Mark Zuckerberg, chief executive and founder of Facebook, waits to begin a joint hearing of the Senate Judiciary and Commerce Committees in Washington on April 10. (Andrew Harrer/Bloomberg News)

Business Insider published a list of the biggest data breaches reported in 2018, and if you look, you can find Mark Zuckerberg’s Facebook involved in two of the top 10. A third involved Chegg, an American education technology company that rents textbooks online and provides other student help such as tutoring.

Tens of millions of accounts were breached by unauthorized actors who stole personal data that companies had promised to protect, which helps explain why some parents and students have become increasingly concerned about online education platforms that hold sensitive data about children.

To add insult to injury, the New York Times just reported that Facebook gave major technology firms far more access to the private data of users than it has ever publicly disclosed. The article says, for example, that Facebook “gave Netflix and Spotify the ability to read Facebook users’ private messages.”

Zuckerberg, of course, has repeatedly promised to keep personal data secure on Facebook, but Facebook has repeatedly been found not to have lived up to that promise.

This has become especially relevant amid the rise of what is called “personalized learning,” a term often used to describe online programs that collect data on individual students and then can supposedly adapt the material to that student based on achievement.

This post is a primer of sorts for parents about the Summit online learning system, a joint project of Facebook and a charter school network called Summit Public Schools, about which student data privacy issues have been raised for a few years. In 2016, for example, The Washington Post published a story expressing concerns, and this year, some students and parents rebelled against it in districts around the country.

The free platform, which offers online lessons and assessments, is backed by Zuckerberg and his wife, Priscilla Chan, with engineering support through their for-profit Chan Zuckerberg Initiative. The Summit website says the platform is a “personalized, research-backed approach” to teaching and learning.

The following was written by Leonie Haimson, an advocate for public schools in New York, who has been monitoring Summit for two years and said parents in 15 states have reached out to her with complaints. Haimson is co-chair of the Parent Coalition for Student Privacy. She successfully led the battle to stop nine states from disclosing personal student data to a student database project called inBloom.

I asked Summit and the Chan-Zuckerberg Initiative for comments. They can be found in full at the end of this post.

By Leonie Haimson

High school students recently walked out of the Secondary School for Journalism in Brooklyn to protest the Summit online learning system, which had been implemented in their school. Then parents in Kettle Moraine district in Wisconsin announced they would start a charter school, unhappy with the district’s use of the Summit system and its overemphasis on a “digital learning culture.”

Parents and students have now rebelled against Summit Learning in New York City, Chicago, Cheshire school district in Connecticut, Boone County in Kentucky, Fairview Park City School District in Ohio, New Egypt High School in New Jersey, the Indiana Area School District in Pennsylvania, Clearwater in Idaho, McPherson in Kansas, and elsewhere.

Over the last year or so, I have heard from parents in 15 states, deeply worried with the way the Summit system has caused their children to develop a negative attitude to school because of excessive screen time and insufficient interaction with their teachers and fellow classmates.

The platform was initially created by the Summit chain of charter schools in California and further refined with the help of software engineers at Facebook. It is now being run with software support from the Chan-Zuckerberg Initiative, a for-profit LLC headquartered in California, founded by Facebook founder and billionaire Mark Zuckerberg.

Since the 2015-2016 school year, the use of the Summit online program or PLP (personalized learning platform) has expanded into more than 300 public schools. Next year, the management and operation of the platform will be spun off into an entirely separate nonprofit corporation, governed by a four-person board led by Mark Zuckerberg’s wife, Priscilla Chan, and the CZI chief financial officer, Peggy Alford.

During the first two years of the Summit platform, parents at public schools using the program were required to give their consent to the collection of their children’s personal data, but shortly after CZI took over technical support in March 2017, Summit announced that parents would no longer have that right. See the excerpt from this Summit FAQ, which is no longer available online but accessible via the Wayback Machine:

You used to require parental consent, why has your approach changed?

We heard directly from our partner schools and districts that they have established processes for making instructional decisions—such as adopting a textbook series or curriculum—to meet the needs of their students.  The Summit Learning Platform is a teaching and learning tool that includes a comprehensive 6th-12th grade curricula in English, math, science, Spanish, and social studies—as well as all the tools and learning resources students and teachers need for the school year. We want to respect each school’s process. Therefore each school’s leadership and teaching team will determine whether to use Summit Learning on behalf of their community.

An extraordinary amount of personal student information is being collected and data-mined by Summit. According to their privacy policy, this information includes student and parent names and email addresses; student ID numbers, attendance, suspension and expulsion records; their disabilities, gender, race, ethnicity and socioeconomic status; their dates of birth, completed homework assignments, teacher feedback and observations; their grade promotion or retention records, their test scores, college admissions, survey responses, homework assignments, extracurricular activities and more.

Summit states in its privacy policy that it plans to track students even after graduation, by accessing their college attendance records and careers. An unspecified amount of teacher data is also collected, “including, but not limited to, name and years of experience.” It is unclear why Summit needs all this data, and what they intend to do with it, though they promise not to sell the data or use it for marketing purposes.

Summit also admits to sharing the data with 19 corporate “providers,” including CZI. Though it says these providers are authorized to use the data only for the purpose of operating and improving the platform, there is no independent oversight to ensure that this occurs.

As the Brooklyn students eloquently asked in a letter they sent to Zuckerberg, “What gives you this right, and why weren’t we asked about this before you and Summit invaded our privacy in this way?”

Clearly, the concerns of parents and students about the potential use and misuse of all this personal data have been intensified because of the involvement of first Facebook and now CZI. In recent months, Mark Zuckerberg has faced multiple lawsuits and legal complaints about his repeated privacy violations and Facebook’s role in purveying fake news.

In September, nearly 50 million Facebook users had their accounts hacked. In early November, another set of hackers announced they had successfully stolen the private messages of some 120 million Facebook users, with the messages of 80,000 users released. Just this week, the New York Times revealed that Facebook shared the personal information and private messages of millions of users with an entire array of other tech giants, which they call their “partners,” without the user’s knowledge or consent.

Zuckerberg has repeatedly allowed various companies to access and manipulate personal data for commercial and political gain without user consent even while promising repeatedly to take steps to protect this data. He has now refused to testify before a joint Parliamentary committee composed of government officials from Britain, Argentina, Brazil, Canada, Ireland, Latvia and Singapore about his practices. As the title of a recent article by Nick Bilton, who has covered Zuckerberg for many years, puts it, “Mark Zuckerberg Has Never Cared About Your Privacy, and He’s Not Going to Change.”

So what should parents know? Though few if any schools or districts using Summit have informed them of their rights, parents do have the ability to demand that their children’s data be deleted from the Summit database, according to the Summit Privacy Center:

“Summit does not own your personal information. Students and their families can request deletion of their personal information from their schools at any time and we will honor the school’s request.”

Parents also have the right to opt out of Directory Information (student name, email, address etc.) from being shared with the company, according to the Summit Data Privacy Addendum:

“Partner School represents, warrants, and covenants to Summit that it shall not provide information to Summit from any student or parent/legal guardian that has opted out of the disclosure of Directory Information. Summit depends on Partner School to ensure that the Partner School is complying with the FERPA provisions regarding the disclosure of any student information that will be shared with Summit.”

Any parent who is concerned about how their children’s data may be used, misused, shared or breached by Summit, Zuckerberg, any of their 19 corporate providers, or the new Zuckerberg-Chan corporation that will soon take over the platform, can demand that their children’s data be deleted from the program. They can also opt out of their child’s directory information being provided to Summit by schools.

A sample letter is available on the Parent Coalition for Student Privacy’s Summit fact sheet, as well as more information and a bibliography about the nationwide parent and student pushback. The coalition’s Parent Toolkit for Student Privacy contains more information about how parents can better protect their children’s privacy, including advocacy tools that can be used to persuade your school or district to adopt stronger privacy practices and policies.

————

Here are responses to privacy concerns about Summit from both the Chan Zuckerberg Initiative and Summit Public Schools.

From Raymonde Charles, communications director for the Chan Zuckerberg Initiative:

“As part of the Chan Zuckerberg Initiative’s (CZI) commitment to education and our goal of empowering teachers to better meet students' individual needs in the classroom, we’re building free tech tools for schools and have no commercial aspirations in the space.  To put a finer point on it, we don’t own or sell student information — and have no intention to. We are strongly committed to safeguarding the privacy and security of students’ personal information — and we adhere to rigorous privacy policies and are proud signers of the Student Privacy Pledge.  As it relates to CZI’s technical support for the Summit Learning Program, we comply with the privacy policy that Summit has set for all of the service providers supporting the operation and development of the Learning Program. All Summit and CZI  staff who work on the Learning Program also undergo thorough training on protecting the privacy and security of student information.”

Here’s a statement from Summit Public Schools:

Summit Public Schools takes the protection of student personal information very seriously. When developing our Privacy Policy to govern data privacy for Summit Learning, we partnered with educators and experts in the field like the Future of Privacy Forum.

Student information is only used for educational purposes — to support schools in their mission to help students succeed. We have adopted strong safeguards to prevent unauthorized access, disclosure, or improper use of information. All of our service providers that support the operation and development of the Platform — from web hosting to software engineering — are required to comply with our Privacy Policy. We make our privacy policies transparent to families through our Privacy Center.

Facebook employees do not have access to the Summit Learning Platform. Summit partnered with Facebook engineers from 2015-2017, but the Summit Learning Platform has always been separate from Facebook and use of the Platform has never required a Facebook account. The Chan Zuckerberg Initiative is now Summit's long-term engineering partner for the Summit Learning Platform.

Today, more than 380 and schools and 72,000 students participate in the Summit Learning Program. Families and teachers throughout the country have embraced Summit Learning because they’ve seen that it has a positive impact on their students. The implementation challenges experienced at a few schools are not representative of the Program nationwide. Summit continues to work closely with all schools in order to help them meet the needs of their students.