Best practices for protection of student's names on students' school email addresses?

[meh2ecu95]

Hello fellow ISC2 parents!

With the new school year starting, I’m advising the administration of a private school on how to minimize the exposure of students’ full names in the email addresses the school creates for them.

To better protect student privacy, especially around personally identifiable information (PII), I’m looking to learn what best practices schools, parents, + or teachers have seen or are implemented today to reduce the use of students’ names in email addresses and school-assigned apps.

It’s concerning how much data about our kids is being collected and used by data brokers building digital profiles.

Can anyone PLEASE share ideas or solutions to help limit this exposure?  Maybe some documentation would help.

Thanks

[JoePete]

I've seen a few different approaches. Just a random student number (e.g. "student1234") does the trick or you can use some initials.

But I'd bark up a different tree. There's not much of a privacy issue with a student's name. Maybe if you are dealing with a private school or some extenuating circumstances, but, depending on your jurisdiction, names are already out there. For example, in the US, many states have laws that make lists of residents public record etc.

What you really need to look at are two things:

1. How else does that email get used? When my kids were in the schools I was surprised at the amount of junk and apps that they were basically required to use. This is where the conversation needs to happen. Nothing is free (your data is going to be sold and it will cost in junk of some form if not identity theft), but too many teachers, administrators, etc. think otherwise.
2. How else is privacy compromised? Team sites and social media are a disaster. As I say, you are as private (or secure) as your most public (or careless) friend. We probably all have that idiot relative or friend who will post something like "enjoy your vacation!" Gee thanks for telling the world my house is empty right now.

Schools aren't well equipped to handle these issues, and again, depending on jurisdiction, they may not be required to. For example, in some states, while there may be a law about privacy, etc., there's usually language that exempts the state and its "political subdivisions" (i.e., municipalities and school districts).

What I told my kids and others is rather than thinking defensively about privacy, think offensively. Use false personal information, varied emails and usernames, etc. and track how your fake information gets sold, traded, and stolen.

[ervinfrenzel]

Many schools use a "randomly generated" email identification to identify the student in email and in records etc.  It helps to not use the students initials or other as you move through the system, there does have to be a way to pass the information if the student graduates, passes to another district,or transfers within the district through.

[akkem]

Use non-identifiable formats like student ID numbers, random strings, or first name + initial, and and I believe schools likely have policies and governance in place to protect PII data.

[denbesten]

I would recommend something like firstname, anticipated graduation year and if not unique, maybe first letter of last name.  So, 

JoeD2031@school.com

Email addresses having some identifying information in them can be extremely useful for ensuring things are being sent the right place.

[meh2ecu95]

Many thanks!  I really appreciate this... some of the initial feedback from some of the teachers was that when we were proposing. to use a generic alpha-numeric prefix, they pushed back indicating how difficult it would be to memorize and associate each student to their new email addresses.  

Your proposal I believe will arrive at a helpful half-way point....

Thanks again

[ervinfrenzel]

Not sure I would use anticipated graduation date as too many things prevent our plans...  (best laid plans of mice and men, often go awry).....  Many students delay a semester, classes do not lineup, maybe even a family emergency happens.  Worse, we might have several students with the same first and last name, who start in the same year.  I still stand by a random sequence (numeric) as it isn't readily identifiable/connectable to the individual.

[denbesten]

---

---

---

@ervinfrenzel wrote:

Not sure I would use anticipated graduation date as too many things prevent our plans...  (best laid plans of mice and men, often go awry).....  Many students delay a semester, classes do not lineup, maybe even a family emergency happens.  Worse, we might have several students with the same first and last name, who start in the same year.  I still stand by a random sequence (numeric) as it isn't readily identifiable/connectable to the individual.

---

I view allowing people to have their identity is much more important than precluding the possibility of name collisions.  Given free choice, people tend to pick something like "ervinfrenzel" over "31446536".

At least around me, "class of" is very much a part of the primary education (K-12) dynamic, even amongst the students. Sports/school jackets are emblazoned with the graduation year, and our boosters sell mascot yard signs with the student's name and "class of" year.   

An email address is not a lifetime commitment.  If a kid prefers a nickname, we can change it.  If we misspell a name, it can be changed.  And, if a kid is held back, we can (optionally) update the year.  And if you are adamant that your kid have "31336536", that too can be accommodated.  The key here is adaptability and flexibility.  

[ervinfrenzel]

You bring up good points. It could really depend upon who will be issued the identifiers. I primarily teach/administrate at the college and university levels. In the K-12 experience, there is an entirely different expectation.

Ervin Frenzel, PhD
CEI, CCISO, CISSP, E|CSA
(806) 570-7658