|
CETPA and legal partners at Fagen, Friedman and Fulfrost, have addressed the issue to questions that have been raised regarding the
FERPA and AB 1584 compliance with Google in its widespread use of G Suite.
An extensive analysis has been made of the G Suite privacy terms and conditions, including the G Suite Online Agreement.
Hundreds of school districts throughout California and the rest of the country use a suite of education products formerly called Google Applications for Education ("GAFE") and recently renamed G Suite for Education ("G Suite"). Questions have been raised as to whether G Suite complies with the Family Educational Rights and Privacy Act ("FERPA") found in 20 U.S.C. 1232(g), and California Assembly Bill ("AB") 1584 found in California Education Code section 49073.1. Both laws establish privacy protections for pupil records stored or analyzed by digital education providers. These protections include, but are not limited to:
(1) prohibitions against the unauthorized use of the records;
(2) requirements to allow a student or parent to access the records;
(3) disposal of the records at the end of the term of the agreement; and
(4) requirements to maintain adequate safeguards for the records, including notification of unauthorized access to pupil records.
The analysis found that central to determining privacy compliance is understanding that the G Suite privacy terms and conditions consist of more than just the G Suite Online Agreement. FERPA and AB 1584 requirements can be found in several additional G Suite documents, including but not limited to: the G Suite Privacy Notice; the Additional Terms for Use of Additional Services; and the Data Processing Amendment to G Suite Agreement.
When taken together, these documents show that G Suite likely complies with all material portions of FERPA and AB 1584. In most cases, the elements of the data privacy requirements are explicit in G Suite's privacy terms and conditions. However, some aspects of FERPA and AB 1584 requirements are not referenced verbatim in privacy terms and conditions. Some of those requirements require statutory interpretation to conclude that G Suite has met a particular data privacy requirement.
|
