The Mineola School District never had an executed contract or data privacy agreement with Quave, the company behind the district’s controversial video education program. Called Build Your Own Grade, the program is owned by Superintendent Michael Nagler and his 19-year-old son, James.
The BYOG program, which was terminated on Oct. 10 after backlash from parents and students, asked eighth-graders to learn almost entirely on iPads through videos and by completing online tasks in response to those videos in their English, math, science and social studies classes. A petition against the program garnered over 600 signatures after both students and parents said it made learning difficult, stressful and ineffective, as teachers were reportedly barred from directly answering the majority of student questions.
“To be clear, there were no contracts, agreements, memoranda of understanding, licensing agreements or data privacy agreements between the school district or Board of Education and Quave, Build Your Own Grade, Build YourGrade, BYOG, James Nagler, Superintendent Nagler, or any company or individual substantially involved with those platforms or services,” reads a document procured by a FOIL request and shared with Schneps Media LI.
The FOILed documents included an unexecuted data privacy agreement, meaning one was never in effect while the program was being used.
State law requires districts to enter into signed, written contracts with third-party companies that handle student data. Contractors must agree to protect student data by limiting its use to educational purposes, implementing industry-standard protection and destroying or returning data when done. Data privacy agreements must be published on the company’s website.
Parent Stephanie Guariglia said she finds the result of the FOIL request, which she submitted, concerning.
“I just feel like they were so irresponsible with our kids’ information, just because it was a relative of the superintendent,” she said over the weekend. “That’s not OK.”
The FOILed documents showing that there were never contracts between Quave and the district appear to conflict with earlier statements made by Board President Cheryl Lampazona and Nagler, who said Quave adhered to all data protection and privacy requirements and that signed agreements existed.
“As required by New York Education Law Section 2-d, Quave has completed the standard data privacy agreement required of all vendors in the district with whom student data is shared,” reads a September email from Lampazona to a district parent obtained by Schneps Media LI. “A written agreement has been signed and will be formally approved at the next board meeting.”
“Quave is currently adhering, and will continue to adhere, to all of the protection requirements of student data outlined in federal and New York State law and regulation, and the district’s policies regarding protection of student data and privacy,” the email continued.
Nagler made a similar statement at the district’s Oct. 9 Board of Education meeting.
“In terms of a data privacy agreement, PII, personally identifiable information, has always been protected,” Nagler said. “In terms of COPPA, HIPAA, and FERPA, none of those were violated. The Ed Law 2-D was followed and an agreement was signed.”
The FOILed documents also state no payment was provided to Quave from the district and nothing was ever signed by either party because the board never approved the data privacy agreement or a contract before the program was rolled out,
The district confirmed there were no signed contracts or data privacy agreements in an email to Schneps Media LI Monday.
It did not respond to a question on where student data collected by Quave currently is, whether it has been deleted by Quave and who can access it.
Data security professional Greg Couture, a parent, has said he believed Nagler created his own Google Cloud server to store the data and that the BYOG platform lacked data security and violated privacy protection laws in a “dangerous” way after he looked at the software on his eighth grader’s device.
“He deployed something with no safeguards, no cybersecurity review, no actual care in the world about protecting the data, and he stored it on a server he and his son own through a company they created in July,” Couture previously said. “This is such malfeasance. It’s such a conflict of interest.”
Earlier in October, Couture said he found that the data collected by Quave includes student names, school emails, grades, IP addresses and location when logging into the app and submitting assignments. He believes the software and the cloud would be “incredibly easy” for someone to hack into since he figured out how to do it “within five minutes.”
He has filed formal complaints with the Federal Trade Commission and the state attorney general.
Couture and other parents have also expressed extreme concern over conflicts of interest between Nagler, Quave and the district, with many calling for Nagler’s resignation at the district’s Oct. 9 Board of Education meeting.
During that Oct. 9 meeting, the board approved a contract to hire outside legal counsel for an investigation into the program, data privacy concerns and potential conflicts of interest between Nagler, Quave and the district.
Lampazona told Schneps Media LI that the board “understands the concerns conveyed by parents and community members” about Nagler, but “cautions against making assumptions and rushing to judgment before the facts are gathered,” in a Monday email.
“As explained at the last board meeting, there is an investigation being undertaken, and the board will take any necessary actions and share the findings with the community as appropriate once that process is complete,” reads an email written by Lampazona and sent by the district’s PR firm, Syntax.
After the Oct. 9 board meeting, students told Schneps Media LI they wanted the BYOG program to end, but were stressed out about what a transition away from the program would mean for them.
When asked on Monday, Lamapasona told Schneps Media LI that the transition away from BYOG was “seamless” and “teachers returned to the same instructional strategies they used in the past to deliver the curriculum.”
Lamapasona also said it has returned to a “traditional grading system,” and that students did not experience any interruption.
“The platform was only in use for approximately 15 school days, and the teachers were able to secure all information from the platform before it was terminated,” Lamapasona wrote in an email. “Grading has been changed back to the traditional grading system without interruption.”
Mineola’s Board of Education will meet on Thursday, Oct. 30, at 7 p.m. at the district’s Synergy building, across from the high school. Parents said they plan to attend to ask additional questions in the aftermath of the program.
