Portland Public Schools and Privacy Practices of the School Climate Survey
4 min read
UPDATE, February 5, 1015. The privacy policy for this survey has been updated. Details available here. END UPDATE
On January 20th, Portland Public Schools released their School Climate survey. The goals of the survey are great - the district is making a focused effort to reach out to a broad range of parents with kids in Portland Public Schools. However, there are some issues with the survey and the associated privacy policies.
The problems start at the point of account creation. While the registration form states that personal info will not be tied to responses, there is no link to any privacy policy or terms of service.
Additionally, the survey site does not run behind https.
This screencast demonstrates the issues with login and https. Other issues are detailed after the screencast.
Moving on from the issues with login and taking the survey, we can only see the privacy policy when we go to
The policy gets off to a bad start when it states that the privacy policy can be changed, at any time, with no notice.
This policy may be updated from time to time without prior notice, so please check back periodically. If you continue to visit our Site and use the services made available to you after such changes have been made, you hereby provide your consent to the changes.
Continuing through the policy, we learn that "consultations are conducted in conjunction with DHM Research, a non-partisan public opinion research firm located in Portland, Oregon. They act as a third party consultant and aggregate all Personal Information to ensure that your responses will be kept confidential and anonymous."
From this, it's unclear who stores the data: the organization behind Oregon's Kitchen Table, or DHM Research. It appears that both Oregon's Kitchen Table and DHM Research can access responses, but unclear who can access lists of respondents.
Continuing on, the privacy policy states that data collected via surveys administered by Oregon's Kitchen Table can be combined with other data from just about any source.
Information obtained in connection with the Site may be intermingled with and used by the National Policy Consensus Center, its partners, or DHM Research in conjunction with information obtained through sources other than the Site, including both offline and online sources.
While I understand that Oregon's Kitchen Table helps facilitate policy research, the terms here are far too broad. They need to be narrowed to respect the privacy of people who are making the time to share information. Ideally, the privacy policies would be tailored to the needs and goals of the surveys.
The policy continues with a "Security" section, which includes this language:
Oregon’s Kitchen Table, The National Policy Consensus Center and our partners are committed to using our best efforts to maintaining the security of your Personal Information. To prevent unauthorized access, maintain data accuracy, and ensure the appropriate use of information, we have put into place physical, electronic, and managerial procedures to help safeguard and secure the information we collect, including an industry-standard firewall security system.
Given the absence of https on login, the claims made here fall pretty flat.
To be clear, there is nothing nefarious going on here. This clearly feels like a situation where policies were crafted to support research needs. However, in the pursuit of supporting the needs of researchers, respondents are left unnecessarily exposed. There are many changes that need to be put in place; the following list would be a decent start. Once the items on this list were in place, a full security audit that examined data collection, storage, data handling, research needs, and policies would be the next priority.
- Specify what entity has responsibility for storing data collected in a survey;
- Specify what entities can access survey responses, and what entities can access personal information;
- Link to a privacy policy that is specific to the survey, and ensure that the privacy policies align with the goals of the survey;
- For the PPS school climate survey - which appears to have a dual function of gathering information about school climate and supporting future parent outreach - specify that data collected will not be shared outside PPS without explicit opt-in;
- Remove the language that specifies that privacy policies can be changed without notice, and update it to allow for end users to be notified of changes;
- Add https to the user registration page.
If I'm missing anything here, or if I've gotten anything wrong, please let me know in the comments or on Twitter.
