Student Privacy Legislative Update—August 18, 2015

In the weeks since our last update, FERPA has taken a backseat (for now), the Senate passed the Elementary and Secondary Education Act (ESEA), Delaware’s governor signed a new student data privacy law, and there are several new resources to check out.

State Update

You may have seen or heard our friend and partner, Jim Steyer, CEO and Founder of Common Sense Media, raising public awareness around the issue of student data privacy in recent weeks. He was instrumental in shaping California’s student privacy legislation (SOPIPA) and he speaks specifically about this law as the solution. However, given the sound bite nature of the media, most viewers aren’t likely to realize the immense progress most state legislatures have made around student data privacy, and the public may be left feeling that students are more unprotected than they are. While SOPIPA is a good example of student data privacy legislation, it is not the only good example. States are borrowing, copying, adapting and creating different approaches to address privacy concerns in a way that is contextual and meets the needs of parents and families in their state. To ensure that all of the facts are out there, yesterday DQC published Credit where It’s Due: Recognizing Progress on Student Data Privacy. To that end, here’s what states are up to:

We’re continuing to track 182 student data privacy bills introduced in 46 states. So far in 2015, 15 states have passed 28 new student data privacy laws. Most recently, Delaware Gov. Jack Markell signed into law SB 79, modeled on SOPIPA, which implements numerous governance and transparency measures and prohibits service providers from using data for commercial purposes. So far this year, six states have passed six laws following the SOPIPA model (17 states have introduced 30 SOPIPA-based bills), and 12 states have passed 22 laws that implement various other approaches to ensure that student data are safeguarded. States are continuing to address many of the same themes as earlier in the year, including use of data by service providers, targeted advertising, breach notification and more.

With only 14 states still in session (many of those states having year-round sessions), we’re diligently tallying up bills and analyzing trends. Expect to see DQC’s year-end wrap up later this summer.

Federal Update

With both the House and Senate in recess until after Labor Day, we all have a few weeks to catch our breath before things start moving again in September.

• The Senate adopted the Markey/Hatch ESEA amendment to establish a policy commission to study student privacy and provide recommendations. DQC supported this amendment.
• We expect the bi-partisan Kline-Scott FERPA amendment to be picked up again in the fall. We are very encouraged about the direction of the bill and the extent to which it addresses concerns raised by the education community after the discussion draft was circulated this spring. We are still deeply concerned about the studies exception (which applies only to studies focused on improving outcomes at the agency or institution providing the data) and the lack of a clear path for those working with students in communities to access appropriate data without parental consent. (We do not expect the House to try to include this bill in ESEA during conference.)

New Resources

• DQC is finalizing a brief outlining the importance of data driven research in improving education. In addition to the brief, we will include a handout that partner organizations can use when meeting with policymakers. Expect to see this resource sometime in the coming weeks.
• Getting Smart released a “bundle” on student data backpacks this Thursday, in partnership with DQC and Digital Learning Now.
• Heads up: United Opt Out is hosting a twitter event, #ParentStrike for Student Privacy, on September 17. The event is conflating testing opt-out with student privacy.