On April 7, U.S. House of Representatives member Cathy McMorris Rodgers and Senator Maria Cantwell released a draft of a bipartisan federal privacy bill, the American Privacy Rights Act of 2024, which protects, among other things, student privacy.
The proposed bill aims to “put people in control of their own personal data” and “eliminate the patchwork of state laws by setting one national privacy standard.”
If adopted, the APRA would supersede state privacy laws. In the interim, some states have established their own data privacy laws, most recently being Florida, Oregon, and Texas.
The Florida Digital Bill of Rights (FDBR), the Oregon Consumer Privacy Act (OCPA), and the Texas Data Security and Privacy Act (TDPSA), which all went into effect July 1, largely apply to those who conduct business in those states or produce a product or service used by residents in those states, and who also process or sell personal data.
Other states that have enacted similar privacy regulations include California, Connecticut, Colorado, Virginia, and Utah.
Both K-12 and colleges process and store student personal data, such as addresses, birthdays, and disciplinary records. Most also store footage from security cameras that contain personally identifiable information such as student faces, which comes with unique privacy challenges.
SSI’s sister publication, Campus Safety, recently did a Q&A with Simon Randall, CEO and co-founder of Pimloc, a security and privacy company that specializes in helping educational institutions implement effective privacy solutions, to get a more complete picture of how student privacy varies by state.
Q&A: Video Surveillance and Student Privacy
Campus Safety: Why is video privacy a critical issue for educational institutions today?
Simon Randall: There is a growing volume of video now being captured in educational settings including schools, universities, and daycares. This covers footage from CCTV for security and video captured for classroom training and monitoring, along with images and video captured to document student developments and for marketing purposes.
Many schools are also beginning to experiment with video analytics and other biometric technologies to help save time and increase school efficiency. Educational institutions need scalable privacy solutions that allow for the management of permissions and usage of images and video for data compliance and child safeguarding, and to allow for responsible data sharing to aid learning and analysis.
As we know, schools are particularly vulnerable environments. Protecting all students of all ages and needs – from both a safeguarding perspective and when considering personal data captured – is vital. This includes personal and medical records and visual data from video – all of which, in the context of children, are considered extremely sensitive and need to be kept secure and private.
Yet, CCTV footage may be requested from an incident in the form of an education record under the Family Educational Rights and Privacy Act (FERPA). In an educational setting, such requests can be made by parents or students, making it essential for institutions to ensure that any released footage protects the privacy of other individuals featured in the footage.
Removing Personally Identifiable Information in School Video Footage
CS: Can you share the best practices for protecting personally identifiable information (PII) in video footage captured by educational institutions?
SR: When handling video footage, especially in response to a formal request, it is crucial to adhere to best practices to protect the PII of all individuals involved. Often, schools may invite parents or the relevant authority to the premises and show them the footage in-house, believing that’s sufficient. Others may send a cut-down clip of an incident without further editing, leaving the faces of other parties visible. Both practices are incorrect and can lead to a breach of data privacy for those individuals captured in the video.
The first step is to inform internal HR about the request and log it accordingly. Second, verify the identity of the student making the request. If the request is made on behalf of a student, ensure there is proof that the child has consented to the request or that they are not competent to do so themselves.
Once the request is validated, locate the video footage from the relevant incident or time period. Upload the video to an automatic redaction platform that applies redaction boxes to personal data. It is important to review these redaction boxes within the platform before downloading the final redacted video to ensure all PII is properly obscured.
