STUDENT ONLINE PERSONAL PROTECTION ACT

Senate Bill 510 (H-2) as reported from committee

Sponsor:  Sen. Phil Pavlov

House Committee:  Education

Senate Committee:  Education

Complete to 12-7-16                                                              (Enacted as Public Act 368 of 2016)

SUMMARY:

Senate Bill 510 would create a Student Online Personal Protection Act, which would protect students from having their personal information compromised or compiled by an "operator."

Key terms defined in the Act:

·         Covered information: any personally identifiable information or material in any media of format that is any of the following:

o   Created by or provided to an operator by a student or student's parent or guardian while using the operator's site, service, or application for K-12 school purposes.   

o   Created by or provided to an operator by an employee or agent of a K-12 school or school district. 

o   Gathered by an operator through operation of a site, service, or application for K-12 school purposes and identifies a student, including the student's educational record, email address, first or last name, address, or anything else that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocational information.

·         Operator: the operator of an online service or application who knows that the service or application was designed for and is being used for K-12 school purposes. 

Prohibited uses for covered information

The new act provides that an operator may not use any covered information or persistent unique identifiers that it may acquire through its site, service or application, in order to engage in targeted advertising on its own or any other site.

Likewise, an operator may not use this identifying information to compile a profile about a student, unless it is in furtherance of K-12 school purposes.  An operator is also prohibited from selling information about a student, but the sale, merger or other acquisition of the operator by another entity does not trigger this section unless the other entity violates other rules about previously acquired student information.

Except for those purposes covered under "permissible uses," below, an operator may not disclose covered information unless the disclosure is made for the following reasons:

·         In furtherance of the K-12 school purpose of the site, service, or application, if the recipient of the covered information disclosed does not further disclose the information unless done to allow or improve operability and functionality within that student's classroom or K-12 school.

·         To ensure legal and regulatory compliance.

·         To respond to or participate in the regulatory process.

·         To protect the safety of users of the site or the security of the site.

Required uses for covered information

            An operator must do all of the following:

·         Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that covered information from unauthorized access, destruction, use, modification, or disclosure; 

·         Delete a student's covered information if the K-12 school or school district requests deletion of data under its own control;

Permissible uses for covered information

An operator may disclose covered information of a student under the following circumstances:

·         If other provisions of federal or state law require the operator to disclose the information, and the operator complies with applicable laws in disclosing.

·         For legitimate research purposes as required by state or federal law, under the direction of a K-12 school, school district, or state department of education, if covered information is not used for advertising or to amass a profile on the student for purposes other than K-12 school purposes.

·         To a state or local education agency, including K-12 schools and school districts, for K-12 school purposes, as permitted by state or federal law. 

An operator is also not prohibited from using covered information that is not associated with an identified student on its own or other sites to develop, improve, or demonstrate the effectiveness of its products.

            These changes do not do any of the following:

 

·         Limit law enforcement's authority to obtain information from an operator as authorized by law or under a court order. 

·         Limit the ability of an operator to use student data, including covered information, for adaptive learning or customized student learning purposes.

·         Apply to general websites or services, even if the login credentials used for the educational site may also be used for the non-educational site.

·         Limit service providers from providing internet connectivity to schools or students and their families.

·         Prohibit an operator of an Internet website, online service, online application, or mobile application from marketing other products directly to parents, as long as they do not utilize covered information to do so.

·         Impose a duty upon the provider of a gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance with this section on those applications or software.

·         Impose a duty upon a provider of an interactive computer service to review or enforce compliance with this section by third-party content providers.

·         Prohibit students from downloading, exporting, saving, or maintaining their own student created data or documents.

·         Prohibit a K-12 school, school district, operator, or service provider from using a student's information, including covered information, solely to connect a student with a not-for-profit institution of higher education or a scholarship opportunity if the K-12 school or district has first obtained written consent from the student (if at least 18 or an emancipated minor), or a parent or guardian.  This consent may be obtained from the annual notice currently required under 34 CFR 99.7 and need not be an additional consent form.

           

SB 510 would take effect 90 days after it is enacted.

BACKGROUND:

This proposed act would be the second of its kind in the country, after California enacted its own act by the same name in 2014, taking effect in 2015.  SB 510 borrows much of its language from the California act.   

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140SB1177

FISCAL IMPACT:

SB 510 would have no fiscal impact on the state or local entities.

POSITIONS:

Education Trust Midwest supports the bill. (1-28-16)

Barry, Branch, Calhoun, Jackson, Lenawee and Monroe ISDs support the bill. (11-10-16)

Stop Common Core in Michigan opposes the bill. (11-10-16)

Hobsons Education Advances supports the bill. (11-10-16)

                                                                                        Legislative Analyst:   Jenny McInerney

                                                                                                Fiscal Analyst:   Bethany Wicksall

                                                                                                                           Samuel Christensen

■ This analysis was prepared by nonpartisan House Fiscal Agency staff for use by House members in their deliberations, and does not constitute an official statement of legislative intent.