Student Privacy Legislative Update—May 19, 2015

It's been a whirlwind week for the Family Educational Rights and Privacy Act (FERPA). In addition to continuing conversations around the Kline-Scott discussion draft, we’ve seen a new FERPA amendment introduced by Sen. Vitter of Louisiana and an old (2014) amendment introduced by Sens. Markey and Hatch. More on all the FERPA excitement and a look at the states below.

Federal Update

Sen. David Vitter (R-LA) has introduced an amendment to FERPA entitled the Student Privacy Protection Act. Unlike the other FERPA amendments and discussion drafts we’ve seen, Vitter’s bill represents a wholesale rejection of the value of data to improving education and of the state’s role in using education data in service of learning. The bill is alarmist in its approach to data and privacy and all but guts state Statewide Longitudinal Data Systems (SLDS), see pg. 11 of the draft in particular.

The bill would allow only aggregated, anonymized and de-identified data to be used for state longitudinal data systems (SLDS) and would prohibit predictive analytics. Almost every current use of an SLDS that you can think of would be banned if this were to become law. In his office’s press release about the bill, Vitter is quoted as saying, “Parents are right to feel betrayed when schools collect and release information about their kids.” You may recall that last year Louisiana passed the nation’s most restrictive student data privacy law which prohibited most data sharing outside of the district (and is already resulting in negative unintended consequences)

Sens. Edward Markey (D-MA) and Orrin Hatch (R-UT) also introduced a FERPA amendment this week, the Protecting Student Privacy Act of 2015. This is the same language the two senators worked on last year. Like the recently introduced Student Digital Privacy and Parental Rights Act from Reps. Luke Messer (R-IN) and Jared Polis (D-CO) and the Kline-Scott draft, the Markey-Hatch FERPA amendment seeks to more effectively govern the activities of online service providers. However, unlike the Kline-Scott draft, the Markey-Hatch amendment does not include an expanded definition of the term “education record” to allow this expanded scope. The result is that the bill would be unable to apply additional protections or governance to any student data collected directly by service providers.

Even as these new amendments are introduced, much of the FERPA conversation in the field is still centered around the Kline-Scott discussion draft that has been circulating for the last few weeks. While the immediate timeline and next steps for the discussion draft are uncertain, many stakeholders, including DQC, have had meetings with hill staff to provide feedback and suggestions on the draft.

The recent uptick in federal activity around student data privacy has been mirrored in media coverage. This coverage has included the reemergence of the Parent Coalition for Student Privacy as a voice on student data privacy issues. Leonie Haimson and Rachel Strickland, who head up the coalition, wrote an op-ed this week on education data privacy and federal privacy laws. While the piece warns of student tracking “beyond George Orwell’s wildest fears,” it is more tempered than some of their earlier statements and offers mild praise for the Polis-Messer bill.

State Update

We are now tracking 178 student data privacy bills in 45 states. So far in 2015, 6 states have passed 12 new student data privacy laws.
 
There are two new state privacy laws since the last DQC update:

• Georgia’s Student Data Privacy, Accessibility, and Transparency Act (SB 89) combines provisions from many of last year’s most robust governance and transparency bills covering state data with the online service provider governance aspects of the SOPIPA law that California passed last year. Its comprehensive approach makes this law one of the most comprehensive and nuanced we’ve seen. The Foundation for Excellence in Education put out a statement commending Georgia’s Gov. Nathan Deal for signing the bill.
• Maryland’s Student Data Privacy Act (HB 298) is also based on California’s SOPIPA law and governs online service providers by prohibiting the commercial and secondary use of student data. Maryland’s law limits its purview to providers who have contracts with public schools, but also expands its scope to providers serving pre-k school purposes.

 
With 30 states still in session and so much recent federal activity, it will be interesting to see how states end their legislative year.