NYC Parent Sounds Alarm on Student Privacy

Parent advocate Leonie Haimson wants more New York parents to know that the state has agreed to share sensitive information about their children’s education with a national data-sharing system run by inBloom.  While state and city officials have tried to reassure families that privacy is a top priority for them, concerns remain. She answers some of our questions about inBloom Inc.

Q: What is inBloom Inc.?

A: inBloom Inc. is a non-profit organization, funded by the Bill &Melinda Gates Foundation and the Carnegie Corporation of New York, to the tune of $100 million. Its website says it was created to help states and districts "record student information, administer tests, analyze performance, train teachers and share lesson plans to support personalized learning.”

The data about individual students are stored on a cloud run by, with an operating system created by Wireless/Amplify, a subsidiary of News Corporation. inBloom plans to share the data with for-profit vendors as well as non-profits with state and district consent.


Q: What states and districts are participating?

A: At least nine states originally planned to share student data with inBloom.  After protests, four states have withdrawn or claimed they never intended to share data in the first place: Louisiana, Kentucky, Delaware, and Georgia. Two states, Massachusetts and North Carolina, are on record as reconsidering their plans. In Illinois, two school districts are participating and state officials said they intended to expand the program to 35 districts in 2014, including Chicago.  

New York is currently the only inBloom client sharing statewide student data for its entire regular public and charter school systems.


Q: What data is being shared with inBloom?  

A: inBloom Inc. is planning to collect about 400 student and teacher data points, going back as far as 2006.  Some of these data points are highly sensitive. New York officials said they are sharing student names, test scores, home addresses, grades, disciplinary and attendance data, economic and racial status, and “program participation”, including “whether or not a student is entitled to special education, 504 indicator, English Language Learner educational services and accommodations.”  

inBloom is also collecting teacher data, including names, addresses, social security numbers, and detailed employment histories.  It is not clear if New York is sharing this teacher data as well with inBloom.


Q: Who has opposed this?  

A: Parents, teachers, advocacy groups and privacy experts throughout the country have protested this unprecedented plan to share children’s sensitive information with private corporations and for-profit vendors.

New York organizations opposing this data-mining include Class Size Matters, the Learning Disability Association of New York, Alliance for Quality Education, New York State Allies for Education and the Coalition for Educational Justice. These groups have pointed out that a breach of this highly sensitive information, or its inappropriate use, could put children’s safety at risk.

The New York City comptroller, public advocate, State Assembly Speaker Sheldon Silver, as well as Cathy Nolan, chair of the assembly education committee, and Robert Jackson, the chair of the City Council education committee, are on record against the disclosure of student data without parental notification and consent.


Q: Is this being done with parental consent, and if not, doesn’t this violate legal privacy protections?  

A: Representatives from inBloom and the Gates Foundation said it would be up to states and districts to decide what their parental notification and opt-out policies will be.  According to a spokesman for the New York State Education Department, parents have no right to opt out or consent, because "when parents register a child for school they give up” the right to keep their children’s information private.

NYSED defends its position by saying that they are compliant with FERPA, or the Family Educational Rights and Privacy Act, the federal law that governs student privacy. FERPA’s regulations were rewritten in 2009 and again in 2012 to facilitate the sharing of confidential student data without parental consent.

The Electronic Privacy Information Center has filed a lawsuit against the U.S. Department of Education on the grounds that the federal government has weakened FERPA’s regulations in a way that violates the language and original intent of the law.


Q: What does inBloom have to do with the federal program called Race to the Top?  

A: States received points in their Race to the Top applications if they agreed to create data systems to support instruction. New York State is requiring any school district that received federal funds to sign onto one of the “data portals” produced by three vendors who will gain access to the data from the inBloom cloud. Still, student data from all districts will be uploaded, whether they received Race to the Top funds or not. 


Q: Didn’t ARIS provide data dashboards to NYC schools?

A: Yes. The city spent $100 million building the ARIS data system which was supposed to produce many of the same benefits to teachers and students inBloom promises to provide.  

In fact, Sharren Bates, the chief product officer of inBloom, was formerly in charge of the ARIS project for New York City.  ARIS is widely considered a failure and, according to independent studies, is rarely used by teachers or parents.  City officials said they would allow ARIS to lapse as soon as the new data dashboards are operable.  


Q: How much will inBloom cost?  

A: Starting in 2015, inBloom says it will charge states and districts between $2 and $5 per student each year for storing the data.  These fees do not count the additional costs charged by vendors if states and districts sign up for other software or hardware products that will receive data populated through the inBloom cloud.

As of now, it is uncertain whether the state or districts will be obligated to pay these fees and whether a district will be able to pull out of inBloom if it chooses not to cover the costs.


Q: Is the data being sold?

A: Currently, New York State and New York City are providing this valuable data to inBloom for free and they, as well as inBloom, insist that the data will never be sold.  

However, inBloom board members have said that inBloom is “exploring cost recovery partnerships with select vendors for the services that it provides.”  If not selling the data, this could be likened to renting it out.


Q: What about the security of the inBloom cloud?  

A: Though inBloom and New York officials claimed the cloud storage used in this project “exceed the security measures in place currently in most states and school districts,” many experts question the safety of cloud storage.

A survey of technology professionals found that 86 percent do not trust clouds to store their more sensitive information. inBloom has warned that it “cannot guarantee the security of the information stored...or that the information will not be intercepted when it is being transmitted.”


Q: What can parents do to stop this data-sharing?

A: Two bills to protect student privacy passed the state assembly in the last session.  A.6059A would have blocked re-disclosures without parental consent, and A.7872A would have allowed parents the right to opt out of the state or district being able to share their child’s data with third parties. A similar bill did not pass the state senate.

I believe parents, advocates and concerned citizens should urge their legislators, their school boards and state education officials to pull all student data out of inBloom as soon as possible. The risks of sharing this data with vendors far outweigh the potential benefits.  A sample letter, which also asks school boards to hold a public meeting and disclose what their current data sharing practices are, is posted here