How To Check A School Testing Contract For Data Sharing
A testing agreement can govern far more than exam delivery. It may describe what student information a vendor receives, where that information is stored, which subcontractors can access it, and whether data can be used for research, advertising, analytics, or product development.
Families do not have to rely on broad assurances that a provider “protects privacy.” The contract, attachments, bid specifications, data security schedule, and board approval materials often provide the clearest evidence. In New York, district residents can use public-records procedures to inspect many of these documents.
Understanding the language also helps parents connect student privacy to larger questions about local control. Concerns about who designs curriculum and assessments are addressed in resources on national curriculum concerns, while a contract review focuses on the specific company and terms affecting children in one district.
Identify The Records You Need
Begin with the name of the testing provider, the assessment program, and the school year involved. A district may have separate agreements for statewide testing support, computer-based testing platforms, test-preparation software, scoring, transportation, or special education assessments. Searching for only the word “testing” may miss relevant documents.
Request the executed contract and every incorporated attachment. Also seek the request for proposals, vendor bid, amendments, renewal letters, board resolutions, privacy addenda, data security plans, and lists of approved subcontractors. A contract may refer to another document for its most important student-data requirements.
Use Public Records Channels
Check the district website first. Board meeting agendas and minutes may include the vendor’s name, contract amount, approval date, and links to supporting documents. The district clerk, records access officer, purchasing department, data protection officer, or superintendent’s office may each hold different parts of the record.
If documents are not online, submit a written Freedom of Information Law request to the district’s designated records access officer. Describe the records and date range precisely, and request electronic copies when available. Ask the district to identify any withheld sections and cite the legal basis for each redaction rather than accepting an unexplained refusal.
Read The Data-Sharing Language
Search the agreement for terms such as “student data,” “personally identifiable information,” “education records,” “authorized representative,” “disclosure,” “subprocessor,” “de-identified,” “metadata,” and “directory information.” A clause may permit access to names and scores, but another provision could allow collection of device identifiers, IP addresses, behavioral records, or usage statistics.
Look for limits on purpose, retention, sale, targeted advertising, profiling, and secondary use. Stronger language says the vendor may process information only to provide contracted services, may not sell or monetize it, must notify the district of a breach, and must delete or return records when the agreement ends. “De-identified” should be defined carefully; a promise to remove names does not necessarily prevent re-identification.
| Contract Language | What It May Mean | Records To Seek |
|---|---|---|
| “Authorized representatives” | A vendor or approved agent may access education records for a specified function | Subcontractor list and written duties |
| “Business purposes” | A broad category that may permit analytics or internal product use | Definition of the phrase and usage policy |
| “De-identified data” | Information may be used after selected identifiers are removed | Re-identification safeguards and data fields |
| “Retain as required by law” | Records may remain after services end | Retention schedule and deletion certificate |
| “Directory information” | Certain student details may be disclosed under district policy | Annual notice and opt-out procedure |
Check Federal And State Protections
The Family Educational Rights and Privacy Act generally restricts disclosure of education records and allows disclosures to contractors performing institutional services when specific conditions are met. The agreement should establish the vendor’s legitimate function, limit access, and require appropriate handling of records. FERPA does not automatically make every privacy practice acceptable, so read the actual contract.
New York Education Law § 2-d and related regulations address educational agency data security and privacy. Look for provisions on a data security and privacy plan, breach notification, encryption, staff confidentiality, subcontractor obligations, and destruction of data. The district should be able to explain how the testing company’s practices fit its annual privacy policy and any parental rights notice.
Ask Focused Questions Before Approval
Specific questions are more useful than a general request for “privacy information.” Ask which data elements are transferred, whether student responses are stored, whether the provider creates profiles, whether data leaves the United States, and whether any company other than the named vendor receives access.
Also ask who approved the agreement, when it expires, whether it renews automatically, and how families can report a suspected breach. If the district cannot answer, request a public explanation at a board meeting. Parents concerned about high-stakes testing can also write your assembly member with specific findings rather than general objections.
Turn Records Into Public Action
After reviewing the documents, preserve the contract, note page numbers, and separate confirmed facts from unanswered questions. A simple timeline can show when the district approved the vendor, when information began flowing, and whether the agreement was amended without a clear public discussion.
Use the findings to request stronger terms in future procurements, including a narrow purpose limitation, a complete subcontractor disclosure, deletion deadlines, parent notice, independent security controls, and a prohibition on selling or advertising based on student information.
Practical Steps For Families
- Request the contract, attachments, amendments, and bid documents in one written records request.
- Highlight every clause concerning collection, disclosure, retention, subcontractors, and data destruction.
- Compare the contract with the district’s student privacy policy and annual parent notices.
- Share documented gaps with the school board, parent groups, and local education advocates.
- Ask for privacy conditions to be included before the district renews or replaces the testing agreement.
A careful records request can turn an unclear privacy concern into a documented community issue. Families can attend board meetings, request answers in public, and support contract terms that keep assessment data under meaningful district control. Understanding what a vendor may collect is the first step toward ensuring that testing serves students without creating an unnecessary commercial data trail.