Thousands of Montana students have had information from their ACT tests inappropriately released since 2016, potentially violating Montana law.
The vast majority of high school juniors take the college entrance exam in Montana, both for federal accountability purposes and for those planning to go to college.
Montana's contract with the ACT prohibited the release of student information into a data portal used by colleges and scholarship groups. But students could still check an opt-in and complete an additional questionnaire; those who did had their information from that questionnaire released, despite the overriding state contract.
Information about things like race, religion, parents' income or citizenship status was available in the database for 8,030 students between April 2016 and February 2019. It's possible test scores were included.
The ACT sells at least some of that data.
"We're still kind of in the early stages" of learning about the release, said Office of Public Instruction spokesman Dylan Klapmeier.
An ACT executive sent a letter to Superintendent of Public Instruction Elsie Arntzen on March 5 notifying her of the data release.
"We regret the unauthorized release and are committed to ensuring the future security of Montana student data," wrote ACT senior vice president Scott Montgomery.
An ACT spokeswoman did not immediately return phone calls late Thursday afternoon.
The company discovered the error during an audit of data provisions in state contracts, the letter said. Any unauthorized student data was removed from the database, and the upload system was changed to ensure the error wouldn't happen again.
The release also comes amid growing scrutiny of the role of how tech giants collect and use consumer data.
Given that affected students did authorize the disclosure, the episode appears less an egregious breach of privacy than an example of the thorny issues that come with the growing importance of big data in education.
Montana recently enacted legislation that lets students release such data if they want. House Bill 61 raced through the legislature and was signed into law on Feb. 19.
It allows students to choose to release information to "accredited postsecondary education institutions, testing agencies under contract with a state entity to provide a college entrance exam to students, or scholarship organizations ... for the sole purpose of increasing access to higher education opportunities for students."
But as the law previously stood, the release "was potentially a violation of the section of Montana code," Klapmeier said.
A different proposal, House Bill 619, would allow the release of test information to the office of the Commissioner of Higher Education and the Department of Labor and Industry "for the sole purpose of research directed at ensuring that Montana's K-12 education system meets the expectations of the Montana university system and the workforce needs of the state."
Data requests would have to be approved.
ACT, inc. registered a California-based lobbyist for this legislative session in Montana.
"It's not that we're opening the doors for people to come in and grab data," said OPI Chief Financial Officer Ken Bailey.
Montana's new contract with the ACT, which will apply to spring testing, allows for the release of about 10 data points, but not the full suite of information collected by the testing company. The amount of information released could be amended in the future, Klapmeier said.
State ACT testing begins in April. OPI plans to notify school districts about the release before then.
Klapmeier said the state wants students to be able to attract attention from colleges through the database, if they choose, but that the contract breach is still concerning.
"Being able to trust ACT is a huge part of that," he said.
Federal guidance from the Department of Education addressed the voluntary surveys in 2018, and raises questions about whether or not the data release violated federal law.
"We have heard from teachers and students, however, that the voluntary nature of these pre-test surveys is not well understood, and that each of the questions requires a response, and the student must affirmatively indicate in response to multiple questions that the student does not wish to provide the information," federal officials wrote.
"The administration of these tests and the associated pre-test surveys by (State education agencies) and (local education agencies) to students raises potential issues under the Family Educational Rights and Privacy Act (FERPA), the confidentiality of information provisions in the Individuals with Disabilities Education Act (IDEA), the Protection of Pupil Rights Amendment (PPRA), and several recently enacted State privacy laws, and generally raises concerns about privacy best practices."