"EPIC has brought some very strong claims," Reidenberg said. And however the EPIC suit is decided, states will start to enact restrictions on student data collection and sharing, Reidenberg predicted, because FERPA lacks any recourse rights for children or their parents.
"Data breaches are going to happen," he said, noting that even in the heavily regulated financial services industry, which spends substantial amounts of money on information security, "data exposures happen on a regular basis."
Perhaps because of the growing outcry, the Department of Education's chief privacy officer recently issued informal guidance on FERPA and student privacy.
But, if data privacy objections prompt new rules or regulations, will that will stunt the use of data-driven technologies in education? We asked Cameron Evans, Microsoft's national and chief technology officer of U.S. education, for his opinion.
"We do see some uses of student data that need to be addressed and foreclosed, including advertising and marketing uses by cloud service providers," Evans said in an email response. He also wrote: "We can enable data-driven technologies in learning by being fully transparent with schools on how we use the student data we collect, and most importantly, ensuring our schools that this data will never be used for commercial interests unrelated to the IT services we are providing them and their students."
But some critics are skeptical about the stated goals of educational data collection per se, which proponents claim is entirely around improving student performance through technology.
"No, I don't think their goal is to improve education," Kaplan said. "It's to make money."
Likewise, Haimson rejected the heralded benefits of data collection, sharing and analysis in education.
"We're not fooled by the PR spin about a 'tech revolution in learning,'" she said. "There's no proven value to any of this stuff -- no research to show any of this stuff works." The real goal of theses high-tech projects, she declared, is simply to get cut costs by getting rid of teachers and putting larger and larger classes online.
What change might satisfy Haimson?
"Opt-in would satisfy me," she said, referring to parental opt-in to collect or use PII by the school or third parties.
But Reidenberg was dubious an opt-in mechanism would solve the problem. "The complexity and sophistication of the data uses would make it difficult for the average parent to know what they're consenting to," he said.