CA finds that Google Complies with FERPA and CA Privacy Requirements

CETPA finds Google Education AppsComplies with AB 1584 and FERPA
\

           

Hundreds of school districts throughout California and the rest of the country use a suite of education products formerly called Google Applications for Education (“GAFE”) and recently renamed G Suite for Education ("G Suite").  Questions have been raised as to whether G Suite complies with the Family Educational Rights and Privacy Act (“FERPA”) found in 20 U.S.C. 1232(g), and California Assembly Bill (“AB”) 1584 found in California Education Code section 49073.1.  Both laws establish privacy protections for pupil records stored or analyzed by digital education providers.  These protections include, but are not limited to:

(1) prohibitions against the unauthorized use of the records;

(2) requirements to allow a student or parent to access the records;

(3) disposal of the records at the end of the term of the agreement; and

(4) requirements to maintain adequate safeguards for the records, including notification of unauthorized access to pupil records.

One reason questions may have been raised about G Suite data privacy compliance is that not all FERPA and AB 1584 required terms are found in the G Suite for Education Online Agreement (“G-Suite Online Agreement”).  Given the widespread use of G Suite there was an urgent need to determine whether G Suite complies with FERPA and AB 1584.  CETPA and its counsel, Fagen Friedman & Fulfrost, undertook an extensive analysis of the G Suite privacy terms and conditions, including the G Suite Online Agreement.

The analysis found that central to determining privacy compliance is understanding that the G Suite privacy terms and conditions consist of more than just the G Suite Online Agreement.  FERPA and AB 1584 requirements can be found in several additional G Suite documents, including but not limited to: the G Suite Privacy Notice; the Additional Terms for Use of Additional Services; and the Data Processing Amendment to G Suite Agreement.

When taken together, these documents show that G Suite likely complies with all material portions of FERPA and AB 1584.  In most cases, the elements of the data privacy requirements are explicit in G Suite's privacy terms and conditions.  However, some aspects of FERPA and AB 1584 requirements are not referenced verbatim in privacy terms and conditions.  Some of those requirements require statutory interpretation to conclude that G Suite has met a particular data privacy requirement

There are two factors of the data privacy compliance laws that require statutory interpretation to conclude that G Suite has met its obligations under FERPA and AB 1584.  The first requirement is to provide students with the opportunity to establish a separate account for student-generated work and the second is the right of a parent to access a pupil's record and correct any erroneous information.  Currently, the G Suite privacy terms and conditions state that G Suite will only take a ministerial role to meet these obligations.

The issue then is whether the federal and state laws require Google to actively manage these processes, or whether Google’s role may be ministerial by implementing the directions of a school district.  We conclude that the creation of a separate account and the modification of pupil records is a power that AB 1584 and FERPA intended to leave to school districts and not to Google.  Therefore, Google’s ministerial role stated in the G Suite privacy terms and language on these two topics is consistent with the intent of the statutes.

CETPA’s finding that the G Suite data privacy terms and conditions comply with FERPA and AB 1584 is bolstered by recent findings of Ernst & Young, which held that G Suite privacy terms and conditions were consistent with the privacy standards established by the International Standards Organization for data privacy.  These standards have many similarities to those found in FERPA and AB 1584.

We hope this guidance will provide reassurance to the many California school districts using or contemplating the use of G Suite.  Please note that student data privacy laws are relatively new and subject to interpretation, and G Suite may amend its terms and conditions at any time, which could alter the foregoing analysis and findings.  CETPA has posted the underlying legal analysis supporting this conclusion on - The F3LAW Partner Resources Page

Sincerely.

Andrea F. Bennett

Executive Director, CETPA