Does sale of SAT, ACT student questions violate privacy?
U.S. representatives Ed Markey and Joe Barton will ask the College Board, owner of the SAT college entrance exam, for details on how it collects and stores data from students as the government seeks to bolster teen privacy laws.
Markey, a Massachusetts Democrat, and Barton, a Republican from Texas, will request the same information from College Board competitor ACT Inc., including disclosure and privacy policies, in letters to the nonprofit organizations later today, Giselle Barry, a spokeswoman for Markey, said late yesterday.
Both companies collect data from millions of teenagers annually as they register for SAT and ACT tests, and then sell their names and personal information to colleges, which use them in direct marketing to potential applicants. While Markey and Barton introduced a bill this month to expand a children's online privacy law to teenagers, the proposal doesn't cover nonprofit companies, such as the College Board and ACT.
“There should be some kind of regulatory control over what even a nonprofit can be culling from students,” said Pam Dixon, executive director of the World Privacy Forum, a nonprofit public interest research group in Cardiff by the Sea, California.
Parents should be asked for consent when their children are answering personal questions on the surveys, said Lake Forest resident Anthony Terrasse, whose son Weston received direct-marketing mail from about three dozen colleges.
“Would they answer more questions if their parents were supervising them and give out information that a lot of people still want to keep private?” said Terrasse, a plastic surgeon.
Weston Terrasse, who plans to enter the University of Notre Dame in South Bend, Indiana, in August, began hearing from colleges in his sophomore year of high school after he scored in the 99th percentile on preliminary SAT and ACT tests. He got mail from schools such as Dartmouth College in Hanover, New Hampshire; Duke University in Durham, North Carolina; and Princeton University in Princeton, New Jersey. He applied to all and was rejected, he said in an interview.
Even now that his college search is finished, he is still hearing from schools. On his 18th birthday earlier this month, Terrasse got an e-mail from the University of Arizona in Tucson wishing him well. The message said he was added to an e-mail list after contacting the school.
“It's a little concerning that they might know some information,” said Terrasse, who said he never contacted the school nor applied there.
The University of Arizona has been sending birthday e-mails for about two years, Kasey Urquidez, the dean of admissions, said in a telephone interview. “We don't feel it is anything out of line.”
The university buys about 100,000 names from sources including the College Board and ACT, and spends at least $170,000 annually for paper brochures and booklets and buying the names, Urquidez said. Students receive e-mails after opting into College Board and ACT services, she said, even though the language in the e-mail Terrasse received made it appear he had requested it.
While prospective names are deleted each year, Urquidez didn't know of protocols required for deleting personal information such as birthdates.
“I know we have very tight security across the board and people are watching the information constantly to make sure it's not compromised,” she said.
Details of a draft letter, described to Bloomberg News by Markey's office, include 12 questions and a request for a response by June 15.
Late yesterday, Kathleen Steinberg, a spokeswoman for the College Board, and Scott Gomer, a spokesman for ACT, said their companies hadn't seen the letters and were unable to comment on them.
“Protecting the privacy and security of the students who participate in College Board programs has always been a top priority for our organization,” Steinberg said.
The College Board's database of student names includes about 5.1 million with e-mail addresses. The New York-based company had $63 million in revenue from its business that includes name-selling in the year ended June 2010. Iowa City, Iowa-based ACT took in $7.5 million in revenue from its Educational Opportunity Service for the most recent year, which ended in August, the company said. It has a database of 2.4 million names of high school sophomores, juniors and seniors.
“Given the kids' ages and the setting in which the data is collected, there are elements that read as less than voluntary because these tests are usually required to get into college,” said Dixon. In 2009, she testified before a joint congressional subcommittee about data collection.
Markey and Barton's proposed bill would establish new protections for 13 to 17-year-olds. Among the safeguards, the legislation would prohibit online commercial companies from using personal information of teens for targeted marketing purposes, as well as limit collection of their personal and geographic information.
The Federal Trade Commission's 1998 Children's Online Privacy Protection Act prohibits personal information of children 12 and under from being collected online without “verifiable parental consent.” The proposed legislation ought to include new authority for the FTC to regulate data-collection practices of nonprofit groups that target teens for commercial- like purposes, such as selling names to colleges, said Jeff Chester, executive director of the Center for Digital Democracy, a nonprofit consumer-protection advocacy group in Washington.
“The Markey-Barton bill is focused on commercial businesses, even though many of these same disturbing practices are being conducted in a widespread fashion by nonprofit organizations,” Chester said. “Nonprofit organizations operate under a golden halo effect.”
The Education Department is trying to change its own privacy regulations under the Family Educational Rights and Privacy Act, known as FERPA, to expand sharing of educational records of kindergarten to 12th graders. The testing companies' data collection isn't covered under FERPA.
More than 90 percent of students who take the SAT register online, said the College Board's Steinberg. The same percentage register online for ACT tests, said Ed Colby, a spokesman for that company. Students are asked to “opt in” to the search service to let schools and scholarship programs provide materials. They can also opt out. Students aren't told their names will be sold and their parents aren't asked for permission.
The College Board and ACT sell student names and information to colleges at 33 cents a name, according to the companies. About 1,100 colleges and universities use the College Board's Student Search Service, Jennifer Topiel, another College Board spokeswoman, said in an e-mail.
Colleges perform searches based on bands of test scores to create lists of prospective applicants. They can search on criteria such as self-reported grades, ethnicity and religion, generated by the survey questions asked of the students.
Universities buy names from the College Board and ACT because they cannot obtain academic records directly from high schools without student and parental consent, said Joel Reidenberg, a law professor who directs the Center on Law and Information Policy at Fordham University in New York.
“The College Board and ACT exploit their role as gatekeepers to college access and use that role to obtain consent from minors to sell their information,” Reidenberg said. “High schoolers are like deer in the headlights against a very sophisticated marketing industry. Parents have no idea and the law does not protect the students' privacy. It should.”
While the College Board's 39-year-old Student Search Service has increased its volume by about 20 percent over the past decade, it doesn't release the total number of names sold annually, spokeswoman Topiel said. ACT didn't disclose how many names it sells annually from its service, which started in 1970.
Both companies have public charity status because they typically get more than a third of their support from membership fees, contributions and gross receipts from activities related to their exempt functions, according to tax filings.
ACT had revenue of $238 million in its most recent tax filing for the year ended August 2009. Richard Ferguson, who retired as chief executive officer last year, had pay of about $735,000, including about $85,000 in additional compensation from ACT and related organizations, according to the filing.
Gaston Caperton, president of the College Board, had earnings in the year ended June 2010 of $1.27 million, of which $509,000 was deferred compensation, according to a filing. He also got an estimated $45,500 from the company and related organizations. The College Board reported total revenue of $659.8 million in the period.