Data mining the Facebook generation

Children care about privacy. 

Who knew? 

Their apparent willingness to share every aspect of their life on social media seems to suggest otherwise. 

But recent findings from Pew Research paint a much more nuanced picture.

They show that children use privacy settings well, they use false details and preserve anonymity, they are good with subtext and hidden meaning. 

It’s not that privacy is dead for our children, it’s just different.  This creates implications for the education sector, and for the vast quantities of often highly personal information which schools hold about their pupils.

At a recent SafeGov conference in Wellington, which I had the privilege of chairing, Martin Cocker, Executive Director of Netsafe, described the danger zone for children. 

This extends from roughly intermediate school to the late teens, when children are digitally very capable but are also at serious risk in the online world. 

At risk because filtering and other protection technologies work only so long before other children find a way around them, at risk from cyberbullying - and also, possibly, at risk from the arrangements their schools are making to store their data.

Schools hold lots of information about students. 

Sensitive information (health, academic, disciplinary, family) about vulnerable members of society (minors unable to provide valid legal consent).  And schools are understandably moving away from filing cabinets into the 21^st century, storing information in the cloud or remote data centres managed by outside service providers. 

Often these services are provided free, but there is often a catch. 

The provider may, through a sophisticated array of tracking technologies and data analysis, be conducting advertising profiling of students. 

This tracking and analysis can lead to the filter bubble phenomenon – online advertising tailored to the individual’s profile. 

It’s a big part of the business model for some data service providers, and schools may be playing into their hands by just letting them do it when there are alternatives. 

Not every cloud provider wants to market to your kids.

A very recent survey of student privacy issues by Curia in New Zealand found that 84% of parents were concerned or very concerned about online advertising companies tracking their child’s computing and Internet activities at school. 

97% of parents want schools to ensure that student data is used only for education, not commercial exploitation, and 95% of parents want schools to require data service providers to commit by contract to use student data only to deliver services to schools and not for an ulterior purpose. 

Our stats compare favourably to similar surveys in the USA, UK and Australia.

There are a few things we can do.  First, we need to understand that we have a shared responsibility to our students.  This is an issue for parents, teachers, principals, Boards of Trustees, the Ministry of Education and the Privacy Commissioner.  It’s not just for the school IT manager, if there even is one. 

Teachers need training to help students become responsible digital citizens and understand the risks they may unwittingly expose themselves to online.  Next, schools need to be prepared to ask the hard questions and insist on transparency and accountability in the data service offering they receive from outside providers. 

A good place for schools to start for those questions is the Cloud Computing guidelines published by the Office of the Privacy Commissioner in February 2013 and available online. 

Finally, we need to keep tabs.  Not all schools will have the resources to deal with this issue well.  If we’re not getting this right, there may ultimately need to be a regulatory response.

Privacy issues sometimes get a “so what?” response, but we shouldn’t be encouraging the next big privacy breach to come from the education sector.  And if advertising profiling doesn’t seem like a big deal to you, consider this: a 2012 study by Cambridge University and Microsoft Research of 9.9 million “Likes” on Facebook from 58,000 volunteers was able to determine with 88% accuracy the sexual orientation of the “liker”, with 73% accuracy whether he or she smoked, and with 60% accuracy whether his or her parents were still together at age 21. 

All that information from a “like”.  Imagine what you can get from a school database …

Justin Graham is a senior associate with Chapman Tripp in Auckland specialising in technology, media and telecommunications, and privacy law.