(iStock)

The U.S. Education Department just warned school districts that give the SAT and ACT for purposes other than college admission that they need to do a better job protecting the personal information of students who take the tests.

An 11-page notice (see in full below) released by the Privacy Technical Assistance Center said school districts run the risk of violating three federal laws that protect student privacy when they register students for the exams and administer them.

The notice says that until recently, most students who took the SAT and ACT registered directly — by themselves or with their parents — with the companies that administer the tests. But high schools have increasingly been using the college admissions tests for other purposes, giving them to entire grades for accountability or other purposes. In these cases, schools register students for the exams and put themselves in the position of revealing private student data to the College Board, which owns the SAT, and to ACT Inc. The data is given to colleges and other organizations for recruiting and scholarship efforts.

The notice says students are not being informed sufficiently about their rights to privacy when asked to fill out voluntary pretest surveys seeking personal information and that this “raises concerns about privacy best practices.” The surveys, which you can see here for the SAT and here for the ACT, ask detailed questions covering race, religious affiliation, grade-point averages and sporting activities.

The notice, titled “Technical Assistance on Student Privacy for State and Local Educational Agencies When Administering College Admissions Examinations,” says in part:

In connection with these college admissions examinations, testing companies administer voluntary pretest surveys asking questions about a variety of topics ranging from academic interests, to participation in extracurricular activities, to religious affiliation. We have heard from teachers and students, however, that the voluntary nature of these pretest surveys is not well understood, and that each of the questions requires a response, and the student must affirmatively indicate in response to multiple questions that the student does not wish to provide the information. The survey’s multiple questions are designed to allow targeted recruitment, and students are specifically asked whether they would like to receive materials from different organizations, including colleges and scholarship organizations. For students who consent to being contacted by these organizations, the testing companies then sell this information to colleges, universities, scholarship services, and other organizations for college recruitment and scholarship solicitation.

The administration of these tests and the associated pretest surveys by SEAs [state education agencies] and LEAs [local education agencies] to students raises potential issues under the Family Educational Rights and Privacy Act (FERPA), the confidentiality of information provisions in the Individuals With Disabilities Education Act (IDEA), the Protection of Pupil Rights Amendment (PPRA), and several recently enacted state privacy laws, and generally raises concerns about privacy best practices.

The department said the document is intended to “remind” state and local education agencies of their responsibilities under three federal laws when “contracting to administer these examinations.” But it also said that “many of the requirements and recommendations discussed herein are also relevant to examinations and surveys administered by third parties more generally.”

The ACT released a statement saying:

ACT appreciates the recent guidance and technical assistance document shared by [the Privacy Technical Assistance Center] regarding data privacy and the administration of college admission exams. ACT recognizes the importance of protecting the privacy of personally identifying information and has worked and will continue to work closely with state educational agencies and local educational agencies administering the ACT to meet their data privacy needs.

The College Board said in a statement:

We are reviewing the guidance. The College Board has a deep respect for student privacy, and — with our state and district partners — are committed to protecting it.

Here’s the full warning from the Department of Education: