TEC Student Data Privacy Alliance

Personally identifiable information (PII) is information that can be used to identify an individual, whether alone, such as with direct identifiers (e.g., name, SS#), or in combination with other data, such as indirect identifiers (e.g., D.O.B, address).

Many quality resources are available online to assist you. Visit our website to learn more and access some of these.

TEC’s DPA… 

• Gives school districts ownership & control of student data
• Defines how a vendor may & may not use student data
• Prohibits “targeted” advertising to students
• Gives school districts the right to audit a vendor
• Defines minimum acceptable data security requirements
• Requires timely district notification in the event of a data breach
• It’s a LEGAL and enforceable agreement between a vendor and the school district
• Once a DPA is signed by both parties, it supersedes a vendor’s Terms of Service and Privacy Policy where they conflict.

It also requires vendors to conduct criminal background checks on all its employees with access to students

TEC’s Student Data Privacy Agreements are legally enforceable documents, and vendors agree to comply with all applicable state-specific and federal privacy statutes, including the FERPA, PPRA, COPPA, and IDEA. A Privacy Pledge “is not intended as a comprehensive privacy policy nor to be inclusive of all requirements to achieve compliance with all applicable federal or state laws.”

No. Teachers cannot use anonymous names for students, as our attorney has shared that this still creates a ‘unique identifier’ tied to an individual student record, which is not allowed under FERPA.

Whether a resource is free or paid, if your employees are using them and there is a transfer of any student personally identifiable information (PII), as with login or rostering,  then you need a signed DPA, as your district is sharing students’ PII to a third party. It does not matter if a teacher pays for the resource on their own; they are still an employee of your district, and sharing student PII with a third party which requires either written parental consent or a DPA.

Our educational collaborative school districts launched the TEC SDPA because they could not afford the time, energy, and expense of contacting every software vendor to negotiate a DPA solely as SDPC members.TEC works to save your district time and money and accelerates the protection of your students’ data as we do the legwork for you.

Furthermore, all TEC SDPA schools and districts are “Basic” members of the Student Data Privacy Consortium with access to SDPC’s online Resource Registry platform. As a bonus, joining TEC’s Student Privacy Alliance connects you with the fastest-growing student data privacy network of school districts across multiple states. And one of  CISA’s K12 Recommendations is to  “work with other information-sharing organizations.”

You can refer to the Exhibit “A,” also known as the “Description of Services,”  in the full agreement to read which of the vendor’s products are covered by the DPA.

If a DPA is about to expire and a new one has not yet been signed (and this can be for several reasons, including that it is still in negotiations), you can enter it in as a “New Request” so that TEC can keep you informed of its progress and let you know when a new one becomes available. If you use the “View Expiring Agreements” renewal process, please refer to this video demo.

As TEC has grown and added staff, we have had to make some changes. Instead of assigning Ramah Hawley as the Progress Admin for your New Requests or Pending Renewals, you now need to choose TEC from the drop-down list. This action will notify us that your district seeks a DPA or a new renewal.

Yes. If you are seeking to be transparent about the digital resources in use within your district using SDPC’s platform, then you can follow these directions to add them to the Resource Registry for your district.

Unless you live in a state where the sharing of staff data is restricted, such as NH, teachers can create an educator account with all of their information, just as long as they are not providing any student information through that one account. Under FERPA, no student record information can be shared without written parent consent or where there is a legitimate educational interest with a signed DPA.

For instance, if a resource allows a teacher to log in and share a video or provide a demonstration to the whole class, then that would be acceptable, as no student information is being shared. However, if that resource allowed the teacher to enter in her class roster and assign specific assignments to individual students, that would be a problem, as PII has now been shared with that third party to provide that functionality.