Sunday, May 2, 2010

Privacy with Free, Foreign, or Shared IT Services

It’s amazing how quickly the menu of IT services has filled out.  I remember back in 1992 when I was asked to connect my employer of the day to the Internet.  I wasn’t quite sure what that meant or where to turn to do it.  It was difficult, expensive, and slow…  18 years later, the Internet is the underpinning to everything we do.

We have many teachers and students that use free Internet services such as imagefor encyclopedia, imagefor finding info, people, tools, and storing / sharing documents, imagefor instant messaging, storing documents, networking, imagefor access and storing / sharing educational videos, imagefor screen casting lessons, imagefor professional networking, imageto host their blogs, and imageto write collaboratively.  I am interested in what steps teachers or Districts take to address privacy concerns with free services.  I know in our District it’s not a formalized process.  Teachers learn from others and use their own good judgment to take certain precautions.  They may create class, instead of student personal, blogs.  They might create “fake” names for their students to use.  They “probably” monitor student created content for acceptable language. 

A lawyer asked me a question the other day, while discussing the topic of privacy, District and teacher responsibilities, etc. in an online world: “are we acting like a firm and judicious parent”?  In other words are we educating teachers, students, and parents and providing guidelines for using online tools in a safe manner including protecting student privacy.  I think in our case, we’re lacking in this area.

I have been looking at the services we run in-house such as email for students, and wondering why we offer such a service.  Students, as they reach the middle years (grade 6-8), are often obtaining their own personal email accounts.  We provide accounts to make it easier for teachers to exchange mail with their students and to be able to monitor.  The cost required to provide email for students isn’t tremendous but it is significant enough for the hardware, storage, licensing, upgrades, etc. required.  Microsoft has offered to host student email for free with theirimageservice.  They will configure it so that the student’s District network login and their mailbox is linked – their email address would remain the same as it is now.  District IT staff would administer the mailboxes, teachers would still have access to monitor, etc.  I think it’s a great opportunity! 

So, what’s stopping us?  A main issue is the USA Patriot Act and the conflict it creates with our BC FIPPA privacy legislation.  You can read more about a BC privacy commission opinion on this here if you like but this and what our lawyer told me indicates we cannot take advantage of Microsoft’s offer.  Our lawyer explained that with consent of a person we could have certain District personal information stored outside Canada.  However, minors (our students) cannot give consent.  We can’t obtain it from their parents either.  A court of law would have to grant consent. We are obligated as a public entity to demonstrate reasonable control over the information including who could access it.  The USA Patriot Act grants the US Gov’t certain powers over US company’s and their information holdings which means any of our information stored by a US company would potentially be within the reach of the US Gov’t, outside of our control.  My understanding then is that moving any of our student related information and services outside of Canada is prohibited by law.

Shared IT services are gaining interest in British Columbia for school districts.  Our first effort in this area was image, the BC Enterprise Student Information System. It is hosted by a Vancouver company and the system is operated / maintained by Fujitsu Canada on behalf of all school districts and the BC Ministry of Education.  There is work underway to attempt to move payroll and HR IT systems into a shared IT services model as well.  I met a few weeks ago with several of my colleagues in neighboring school districts and we created a list of possible shared IT services and considered which we felt would make the most sense.  Personally, I have mixed feelings about shared IT services – an organization has to give up a lot of control, choice, and flexibility for this to work.  It can be very expensive, frustrating, and difficult to manage, govern, and continuously improve.  I think the main advantage of BC-based shared IT services vs. foreign hosted in this context is that the information is protected by BC privacy legislation.  I’m mixed on the advantages of shared vs. in-house…  we run a fairly lean shop and I’m not convinced yet that shared IT services are less costly or experience better service.

I worry about the privacy teachers, students, families are giving up every day by tapping into free online services.  I’m one of them though – I write this blog post using Windows Live Writer (free tool  from Windows Live) and will post it to Blogspot (Google’s free blog service), and promote it with Twitter (a free networking tool).  For these three services, I have three different accounts and personal information, ideas, etc. about me are stored and accessible to others online.

I think it will become more and more important to create good guidance for using free and other online tools in our classrooms.  Our lawyer advised as much and that we need to create educational programs to support our teachers, students, and their parents.

I would love to hear from others about what you are doing in this area. Do you have modern guidelines for using online tools in safe ways that protect student privacy where necessary – could you share the guidelines?  What education do you provide to teachers, students, and families?