Student Privacy Legislative Update — February 3, 2016

In the weeks since our last update, ESSA was signed into law, Congress has convened for a new session, Washington was buried by #Snowzilla, and states have hit the ground running introducing student privacy legislation.
 
Federal Update

• In case you missed it, ESSA was signed into law in December. The new law represents a shift in the nation’s approach to education, but it’s remarkably consistent with its predecessor (No Child Left Behind) in one significant aspect — affirming that data matters to student success. Read more about the data implications and opportunities in EducationNext.
• Key takeaways related to student privacy:
  • Keeping any FERPA amendment out of ESSA allowed the conference to be successful and gives Congress more time to consider how best to tackle the complex task of updating the 40-year-old student privacy law.
  • Congress missed an opportunity to adopt the student data privacy amendment introduced by Sens. Markey, D-Mass., and Hatch, R-Utah. The amendment would have created a Student Privacy Policy Committee to study and make recommendations on issues of student privacy and parental rights.
  • An amendment from Rep. Messer, R-Ind., explicitly lists data literacy and data privacy trainings as allowable uses of PD (Title II) grant funds for states and districts.

• Anticipate renewed attention paid to a potential FERPA amendment in the coming months — but if FERPA doesn’t move soon, it likely won’t get much action until after the presidential election this November.

 
State Update

States have hit the ground running introducing student data privacy legislation — though there are notably fewer bills this year (as DQC predicted). As of today (1/28/2016), we’ve seen 25 bills in 14 states. The same time last year (1/28/2015), we saw 85 bills in 26 states. There are two likely reasons for this slowdown. First, states have been having conversations — and legislating — around student data privacy for the past few years. In the few years that we’ve been tracking these bills, every state except Vermont has introduced some sort of student data privacy legislation. Second, it’s possible that some states are wary to pass any new privacy legislation with a likely FERPA amendment looming in the not-too-distant future.
 
Here is a summary of what we’ve seen to date:

• Eight bills are based on CA SOPIPA.
  • One such bill, NJ S 794, would also include a provision to provide schools with guidance and technical assistance around preventing and responding to data breaches involving PII.
• Most bills focus on legislating third parties, though some would legislate the state’s role in data collection, access and use.
• Seven bills would include some type of role for the Local Education Agencies.
• Three bills would require data breach notification.
• Very few bills would seriously inhibit the effective use of student data.

The ACLU recently unveiled its, “nationwide effort to empower Americans to take control of their privacy.” As part of the effort, it coordinated the simultaneous announcement of legislation in 16 states and Washington on January 20. Please note that although the legislation was announced publicly, it hasn’t yet been formally introduced in the legislature in many states.
 
Here is a handy chart depicting the volume of bills states introduced the past two legislative sessions on student data privacy; we won’t even think about exhaling until April Fool’s Day.