There’s big news on the federal privacy legislation front as states continue their own activity at a fever pitch, including six new laws and big news in Georgia and Louisiana.

For a complete list of state education privacy laws, check out this chart of U.S. State Education Privacy Legislation 2015 in the IAPP Resource Center based on information provided by the Data Quality Campaign.

Federal Updates

Today’s big news is, of course, the release a discussion draft of a proposed Family Educational Rights and Privacy Act amendment from Rep. Bobby Scott (D-VA), ranking member of the Education and the Workforce Committee, and Rep. John Kline (D-MN), chairman of the Education and the Workforce Committee. The bill is designed to stand alone and is not intended to be rolled into The Elementary and Secondary Education Act (ESEA). The offices of Reps. Scott and Kline are directly sharing the proposed bill with numerous education groups and encourage additional sharing. The  offices will begin inviting groups up to the hill for bipartisan feedback conversations within the next two to three weeks, but they are eager to receive feedback from all interested parties at any time. Every part of the amendment is on the table for discussion and there is no formal process or format for providing feedback, although something in writing is preferred.

Reps. Jared Polis (D-CO) and Luke Messer (R-IN) continue to plan for the introduction of their Student Digital Privacy and Parental Rights Act. Polis and Messer’s staffs continue to revise the bill based on input from the education community.  Staff would like to introduce this bill on April 13, but the date may be pushed back given the ESEA schedule.

ADVERTISEMENT

Syrenis: What does the future of privacy look like?

State Update

State legislative sessions continue to be quite active. 2015 has so far seen 165 bills introduced in 42 states , and six new student data privacy laws—three in Virginia and three in Utah. Here’s a brief overview of the new laws:

Virginia

  • HB 2350 directs the state Department of Education and the Virginia Information Technologies Agency to develop a model data security plan for districts. It also requires the designation of a chief data security officer to assist local school divisions with the development or implementation of data use and security policies.
  • HB 1334 requires the state Department of Education to develop policies ensuring state and local compliance with federal and state privacy laws and requires parental notification in instances of possible disclosures of electronic records in violation of FERPA.
  • HB 1698 requires parental notice of student surveys that include questions on "sensitive" topics and allows parents to opt children out of taking the survey.

Utah

  • HB 163 requires an education entity to notify parents if there is a release of their student's PII due to a security breach.
  • HB 68 requires the state Board of Education to make recommendations to the legislature on updating student privacy laws in statute and in board rule (with input from educators, parents, other stakeholders). Recommendations will address data security, communicating to parents how data are used, processes for data disclosure to other education agencies, other states and third parties, including contact requirements and prohibitions against using data for non-education services and commercial purposes. It also requires the board to designate a chief privacy officer.
  • SB 204 allows a parent to opt out of any federal- or state-mandated assessment or an assessment that requires use of a state assessment system or software that is provided or paid for by the state.

Georgia is close to having its first student privacy law of the year; SB 89 passed unanimously through the House and Senate in the nick of time before the state legislature adjourned on April 2 and is now awaiting the governor’s review. This bill was originally introduced as a digital learning bill, but was later substituted with a version containing many aspects of the governance bill introduced in numerous states last year (e.g. Colorado) including a chief privacy officer, a public data inventory, and new privacy protections, as well as provisions of California’s SOPIPA language that governs service providers and prohibits use of student data for secondary and commercial purposes. This bill’s passage is the result of the hard work of a diverse group of education advocates and is a real win for a state whose only 2014 student data privacy bill was incredibly prohibitive.

Although, as noted above, Louisiana has not yet started its 2015 session, the sponsor of one of Louisiana’s laws from 2014 has prefiled a bill (HB 718) to amend that law. As you likely recall, last year the Louisiana legislature passed the most problematic student data privacy law in the country, which prohibits districts from sharing PII with any entity including the state, without parental consent. We had heard that the sponsor was interested in reopening the law this year to try to make some fixes, which is great, but the amended bill as it stands is still deeply problematic. The bill would expand the parties districts can contract with for data services, but would also leave the majority of the law’s provisions in place and would prohibit any contractor from using student data for predictive modeling.

As of April 6, 11 states have concluded their 2015 legislative sessions, including Arizona, which adjourned nearly a month earlier than scheduled. Since Louisiana does not begin its session for another week, 38 states and DC are currently in session.