Student Sues Chicago Public Schools Over Naviance Data Use (1)

A Chicago public school student and his parent have sued the school system and several education technology companies for illegally collecting sensitive personal data using the platform Naviance.

The college-readiness platform provides planning tools and counseling—and, according the purported class action filed Aug. 18—has been a vehicle by which companies can extract personal data.

“While the benefits of such products are questionable, what is not, is the amount of data they gather about the schoolchildren that use them,” said plaintiff Q.J. and his parent J.J.

The complaint names Naviance provider PowerSchool Holdings LLC, its subsidiary Hobsons Inc., and the Board of Education of the City of Chicago, alleging they have caused millions of school students to hand over data and forfeit privacy without consent. The proposed class action, filed in the US District Court for the Northern District of Illinois, was brought on behalf of all public school students in Illinois and across the country who have used Naviance.

The complaint alleges violations of the Fourth Amendment, the Illinois Eavesdropping Act, and the California Invasion of Privacy Act. It also accuses PowerSchool Holdings, which acquired Hobsons around March 2021, and Hobsons of breaching their contracts with Chicago Public Schools by failing to comply with federal and state student-privacy laws, including the Federal Educational Rights and Privacy Act.

Among the data obtained by PowerSchool Holdings and Hobsons was a student’s photograph, email address, phone number, home address, gender, ethnicity, citizenship, and school history, according to the lawsuit.

In an emailed statement to Bloomberg Law, a PowerSchool spokesperson said respecting student data privacy rights is “of paramount importance” to the company, and PowerSchool’s products comply with federal and state data privacy laws and regulations.

“We do not collect, process, maintain, use, or share student personal information beyond that needed for authorized educational or school purposes, or as authorized by the district, parent, or student,” the spokesperson said.

While the defendants had a “duty to exercise reasonable care,” the suit says, they unlawfully allowed unauthorized access to and interception of education records and failed to provide adequate oversight of sensitive data.

The breach of contract occurred as PowerSchool Holdings continues to say it’s a signatory to the Student Privacy Pledge signed by K-12 school service providers, promising not to “collect, maintain, use or share student personal information beyond that needed for authorized educational/school purposes,” according to the complaint. The contracts with Chicago Public Schools also required Hobsons, and later PowerSchool Holdings after it bought the company, to comply with the Illinois School Student Records Act, which bars student records from being released, transferred, or disclosed unless certain exceptions apply.

The student, alongside his parent, alleged that each time he logged into the platform his data transmissions and communications were “surreptitiously intercepted, monitored, captured and recorded and contemporaneously transmitted” to the servers of data analytics company Heap Inc.

Heap, also named as a defendant in the case, allows website operators to capture user interactions on their websites, according to the complaint. The student said he wasn’t aware that his platform interactions were being recorded.

The student and parent requested damages. Alongside putative class members, they are represented by Drury Legal LLC.

Heap and Chicago Public Schools didn’t immediately respond to a request for comment.

The case is Q.J. v. PowerSchool Holdings LLC et al, N.D. Ill., No. 1:23-cv-05689, complaint filed 8/18/23.