March 4, 2002; Vol. 21 No. 5

Education statistics agency plays loose with privacy

By Robert Gellman
Government Computer News

A traditional way to balance privacy and research needs is to allow personal data to be used only in aggregate form for statistical purposes. The Census Bureau offers a good example. The law prevents the bureau from sharing identifiable data with the FBI, IRS or other agencies for criminal investigations, tax collection or any other administrative purpose.

This is a reasonable middle ground. Statistical data is available for legitimate purposes under controlled conditions that provide reasonably good privacy protections. Other agencies with comparable statistical privacy laws include the Agency for Healthcare Research and Quality, National Center for Health Statistics and National Center for Education Statistics (NCES). The laws applying to each of these agencies differ somewhat, but the basic idea is the same.

To be perfectly clear: A record cannot be both statistical and administrative at the same time. The categories are mutually exclusive. Once any administrative use is allowed, the record loses its statistical flavor completely.

The antiterrorism law that passed last year changed the NCES statute. The Justice Department can now obtain NCES records for terrorism investigations. A court order is required, but the access standard and procedures are minimal.

What is terrorism? In recent years, the Justice Department classified being drunk and unruly on an airplane and other ordinary crimes as examples of terrorism.

Everyone wants to stop terrorists. But we can?t abandon every principle along the way. If we open statistical records because of a remote chance that they might be useful, we won?t have the records at all in the end. Without protections, data sources won?t cooperate. Anyway, if the cops need records from schools, they have other ways of getting them. There was no need to break open statistical records.

The most remarkable?and chilling?aspect of the new law is that it was sought by NCES. Rather than pay attention to its longstanding statutory mission and its promise to thousands of schools and millions of students, NCES asked for the ability to give records to the Justice Department. In a burst of misplaced zeal, NCES sold its birthright. Education records collected for decades under a statutory guarantee of confidentiality can now be used to put people in jail.

In the future, if Congress wants to use NCES records to catch student loan defaulters, deadbeat parents or people with overdue library books, NCES will have no grounds to argue. Even worse, records of other statistical agencies are threatened now that there is a precedent for reversing the law.

NCES has demonstrated an appalling lack of judgment. After looking at the new law, schools would be acting reasonably to protect themselves and their students if they decided not to provide data to NCES in the future.

Many in the privacy community have always believed that the Justice Department has no real interest in protecting privacy. Congress blows hot and cold. Now it is clear that NCES can no longer be trusted with confidential data. That?s just about the worst thing you can say about a statistical agency.

Robert Gellman is a Washington privacy and information policy consultant. E-mail him at [email]rgellman@cais.com[/email].