As believers in student data privacy and policy makers who have worked extensively on that issue, we are deeply concerned about the fact that personally identifiable information about virtually every public school student in Colorado was surreptitiously released to the Colorado Department of Public Health and Environment (CDPHE) earlier this year without parental knowledge or consent.
The data were used to determine individual student COVID-19 vaccination statuses, with the ultimate goal of producing an online data dashboard publicly displaying school- and grade-level vaccination rates at every public school in Colorado.
We believe this dashboard and the 2022 inter-agency data-sharing agreement that underpinned its creation seriously undermine the privacy of Colorado students, inaccurately and unfairly stigmatize schools for voluntary vaccination rates they cannot control, and could have the effect of applying inappropriate pressure to families making voluntary, highly personal medical decisions about their children. We also believe the data dashboard is unhelpful as a public tool because it provides incomplete and outdated information.
No parental consent
The dashboard and the process by which it was created undermine the privacy of Colorado students and run counter to the expectations of Colorado parents.
The data dashboard was created using sensitive student data from both the Colorado Department of Education (CDE) and the Colorado Department of Public Health and Environment. In particular, data shared with CDPHE included student personally identifiable information like names, dates of birth, gender, district of parents’ residence, grade level, and more.
These personally identifiable data points were then overlaid with state-held medical records related to COVID-19 vaccination status — also extremely sensitive information for many families, especially in the politically charged atmosphere surrounding COVID-19 — to determine whether individual students had been vaccinated. Once matched, CDPHE used the data to calculate school- and grade-level vaccination rates and build the associated public dashboard.
CDE itself was uncomfortable with this proposed use of student data, as the department “felt it had drifted away from the health and safety aspect” of earlier COVID-related data-sharing requests. As such, the department initially refused to release the requested data.
Shortly thereafter, Gov. Jared Polis addressed this impasse between state agencies by simply forcing CDE to comply with the data-sharing request via an executive order leveraging his broad emergency powers.
Thus, CDPHE and the governor circumvented both the elected State Board of Education and the Colorado Department of Education itself to force the release of personal records for every public school student in Colorado to the state health agency.
Parental consent was never sought for this sharing of data, nor was any notification of the data sharing provided to families or, in most cases, schools themselves. The data-sharing agreement attempts to justify this secrecy with a short legal statement about the ability to release student records, including those that contain personally identifiable information, “without parental or student consent” during an emergency, but that legal statement notably includes no prohibition on seeking that consent or providing notification.
While parents and schools had little knowledge of what was happening, however, it appears the governor knew exactly what CDPHE planned to do with these data.
In the governor’s words:
“I direct the Colorado Department of Education to share with the Colorado Department of Public Health and Environment (CDPHE) student information necessary for public health purposes of ongoing COVID-19 investigation and disease mitigation, including information identifying the student’s school of attendance and sufficient information about students to match their information to records in CDPHE immunization and disease control databases.”
We understand that CDPHE may not have had a legal duty to notify parents or seek their consent. But the fact remains that the department could have chosen to do so in order to preserve public trust and honor parental expectations about the protection of their children’s personal information. It could also have chosen to notify schools or districts that this data sharing would occur, but it again chose not to do so.
Instead, the department opted to construct this database and the associated dashboard largely in the dark. The data gathering was not brought to widespread public attention until the launch of the data dashboard in March 2022 — eight months after Polis declared an end to the COVID-19 emergency.
For obvious reasons, parents and schools have been extremely concerned about the fact that this project was conducted without their knowledge or consent. A petition with more than 1,300 signatures was sent to CPDHE by the Education Alliance of Colorado, an advocacy group representing 20 public charter schools serving more than 20,000 students, to protest the release and use of student data by CDPHE. The department’s response was essentially to ignore the concerns and carry on.
Colorado has a long history of protecting personally identifiable student information. Most notably, the Student Data Transparency and Security Act of 2016, of which one of the authors of this commentary, Sen. Paul Lundeen, was a prime sponsor, provides a variety of protections. These protections include many instances of requiring parental consent for data sharing with entities outside a school or school district itself.
It is disappointing to see the governor and the department behave in a way that is contrary to this history of transparency and public trust.
The data dashboard unfairly stigmatizes schools for rates of voluntary vaccination they cannot control.
Unlike other vaccination databases and dashboards built by CDPHE, which provide information about mandatory vaccines and exemptions, the COVID-19 database provides information about a wholly voluntary vaccine — the taking of which has become deeply personal due to political debates, cultural differences, and family beliefs.
We make no statement here about whether families should vaccinate their children for COVID-19 — that is entirely up to them based on their beliefs, values, and situations. We do, however, believe that they should be allowed to make voluntary, personal medical decisions for their children privately and without state interference.
Because the COVID-19 vaccine is voluntary, schools and school districts have no ability to control their vaccination rates. Yet, the CDPHE data dashboard color-codes schools with low COVID-19 vaccination rates as red (the universal color for “bad” or “dangerous”) and those with high vaccination rates as blue (the typically accepted color for cleanliness and compliance).
This method of presenting the data paints schools as good or bad actors without any acknowledgment of the fact that they cannot control the factors that influence those classifications. Furthermore, the presentation of the data makes no effort to provide more complete information about other mitigation or health efforts those schools may have undertaken to quell the spread of COVID-19 — increased ventilation, social distancing, virtual learning, etc.
Instead, as the lone concession to the 1,300-signature petition from the Education Alliance, CDPHE added only a general statement that schools “may also employ” other measures to stop the spread of the virus. These measures do not impact a school’s color-coding, nor are any of these mitigation efforts reflected in the provided datasets themselves when one clicks on a specific school.
Although the data dashboard shows total student population numbers for each school, it applies the same color-coding system to tiny rural schools serving dozens of students as it does to massive urban schools serving thousands of students. In some cases, small enrollment numbers mean that even a handful of unvaccinated students could significantly affect a school’s rating and color presentation on the dashboard. Meanwhile, larger schools could enroll dozens or even hundreds of unvaccinated students and still show as blue.
The color-coding system was clearly intended to influence parental decisions about enrollment and to pressure “red” schools to find ways to increase their rates of student COVID-19 vaccination — likely by pushing families to vaccinate their children. It also risks further dividing communities as schools are segregated into “vaccinated” and “unvaccinated” ideological camps, and it ignores important community differences that could factor in COVID-19 vaccination rates among children.
In addition to being inaccurate and unfair, this weaponization of data gathered—and especially data gathered via executive order—is highly inappropriate, particularly on the part of a state agency. Colorado parents should be allowed to make decisions about voluntary medical issues on their own, free from shaming or stigma. And Colorado schools should not be penalized or stigmatized for things which they cannot control.
New dashboard, old data
The database and associated dashboard are unhelpful as public tools because they rely upon outdated information.
The final batch of student information was shared by the Colorado Department of Education with CDPHE in early 2022. CDE has indicated that no further student information will be shared. As such, without an ongoing data-sharing agreement that would far outlive the state of emergency created by the pandemic, the data dashboard is already out of date for the 2022-2023 school year.
Students move, graduate, disenroll, and otherwise leave or change schools by the tens of thousands every year. Thus, the dashboard does not provide a current view of school-level vaccination rates in Colorado. Instead, it simply provides a snapshot of those rates at the time the final raft of data was collected. Neither parents nor citizens nor government agencies derive any additional value from viewing an outdated database.
In fact, the entire timeline of the dashboard is bizarre. It was not published until March 2022 — six months after the issuance of the executive order forcing CDE to share student data, two years after the start of the pandemic, and eight months after Polis announced the end of the emergency phase of the pandemic.
Given that the explicit purpose of the data-sharing agreement was for it to be used in connection with an emergency situation, it is highly questionable whether the current data dashboard is justifiable at this late date — if it ever was.
In light of these concerns, the state should remove the data dashboard in question from public access or, at the very least, place a prominent advisory statement or warning on it stating that the data it provides may be incomplete or out of date. Schools should no longer be color-coded or rated based on vaccination rates.
Additionally, if it has not already, CDPHE should immediately destroy the student records it holds under the terms of the data-sharing agreement — and the department should provide public notification that such destruction has occurred. Any further sharing of data should be done publicly, in full view of parents and schools, and with the direct input and approval of the State Board of Education.
These steps will provide an important signal from the state of Colorado that it prioritizes the protection of sensitive student data and believes in full transparency when those data do need to be shared. And, hopefully, they will encourage state officials to more carefully balance the needs of the state against students’ and families’ right to privacy in the future.