As believers in student data privacy and policymakers who have worked extensively on that issue, we are deeply concerned about the fact that personally identifiable information about virtually every public school student in Colorado was surreptitiously released to the Colorado Department of Public Health and Environment (CDPHE) this year without parental knowledge or consent.

The data were used to determine individual student COVID-19 vaccination statuses, with the goal of producing an online data dashboard publicly displaying schooland grade-level vaccination rates at every public school in Colorado.

We believe this dashboard and the 2022 interagency data-sharing agreement that underpinned its creation seriously undermine the privacy of Colorado students, inaccurately and unfairly stigmatize schools for voluntary vaccination rates they cannot control, and could have the effect of applying inappropriate pressure to families making voluntary, highly personal medical decisions about their children.

We also believe the data dashboard is unhelpful as a public tool because it provides incomplete and outdated information.

No parental consent

The dashboard and the process by which it was created undermine the privacy of students and run counter to the expectations of Colorado parents.

The data dashboard was created using sensitive student data from the Colorado Department of Education (CDE) and the Colorado Department of Public Health and Environment. In particular, data shared with CDPHE included student personally identifiable information like names, dates of birth, gender, district of parents’ residence, grade level, and more.

These personally identifiable data points were then overlaid with state-held medical records related to COVID-19 vaccination status — also extremely sensitive information for many families, especially in the politically charged atmosphere surrounding COVID-19 — to determine whether individual students had been vaccinated. Once matched, CDPHE used the data to calculate school- and grade-level vaccination rates and build the associated public dashboard.

CDE was uncomfortable with this proposed use of student data, as the department “felt it had drifted away from the health and safety aspect” of earlier Covid-related data-sharing requests. As such, the department initially refused to release the requested data.

Shortly thereafter, Gov. Jared Polis addressed this impasse between state agencies by simply forcing CDE to comply with the data-sharing request via an executive order leveraging his broad emergency powers.

Thus, CDPHE and the governor circumvented the elected State Board of Education and the Colorado Department of Education to force the release of personal records for every public school student in Colorado to the state health agency.

Parental consent was never sought for this sharing of data, nor was notification of the data sharing provided to families or, in most cases, schools themselves.

The data-sharing agreement attempts to justify this secrecy with a short legal statement about the ability to release student records, including those that contain personally identifiable information, “without parental or student consent” during an emergency, but that legal statement notably includes no prohibition on seeking that consent or providing notification.

While parents and schools had little knowledge of what was happening, however, it appears the governor knew what CDPHE planned to do with these data.

In the governor’s words: “I direct the Colorado Department of Education to share with the Colorado Department of Public Health and Environment (CDPHE) student information necessary for public health purposes of ongoing COVID-19 investigation and disease mitigation, including information identifying the student’s school of attendance and sufficient information about students to match their information to records in CDPHE immunization and disease control databases.”

We understand that CDPHE might not have had a legal duty to notify parents or seek their consent.

But the fact remains that the department could have chosen to do so to preserve public trust and honor parental expectations about the protection of their children’s personal information. It could also have chosen to