Case Study

Laurel Chiesa, the Director of Instructional Technology at New York’s Fayetteville-Manlius School District, outlines three ways school districts can more effectively safeguard their students’ data.

Cyberattacks and data breaches are infiltrating K-12 communities. To proactively thwart these attempts to steal student data, states such as New York are passing legislation that requires school districts to adhere to stipulated student data privacy compliance regulations. Laurel Chiesa has been leading her district’s data compliance efforts and understands the significant challenges schools face. To help other districts navigate this unpredictable landscape, Laurel has shared the following three recommendations:

1. Continuously Monitor What Your Students And Teachers Are Using On Their School Devices

With so many free applications and web-based learning tools available, it is extremely difficult for school leaders to track what their students are using if they do not have direct visibility into their students’ and staff’s application usage data. In some instances, teachers are providing their students’ names and dates of birth in order to access these free resources without realizing the ramifications sharing that information could have on their students’ data privacy.

The Fayetteville-Manlius School District has ruled that teachers must vet any new software program with the district’s Instructional Technology staff. Despite this policy, Chiesa has discovered through Lightspeed Digital Insight, a data insights and data privacy monitoring solution, that some educators are continuing to introduce new online tools without notifying the district’s Instructional Technology team.

I regularly check my Lightspeed Digital Insight dashboard to monitor the trending apps being used in the district.

2. Create An Organized System For Posting And Updating Approved Applications And Vendor Contracts

With so many applications being used in their classrooms, it is essential for districts to create an effective tracking system for their ed-tech tools. At Fayetteville-Manlius School District, Chiesa is using Lightspeed Digital Insight to house and track all this critical information. “I like having all of our approved applications in one place,” said Chisea. “Every new software purchase is entered into the system, how much we paid for it, when we purchased it, the renewal date, and the contract. I like being able to quickly see how much we paid for a tool or if we have the contract yet.”

Regularly updating the list of approved applications students can use and communicating that list to teachers, students, stakeholders, and parents is also very important. “We generate our approved applications in Lightspeed Digital Insight and have them posted in multiple places, including on our district website and within our learning management system, which parents have access to.

It’s critical for district leaders to see what applications and online tools are being used by students and teachers.

3. Be Proactive In Your Compliance Efforts

Although many states have yet to pass student data privacy legislation, Chiesa advises school districts to be proactive with their compliance efforts and ask questions. “Ed Law 2-d was a challenge for everybody, but I’ve really learned a lot through this process,” said Chiesa. “I’m very concerned about how long some vendors are keeping their customers’ data, even years after their contract has ended. Also, we are now asking our vendors what security training they provide to their employees who manage their servers.”

Chiesa also recommends districts attain a keen understanding of what software is being used by their students in the event of a breach on the vendor’s side. “There was a product that was not approved by our district, and that company had a breach,” said Chiesa. “I reached out to my teachers to confirm it was not being used. I then checked Lightspeed Digital Insight, and I could see that there were some individuals using it. Having that visibility is so important because there are always going to be breaches and there are always going to be individuals who may not remember the software they are using.”

With cybersecurity threats and data breaches on the rise, districts need to evaluate their current compliance practices to help safeguard their students’ data.