This paper presents the first joint hearing of the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies of the Committee on Homeland Security and the Subcommittee on Early Childhood, Elementary, and Secondary Education of the Committee on Education and the Workforce. The subcommittees met to examine data collection and privacy concerns in education, specifically the privacy and security of students' Personally Identifiable Information (PII). In recent years, the number of school districts using educational software and cloud services has exponentially increased. Today, nearly 95 percent of school districts are using these services. These services can provide numerous advantages to school administrators and educators, including individualized learning, State examination assessments and administrative functions such as attendance records. While these services can be helpful to students' development, it is vitally important that the the privacy and security concerns of sharing such sensitive information are understood. A report by the Fordham Law School found that cloud services used by school districts are poorly understood and have a lack of transparency, finding 20 percent of school districts do not have proper policies in place for the use of these services. Fewer than 7 percent restrict the sale of student information by vendors. Cyber criminals have become more sophisticated in their tactics and techniques, evidenced by the increasing number of cyber breaches at universities, schools, and retailers. Greater transparency is needed on behalf of the school districts and the vendors with which they contract. Parents enrolling their children in school should have a clear understanding of what information is collected, stored, and shared. The Family Educational Rights and Privacy Act (FERPA) is the Federal law that governs the privacy of student records. FERPA establishes when, and what type, of information school districts can share with private vendors. However, there are concerns that because FERPA was enacted in 1974, long before the advent of these technologies, it doesn't reflect the current reality in the classroom and changes in how data is collected and shared. Testimony is also given about gaps that exist in the laws that oversee the protection of student information. This joint hearing seeks to examine the sharing of student information with educational software and cloud service vendors, and the laws and guidelines that govern them. Testimonies are given from a distinguished panel, including representatives from the Fordham Law School, Software and Information Industry Association, the Idaho State Department of Education, and the Alliance for Excellent Education.