Districts must consider their approach to the privacy interests that a student or employee may have in the contents of their personal e-mail files or records of online activities.
Issues to Consider
Expectation of privacy
People are still struggling to hold onto the right of privacy at the same time that technology seems to be removing many vestiges of this important interest.
System administrators and technical services personnel have the ability to access personal files and monitor online use. General system administration does not require that the technical personnel review personal files and most personnel respectfully do not read other people's mail. However, there is always the possibility that during routine maintenance the contents of a student or employee mailbox will be accessed. The system administrator must investigate any unusual activity on their system and will likely be charged by the district from time to time to report on the manner in which the district system is being used. These activities also raise the potential that information about the use of the system by an individual will be discovered.
Instructional staff must be carefully monitoring students when they are using the Internet because of the potential of students accessing inappropriate materials or engaging in inappropriate activity when using the Internet. This will necessarily impinge on the privacy interests of students.
Education about privacy
The easiest approach for a district would be to say "The district can review personal files at any time." But districts ask students to respect the privacy of others by not posting personal information and not forwarding personal mail they receive without permission. At the very least, it is incongruent to say to students that the district expects them to respect the privacy of others, but will not respect their own privacy.
Legitimate need for privacy
There are times that students may have a legitimate need for privacy. For example, a student who is dealing with gender-orientation issues can find helpful, very legitimate materials available online to assist him or her in addressing questions or concerns.
The standards for school officials in conducting a search and seizure in the school setting where there is a legitimate expectation of privacy were enunciated by the Supreme Court in the case of New Jersey v. T.L.O., 469 U.S. 325 (1985). These standards are:
Was the search "justified in its inception"? Id. at 341. A search is justified when there are "reasonable grounds for suspecting that the search would turn up evidence that the students has violated or is violating either the law or rules of the school?" Id. at 342 (citations omitted).
Was the search "reasonably related in scope to the circumstances which justified the interference in the first place"? Id. at 342. A search is reasonable when "the measures adopted are reasonably related to the objectives of the search and not excessively intru-sive in light of the age and sex of the student and the nature of the infraction." Id. at 342 (citations omitted).
Clearly, the T.L.O. standards would apply in cases where there is an individualized search based upon reasonable suspicion of wrongdoing. The question remains whether the district can randomly investigate the contents of a student's personal e-mail files and the records of their online activity. The answer to this question depends on whether the student has a reasonable expectation of privacy. Zamora v. Pomeroy, 639 F.2d 662 (10th Circuit, 1981).
Student's expectation of privacy related to their Internet use will depend on a number of factors, including how the district has structured the Internet services, what the district has told the students, and the natural expectations that relate to specific uses of the Internet. For example, virtually all people feel that their personal e-mail is and should be considered private. Whenever, the district provides individual e-mail accounts to students, these accounts will be presumed, absent clear notice to the contrary, to be private. However, the expectation that web research on a school system will be private is much less strong. Students generally understand that there is a need for the school to monitor how students are using the web.
District educators will need to balance the interests in protecting privacy against the needs for effective monitoring and supervision. The manner in which the district addresses these issues may depend on a variety of factors, including the age of the students and the community environment. Whatever the district decides, it is critically important that students be given clear notice of the standards and expectations.
The following is language from an Internet use policy that addresses this issue:
"You should expect only limited privacy in the contents of your personal files or record of web research activities on the XYZNet. Routine maintenance and monitoring of XYZNet may lead to discovery that you have violated this Policy, the XYZ District disciplinary code, or the law. An individual search will be conducted if there is reasonable suspicion that you have violated this Policy, the XYZ District disciplinary code or the law. Your principal has the right to eliminate any expectation of privacy by providing notice to the students. Your parents have the right to request to see the contents of your e-mail files."
An alternative approach that is to make the students fully aware that the record of web research activities is not considered to have any level of privacy, especially if a technical system is used for monitoring. The district should also develop standards regarding who has the right to authorize access or monitoring of an individual student's files or online activities when their is an expectation of wrong doing.
There also may be educational or disciplinary reasons for a student's e-mail not to be considered private. The clearest example is with younger students who use a group e-mail account rather than an individual account. A district, school, or teacher may need to "unprivatize" the personal e-mail of a group of students to achieve certain curricular objectives related to effective communication or as a temporary measure to address wide-spread communication difficulties. Additionally, "unprivatizing" an individual student's e-mail or records of online activity may be a very appropriate consequence of the violation of the provisions of the Internet Use Policy. Under such circumstances, clear notice should be provided to students that they have no expectation of privacy.
The extent of a district's ability to investigate the personal files of its employees is less clear. In O'Connor v. Ortega, 480 U.S. 709 (1987), the Supreme Court held that employees did have constitutionally protected privacy interests in the work environment but that the reasonableness of the employee's expectation of privacy must be determined on a case-by-case basis. The Court then applied the T.L.O. standards of reasonableness to employer intrusions of employee privacy for noninvestigatory, work-related purposes, as well as for investigations of work-related mis-conduct.
Electronic communications of public employees are generally considered to be discoverable under state public records laws, therefore it could be argued that employees have no expectation of privacy. On the other hand, the common practice is to treat e-mail as private. This could give rise to the reasonable expectation that unless there is a public records request, the district will respect the privacy of an employee's e-mail.
Accessing employee e-mail or records of online activity clearly raises issues of personnel relations. From an effective employee management perspective, the standards under which employees' files are accessed or their activities are monitored should be respectful and fair. A reasonable and prudent approach to this issue would be to rely on the T.L.O. standards for searches of both student and employee records with the additional potential for review of an employee e-mail file in the event of a public records request.
The fact that a district may have the right to look at an employee's e-mail does not mean that every employee has the right to look at another employee's e-mail. Access of an employee's e-mail is a serious invasion of privacy that should only be undertaken in accord with a strict procedure that requires high level authorization and a written notice setting forth the justification for such access and the results.
Privacy on the Internet
Educators must be aware of the need to protect the privacy of students in relation to the use of the Internet. Frequently, concerns about privacy are raised in conjunction with concerns about predators on the Internet. There are no reported cases of a predator contacting a student as a result of a school's disclosure of student information. However, schools must be aware of parent's fears in this regard. The issue of personal privacy is much greater than such concerns. The explosion of technology has resulted in a loss of privacy. It is important for schools to cultivate respect for privacy and to help students learn how to protect their privacy and that of others when they are using the Internet.
There are three basic areas of concern. The first is student information that is placed on the district web site or otherwise distributed through the Internet by school staff or other students. The second is disclosure of confidential student information by staff via electronic communications. The third is information that a student discloses about himself or herself in e-mail messages of on web sites.
Disclosure of Student Information on the School web site.
Actions that school staff or students may take that would violate the privacy of a student include posting the student's name, classwork, or a picture on a district web site. Schools have mechanisms that allow for the disclosure of student information in student phone books and in other district publications. Generally, parental consent is required for any disclosure. The same mechanism should be used for disclosure of student information or posting a student's picture on a district web site.
Many schools are responding to this situation by requesting parental permission in a manner that allows for many options. Some of the options present include: student initials, student first name and last initial, student full name, photo or video of student in group without identification, photo or video with identification, classwork without identification, classwork with identification, etc. The problem with this approach is practical. School staff cannot be expected to keep track of this amount of individualized information. Inevitably a school will end up posting something that a parent had disapproved.
A more practical approach would be for the school to determine what student information would be safe, reasonable, and appropriate in accord with the instructional goals. The level of appropriate disclosure will most likely be different at different grade levels. This one set of disclosure standards could then be provided to parents with the only option given being that of approving or disapproving the entire set.
At the high school level, the issue of the level of disclosure of student information in student press publications will also have to be given careful consideration. The future of news publications is online therefore there are strong educational reasons to support student journalists in the development of skills for online publications. There are no court cases to provide guidance on these issues. Addressing this issue requires a balancing the interests in privacy of older students against the free speech rights of student press.
Disclosure of Confidential Student
School staff members are generally well aware of their legal responsibilities related to the protection of confidential student information. Problems can emerge in regard to the protection of such information when staff members communicate with each other via e-mail. E-mail tends to be informal. Its use leads to the same kinds of casual conversations as can occur in the staff break room or via a telephone. During such casual conversations, confidential student information can be disclosed. But with e-mail, there is now a permanent record of that confidential student information that can be easily disseminated. Staff should be reminded of their responsibilities regarding confidential student information and warned of the potential problems that can emerge due to the nature of electronic communication. One strategy to address this concern may be to develop some type of code to identify such information, for example the letters "CSI" could be written into an e-mail message as a signifier to the recipient of the importance of treating the message properly. The requirement to include such an indicator would be a constant reminder to both the writer and the recipient of the importance of protecting privacy.
A student may also violate the privacy of another student by including personal information in an e-mail message. Students have been writing notes and disclosing private information about other students since long before the Internet. But there is a vast difference between a piece of paper that is handed to one student and an electronic message that can be sent anywhere. It is important to teach students to respect the privacy of others when communicating electronically and understand the harm that they can cause when they fail to do so. A prohibition against the distribution of personal information about other students can be included in the district Internet use policy.
Students may disclose personal information in electronic messages or on web sites. Some amount of personal disclosure is to be accepted. But the district's Internet use policy should prohibit the disclosure of personal contact information without express permission. Personal contact information includes full name, home address, and parent's names.
The restriction against disclosure of personal contact information may need to be modified at the high school level because some of the ways in which students will be using the Internet will require disclosure, for example providing a university with a name and address to send a college catalogue. High schools may provide permission to disclose contact information in certain kinds of situations.
The National Center for Missing and Exploited Children has excellent educational materials for children parents addressing issues of personal safety on the Internet.
Another area of concern about student self-disclosure relates to the practices of many of the commercial web sites that target children. Many of these sites are soliciting personal information from children through surveys, contests, and games. The sites are using this information to engage in targeted marketing. A recent survey of such sites conducted by the Center for Media Education revealed that 95% collected personal information, 73% had no privacy policies posted, and fewer than 6% had a mechanism established to obtain prior parental consent. Commercial companies have significant amount of money to spend on the development of these sites. They are retaining the services of child psychologists to find ways to make such sites more attractive. Many sites that appear to provide educational activities are really nothing more than commercial "pitches". They are merging education, entertainment, and advertising into "edutainvertising." Such sites present significant concerns for schools because they are very attractive to children and they come disguised as presenting material of educational value.
In 1998, the U.S. Congress enacted the Children's Online Privacy Act, which authorized the Federal Trade Commission (FTC) to develop rules that would place restrictions on companies in soliciting personal information from children under the age of 13. The FTC is currently developing such rules and they will take effect in April 2000. Companies are seeking the least onerous rules
Schools can help educate students and parents about privacy on the Internet in the following ways:
Include a provision in the school Internet policy against student disclosure of personal contact information without express permission or in identified situations.
Provide students and parents with education about how to protect personal safety on the Internet.
Avoid the use of edutainvertisement sites in school except to educate about how such sites are being designed to market products.
Teach kids about the need to protect their personal information and how to recognize the "privacy traps" set by the companies.
Teach parents about exploitive practices of commercial sites.
The Center for Media Education has excellent resources for student and parent education. The National Center for Missing and Exploited Children has excellent materials on child safety on the Internet.