The latest technology and digital news on the web

Powered by

How your aggregation can limit its accountability for US data accumulating lawsuits

  • Tech
  • Data security
  • Lawsuit
  • privacy
  • COVID-19

How your aggregation can limit its accountability for US data accumulating lawsuits

Implement COPPA notices, delete old data, and be anxious about absence settings, among other best practices.

Built In
Story by
Built In

This commodity was originally appear by Built In.

As families and schools across the country adjust to the new normal of remote learning, litigants are branch to court claiming that the very technologies that make remote acquirements achievable may be impermissibly accession children’s claimed data.

Allegations that remote acquirements tools are actionable the Children’s Online Aloofness Protection Act are coming from both state and clandestine litigants. COPPA requires online providers that aggregate the data of accouchement under 13 years of age to take specific measures to assure that data, including aloofness policies, affectionate accord and reasonable data aegis practices.

In the remote acquirements context, the Federal Trade Commission has issued guidance stating that schools can accord on behalf of parents to the accumulating of students’ claimed information, provided the advice is used for a school-authorized educational purpose and is not used for any bartering purpose. For the school to consent, the remote acquirements provider must accommodate COPPA-compliant notices of its data collection, use and aegis practices to the school.

Notably, the FTC bases this barring to affectionate accord on its 1999 COPPA Rule, which states that COPPA “does not avert schools from acting as intermediaries amid operators and schools in the notice and accord process, or from confined as the parents agent in the process,” but it has not yet especially codification the exception. Last summer, the FTC sought added comments on the contours of the barring should it be codified.

Whether the claimed advice calm by the provider is solely used for school-authorized educational purposes appears to be a basis for abeyant liability. In a recent lawsuit brought by New Mexico’s advocate general, the state claimed that Google’s apprenticeship belvedere calm students’ claimed advice for its own bartering purposes.

The complaint claims that the belvedere tracks and monitors students’ web-browsing activities for bartering purposes, such as its own artefact advance and development. In its recent appeal for comments, the FTC accurately sought opinions as to whether or not operators should be able to use students’ data for artefact improvement.

COPPA is not the only abeyant player in remote acquirements litigation. The Illinois Biometric Advice Aloofness Act (BIPA) provides addition trap: an individual’s biometric data — including voice or facial scans and including the biometric data of accouchement — cannot be calm or stored by a clandestine entity after accepting abreast consent.

Another recent lawsuit filed in California federal court claims that Google’s apprenticeship belvedere collects the unique voiceprints and facial scans of acceptance in abuse of BIPA after allegorical or accepting a absolution from parents. Unlike COPPA, BIPA’s restrictions are not bound to bartering activity. If biometric identifiers are collected, abreast accord is required. And, unlike COPPA, there is no barring for schools to accord to accumulating on behalf of students.

The quick switch to remote acquirements may have caught some off guard — indeed, many schools across the country that initially accustomed agents to use Zoom videoconferencing for educational purposes abruptly banned use of the belvedere after Federal Bureau of Investigation warnings over its aegis functions. Luckily, remote acquirements providers can slow the spread of action by implementing several best practices:

Prohibit data use/collection beyond accustomed educational purposes

Platforms should avoid using claimed data alfresco of the specific, school-authorized educational purpose. Until more accuracy is provided from the FTC, providers should also avoid using students’ alone data for centralized artefact development or improvement.

Implement and accommodate COPPA notices

Even where schools may accord on students’ behalf, the FTC recommends that parents be provided a provider’s COPPA notice. Providers should accede acute that schools accommodate these disclosures to parents as a part of the providers’ account agreements with schools.

Routinely delete old data

Schools can only accord on behalf of acceptance if the school can review and appeal the abatement of claimed advice calm from its students. Providers should accede implementing proactive data abatement behavior to ensure apprentice data is not retained any longer than necessary, which may mean as bound as the end of the school year.

Be anxious about absence settings

Avoid absence settings that might aggregate non-educational data. For example, the accusation filed by the New Mexico advocate accepted alleges that Google’s absence sync action automatically uploaded student’s online browsing habits to Google’s server when acceptance logged into their accounts. Though an option to turn off the absence sync ambience exists, the complaint alleges that it was buried in settings parents were not likely to see. At bottom, COPPA is advised to notify parents and give them the choice to consent. Therefore, it is not acceptable to accommodate a way to abolish accumulating — providers must obtain consent  to collection.

Consider state aloofness laws

Remote learning providers must also accede state laws apropos apprentice data. Arizona, for example, requires that vendor affairs accommodate accurate accoutrement prohibiting accessory uses of apprentice data after affectionate consent. In the wake of COVID-19, Connecticut briefly waived its apprentice data aloofness law acute schools and vendors to enter accounting affairs ensuring apprentice data will not be used for any purposes alfresco of the stated purposes of the contracts. They saw this as all-important to ensure remote acquirements could be bound rolled out to Connecticut students.

As these recent lawsuits show, both states and the public expect a high level of albatross apropos the advice that is calm by remote acquirements platforms — no small order because the speed with which schools have had to pivot to remote acquirements due to COVID-19. Regardless of the abeyant accountability remote acquirements providers may face, complete and upfront acknowledgment of data accumulating by the provider is the best way to limit accountability in aloofness claims.

Appear July 27, 2020 — 13:00 UTC

Hottest related news