ClassDojo, the popular class behaviour app, has announced that it will change its privacy policy to delete student data after one year.
You may be familiar with ClassDojo. According to the company's website, it is used by over 35 million teachers, parents and students worldwide, including many in Australia. It uses a system of points to reward or discourage certain behaviours such as completing homework. Students are encouraged to update their own points on interactive Smart Boards.
As the New York Times reports, from January 2015, the company behind the app, ClassTwist, Inc, will delete student data after one year. The New York Times previously reported that legal experts were questioning the privacy ramifications of storing such sensitive data on students.
Non-government schools that use ClassDojo may not have been aware of the privacy implications of using ClassDojo, but may now be assured that the data that is provided to ClassDojo will not be lingering in the ether of the Internet for more than one year.
What is ClassDojo?
Billed as an app that allows teachers to 'improve students' behaviour', ClassDojo is a cloud-based system where students can create accounts that register points. These points are used to guide behaviour, rewarding things such as 'following directions', and discouraging things such as failing to complete homework.
Students can have the experience of being awarded points on the system in front of the class, and will usually proceed to give themselves these points using an interactive Smart Board.
It's analogous to a real-time star chart, but also has additional features to share behavioural data. Teachers, parents and students are all usually involved in interacting with the software.
ClassDojo and privacy laws
Although ClassDojo is based in the United States, this does not mean that Australian privacy laws do not apply.
Generally, a non-government school is bound to comply with privacy laws. It needs to apply its privacy program to information that it 'collects' and 'holds'. These terms are usually wide enough to cover the behavioural information collected by ClassDojo because generally, teachers have access to that information through their ClassDojo accounts. This is despite the fact that that information is, in all probability, physically located on a server somewhere in the US. So, a non-government school must deal with this information according to privacy principles.
But here's the twist. Given that the information is sent overseas, non-government schools must comply with 'Australian Privacy Principle 8: Cross-border disclosure of personal information'. In essence, this means that a non-government school has an obligation to ensure that the information it discloses is stored in a secure way.
Thankfully, ClassDojo's Privacy Policy contains some useful points which might assist schools. These include:
Importantly however, schools need to look at their individual privacy obligations and determine for themselves whether they are complying with privacy laws.
The ClassDojo privacy policy
For children under 13, the Privacy Policy states that they collect 'only very limited personal information - users choose their own username and password', and provide contact details (but not names) of parents. It also explicitly states that 'use of the service by students does not require sharing any personal information'.
In addition to this, the Privacy Policy states (emphatically, in bold), that any children's personal information provided is not sold, leased or shared with any third parties for advertising or marketing purposes.
What does the change in policy mean?
For schools, the change in policy (to be effected in 2015) means that they can be assured that the personal information collected by ClassDojo will be destroyed after one year. The change will make it easier to assess the risks of using the software.
Currently, only limited information that identifies students is collected. In the future, this policy will also mean that a student's behavioural data will not follow them throughout their time at school, and in many cases, will not follow them from teacher to teacher. It will, in a sense, allow some behaviours and interactions to be truly 'forgotten', providing some relief to students and teachers.
Although this is a positive change in policy for the many schools in Australia that use this service, it is also a reminder of the myriad of privacy challenges that schools face. Services such as these are just some of the many cloud-based applications that schools may be using - each with their own varying levels of personal information collection, security and risk.
Using ClassDojo in the future
Although currently free, ClassDojo may in the future use the personal information it collects to generate revenue. At this point, it's privacy policy may change - requiring schools to reassess their use of the application.
Complying with privacy laws is important. Failure to do so can result in substantial fines, as in the recent case of a non-government school in Brisbane. For more detail on how the privacy laws apply to your school see CompliSpace's whitepaper.
In a digital era, technology can present as many pitfalls as it can benefits. Unfortunately, as with many things, the devil is in the detail and it will always be a school's responsibility to read the fine print.
.png)
