Book Club on a Third-Party App
You are the media specialist at a K-8 school with 640 students. You sponsor a 5th-grade book club with 22 students, ages 10-11. To keep discussion going between meetings, you created a free account on a third-party app, BookBuzz, which has a public discussion board, display names, and no district contract. Students log in with personal email addresses or school Google accounts. A parent emails the principal: their child's display name and comments are visible to anyone, and the parent never consented. The principal forwards the email to you and asks for a fix by the end of the week. Separately, a 5th-grade teacher asks to stream a PG-rated movie from her personal subscription as a Friday reward for 30 students; she says it is for fun, not teaching. Your principal has also asked you to review the school's acceptable-use policy, which was last updated in 2016.
1. Analyze the privacy and compliance problems with BookBuzz. What immediate action do you take, and what long-term alternative do you recommend?
Read the worked answer
The core problems are public visibility, collection of children's data by an unvetted vendor, use of personal email addresses, and lack of documented parental consent. Students are under 13, so children's online privacy rules and district consent procedures are directly implicated. Even if the school's use is educational, a public board is not a closed classroom space, and the vendor has not been approved through district procurement or data-privacy review.
Immediate action: I would suspend the BookBuzz discussion board, preserve evidence of what was posted, ask the vendor how to delete the group and student data, and notify the principal and district technology or privacy staff. I would contact the affected families, explain what happened, and avoid blaming the parent who reported it. I would not ask students to delete their own accounts without documenting the request.
Long-term alternative: Move discussion into a district-approved learning management system with private groups, teacher moderation, and school accounts only, or use a password-protected class site approved by the district. Any new tool needs a data-privacy agreement, a review of its retention and sharing practices, parent notice and consent where required, and a rule that students use display names only. The educational goal can be preserved without a public audience.
2. How do you respond to the teacher's request to stream the PG movie as a reward?
Read the worked answer
I would respond respectfully and concretely, not with a lecture. The classroom copyright exemption is generally for face-to-face teaching tied to instructional content, using a lawfully made copy. A Friday reward with no instructional purpose falls outside that narrow exemption, and a personal streaming subscription usually carries terms that restrict public or group exhibition. Showing the film to 30 students as entertainment creates a real licensing risk for the school.
I would offer alternatives: use a district-licensed streaming service if one exists; substitute a short, licensed clip tied to a lesson; plan a book-trailer or readers' theater activity; or ask the principal to obtain a public-performance license if the school wants a movie event. I would also suggest a reward that does not require a license, such as an outdoor reading picnic or a game period.
I would document the request and my response so the school has a consistent practice. I would not embarrass the teacher in front of students. The message is that I want to help with the reward, but I cannot treat a personal subscription as a school license. If the teacher disagrees, I would refer the question to the administrator rather than making it a personal conflict.
3. What process and content would you use to update the acceptable-use policy?
Read the worked answer
I would use a committee process, not a solo rewrite. The committee should include an administrator, the district technology director or designee, a teacher, a parent, a student at an appropriate level, and the media specialist. District legal review is essential before adoption.
Content to review: the current 2016 policy against current district policy and law; student data privacy; parent consent; device and account use; social media and publication of student work; copyright and fair use; cyberbullying and responsible behavior; filtering and network access; and AI tools. The policy should distinguish instructional use from personal use, state consequences consistently, and include a review cycle.
Process: gather input through a short staff survey and a parent meeting, draft in plain language, translate key notices, and have the principal and district approve before publication. I would include a one-page student-friendly summary and a staff quick-reference guide. The policy should not promise privacy the district cannot guarantee, and it should name who to contact with concerns. Finally, I would schedule an annual review so the policy does not become outdated again.