Explore creative and engaging seasonal activities for educators. Discover ideas and resources to make learning fun throughout the year.
Safeguarding sensitive student data was easy pre-technology. I had to drop a file folder in a desk drawer, not forget to lock it, and that was it. Today, safeguarding sensitive data is a multi-million dollar business that still manages to fall short. Back then, protecting data was the job of a few dedicated professionals. Now, it’s a global effort—governments, non-profits, companies, and people like us. Data Privacy Day, on January 28, calls us to protect personal data. In ed tech, privacy is a daily task. This day warns us: the next breach could start with a phishing email you click or a vendor you trust.
“Data privacy isn’t just a checkbox—it’s a culture.”
– Unknown
In light of recent breaches like the PowerSchool incident, which exposed sensitive student and parent information, proactive measures must be taken. Please find seven strategies for Data Privacy Day. You may feel such efforts are inconsequential against the international backdrop of ransomware attacks, but they are not. Make the effort to safeguard your own, your students’ data privacy.
1. Start with Awareness
“You can’t protect what you don’t understand.”
— Nuala O’Connor
Today, students access and share more data than I did as a technology director. The reason is that they are maker and creators sharing information on social media, participating in DDOS attacks (as two high school students did in my experience, knocking the network offline for a few hours on test day). With such casual access to information, it’s critical to assist students in putting data privacy right up there with substance abuse, bullying, and other criminal acts. Explain what personal data is, why it’s valuable, and how they can protect it.
- Classroom Activity: Use real-world examples like the PowerSchool breach to spark a class discussion on risks and responsibilities.
2. Teach Students to Recognize Phishing
“The best defense is a skeptic with a mouse.”
— Kevin Mitnick
I grew up as a Gen Xer reading stories of Kevin Mitnick and other hackers working to liberate information from corporate gatekeepers. Today, those hackers are not liberators but blackmailers and extortioners. Their goal with that bit of ransomware is to compromise student data when they are young, selling data and using it inappropriately to make money. Phishing, suspicious links, and attachments are some of the ways into the walled fortresses school networks have become. If a student willingly helps an unknown stranger breach the castle’s backdoor, all are at risk.
Show students how to identify suspicious emails, links, or attachments.
- Classroom Activity: Conduct a “spot the phishing attempt” challenge, presenting real and fake emails for students to analyze.
You can find a few examples in this Google Doc. My favorite? This one:
| #7 | Unclaimed Package Delivery | Subject: Action Required: Unclaimed PackageFrom: Delivery Service notification@fedx.com Dear Customer,We attempted to deliver your package but were unsuccessful. Please click the link below to reschedule delivery:Reschedule DeliveryIf not claimed within 3 days, the package will be returned to sender.Regards,FedEx Delivery Team | – Misspelled Domain: ‘fedx.com’ instead of ‘fedex.com’. – Phishing Link: Hover reveals suspicious URL. – Urgency: Threat of returning package. – Generic Greeting: ‘Dear Customer’ instead of personalized name. |
|---|
3. Promote Strong Password Habits
“Passwords are like underwear: don’t share them, don’t leave them lying around, and change them often.”
— Chris Pirillo
Our brains make horrible password managers. The days of three to five passwords is no longer possible. Today, students need to be aware of secure password generators and managers. For younger students, single sign-on solutions abound. For older students, offer solutions like Keepass they can run on their device, or Bitwarden that works across devices. My son relied on Keepass through high school to keep track of his passwords. Encourage students to use unique, strong passwords.
Here are some of my favorite password generators:
A quick classroom activity can get students thinking about their passwords rather than relying on what’s convenient.
- Classroom Activity: Play the TCEA Password Guardian Game.
Here are three other games you can try:
- Password Duel for grades 3-5 via Science Buddies
- The Password Game for grade 8-12 students via Next Gen Personal Finance
- Password Power-Up via Common Sense
4. Secure Classroom Devices
“A secure device is a safe student.”
— Unknown
Discuss the importance of locking devices and logging out of accounts. My own children secure their devices before they leave the room or walk away from them. That habit may have developed to prevent snooping classmates or parents from sneaking a look at what they were doing. It’s the equivalent of Boomers and Gen Xers locking doors when they got into a car or stepped into a house. The only people who have problems with this? Country folks who leave their doors unlocked. At least, that’s my city mouse perspective. Today, securing devices when not in use is critical. With theft of mobile devices rampant, that digital lock with a top secret password, encrypted hard drive, or smartphone app vault may be all that stands between scandal, financial ruin and you wondering, “Where can I convert cash to bitcoin?”
- Classroom Activity: Role-play scenarios where students learn what to do if they find an unlocked device.
5. Limit Data Collection
“Less is more—especially when it comes to data.”
— Privacy International
One way to limit data collection? Encrypt it. In this way, you and your students have to make the effort to decrypt it. It’s a pain but can provide that valuable moment of clarity when you ask yourself, “Should I decrypt this? What am I really going to use this for?” Some user oriented encryption tools that every student and teacher should be using:
- Paranoia Works Text Encryption. Safeguard any email correspondence or the contents of a text message or document.
- FileLock. An easy to use, browser-based solution. Chromebook environment? No problem. Try this as an alternative.
- 7-zip. Offers file encryption across platform that is AES-256. It may not stop a foreign power, but it should work for run of the mill hackers.
Only collect data you need for learning. Teach students to avoid oversharing.
- Classroom Activity: Have students review permissions for apps they use and identify unnecessary requests.
Explore the Encryption Made Easy tools:
6. Use Secure Apps and Tools
“Data privacy starts with smart choices.”
— Data Protection Commission
Anyone can check to see if apps comply with FERPA and COPPA. To accomplish that, use the TCEA PROTECT rubric. It’s available as a paper assessment (below), but you may be better off dropping that shiny new app’s privacy policy and terms of service into the TCEA PROTECT GPT to double-check.
- Classroom Activity: Create a checklist for evaluating apps’ privacy policies with your class.
Give the AI version of TCEA PROTECT a whirl.
7. Engage Parents in Privacy Practices
“It takes a village to protect a child’s digital footprint.”
— Common Sense Media
Host workshops to educate parents on protecting children’s data at home. Many efforts at involving parents take a “Scared straight” approach. More helpful are actions that seek to encourage parents to build relationships that allow for honest, authentic conversations with their children. Having shared values that hold all people have dignity, can determine right from wrong, the equality of all people, and skeptical thinking can go a long way to building those relationships. These values draw upon cultural, familial, and faith-based values common to a variety of situations. It never hurts to reinforce kindness to all, tolerance for those who believe and/or think differently, too.
Consider these Data Privacy Tips for Parents:
Build a Privacy-First Culture
Data Privacy Day calls us to act. Teach students, staff, and parents to value privacy. Use tips and activities to protect data and build lasting digital habits. Today is not for reflection alone—take steps to secure the future.
But Wait, There’s More!
In case your school suffers a data breach, consider these five steps to dealing with a data breach:
- Acknowledge the Incident Immediately and Share Insights. Upon discovering a breach, notify all stakeholders about the issue. Elaborate on the steps being taken, using clear, concise language to get the facts out there. Avoid jargon that might confuse readers unfamiliar with the topic. You’ve learned a lot through this process. To rebuild trust, be accountable, be transparent about what has happened, where you failed, and what you are doing to make sure it doesn’t happen again.
- Contain the Breach. Do your best to limit the damage to affected systems. You can do that by isolating them, disconnecting from the local or wide area network. Ensure unauthorized access is stopped.
- Conduct a forensic analysis. You have to investigate and find out what happened. Involve an external, third party to gather facts and make recommendations.
- Notify and Support the Affected. Was teacher personally identifiable information exposed? What about others, including students? Explain what happened, including the risks. Then, provide resources to safeguard personal information, including credit monitoring and identity theft protection if necessary.
- Reassess Your CyberSecurity Policies. Take advantage of data minimization, implement security audits, and minimize third party vendor partner risks.
These are a few of the steps you can take. TCEA can assist you with district technology audits. Request one today via Lori Gracey (lgracey@tcea.org).
