled.

“A data dump going back to 2008 disturbs me,” she said. “(Some of) these students are now 25 years old. I’m not sure they would want their report cards and progress reports pawed through without understanding the necessity of it. This strikes me as an overly broad amount of data for somebody to sift through.”

Under a process set out by the court, a special master with cybersecurity experience is responsible for ensuring that the data is protected. In a document filed with the court last year, the special master said he “has significant concern about the storage and use of the highly sensitive student data” the state will provide. He noted that a security breach could result in notifying millions of people under state and federal requirements at a cost of millions of dollars.

To guard against that, he proposed a series of risk assessments and safeguards, including a record of all devices and people who access the information. He also suggested that data be fully encrypted. Mueller’s order bars any public disclosure beyond the parties involved in the federal case, their attorneys, consultants, the special master and the court.

The data include Social Security numbers principally for the estimated 10 percent enrolled in special education, according to state Department of Education spokesman Peter Tira. Districts historically have relied on Social Security numbers to track special education students, but created unique identifiers for other students.

In April 2012, the larger and newly created Concerned Parents Association joined the Morgan Hill parents group as a plaintiff. The larger organization represents parents of special needs children at more than 70 school districts in the state, including those in Sacramento and Placer counties, according to the group’s website.

The plaintiffs now seek to show that the state agency is systematically failing to monitor, investigate and correct public schools’ non-compliance with federal and state laws. They say the judge’s order came after several frustrating years of failing to obtain data.

“When (the state) did provide information, it was token in nature and in such a small amount that the plaintiffs’ questions couldn’t be answered,” said Christine English, vice president of Concerned Parents Association.

English said plaintiffs need the larger pool of data to, among other things, learn how many students are denied access to special education programs but not properly assessed.

“Forty to 50 percent of our case revolves around kids who have not been identified, who were refused assessment,” said Linda McNulty, a former Morgan Hill resident who represents the Morgan Hill plaintiffs and has a child with autism.

She said reaction over the privacy issue has turned “ugly and nasty.”

“We had to shut our Facebook page down,” she said. “People were threatening us.”

State Superintendent Tom Torlakson said on the state’s website that the state Department of Education provided plaintiffs last year with all of the information from a California Special Education Management Information System database that includes records of special education students and those being tested for special needs, but with personally identifiable information removed.

Tira said that plaintiffs feel “nothing we’ve provided has been good enough or satisfactory enough. We’re extremely protective of the privacy of students and our families. That’s where we are.”

He said the agency is working with the state Attorney General’s Office to plan the next step in fighting the order.

The federal Family Educational Rights and Privacy Act protects student information, according to a letter that Torlakson wrote to districts on Feb. 2. But he said courts can force agencies to provide the data.

Torlakson urged school districts and county offices of education around the state to provide online links for parents to file an “Objection to Disclosure” form with the federal court. It’s unclear whether submitting the form guarantees removal from the data transfer.

“It’s an objection letter,” Tira said. “It’s up to the court to decide what they do with those letters.”

The Davis Joint Unified School District this week drew a handful of posts about the case on its Facebook page. The Folsom Cordova Unified School District posted an announcement about the case on its home page. And the Sacramento City Unified School District made automated calls to families on Thursday night informing them of the legal case and advising how parents could file an objection.

Some education organizations were critical.

“It’s hard to fathom that a judge would allow such an overexposure of children’s information,” said California State PTA President Justine Fischer in a statement.

James P. Steyer, CEO and founder of Common Sense Media, said in an email that parents are rightly concerned about their child’s data being handled and used without their consent or knowledge. His group, a nonprofit that advocates for parents, has taken a lead role in issues affecting student data security and privacy.

“The various parties involved in this matter could have the best intentions in the world,” Steyer said. “But the reality is, no one can assure parents that their child’s data will not end up in the wrong hands, and the risks increase every time data is shared.”

John Affeldt of Public Advocates said there needs to be a balance between ensuring that “state agencies are performing their duties to serve all students, which people have a right to challenge and litigate” and, on the other hand, making sure that privacy rights of innocent parties are protected.”

Those parties are “people who didn’t thrust themselves into the fray,” he said.