STUDENT DATA; PRIVACY S.B. 33 (S-2):
ANALYSIS AS REPORTED FROM COMMITTEE
Senate Bill 33 (Substitute S-2 as reported)
RATIONALE
Educators, students, parents, and those in government require data in order to improve education programs and outcomes. Data allow educators to personalize academic programs, give parents tools to hold schools accountable for performance, and ensure that states allocate appropriate funding for effective programs. The privacy of student education records is protected by the Federal Family Educational Rights and Privacy Act (FERPA) and its regulations. This Act grants parents of pupils and students 18 and older (referred to by FERPA as "eligible students") certain rights with respect to education records. Some have expressed concern, however, that the protections under FERPA do not sufficiently protect the privacy of education records. To address this concern, it has been suggested that heighted disclosure requirements and privacy protections for pupil education records should be included in the Revised School Code.
CONTENT
The bill would amend the Revised School Code to do the following:
-- Require the State Board of Education to ensure that the Department of Education complied with requirements pertaining to the collection, sale, or transmission of information collected for a pupil's education records.
-- Require the State Board to ensure that the Department complied with all other applicable privacy law.
-- Require the board of a school district, board of directors of a public school academy (PSA), or governing board of an authorizing body, to ensure that the school district, intermediate school district (ISD), PSA, or authorizing body complied with various requirements pertaining to the sale of pupil education records and parental notification and disclosure.
The bill would take effect 90 days after its enactment.
Specifically, the State Board of Education would have to ensure that the Department of Education complied with the following:
-- The Department could not sell or provide to a for-profit business entity any information that was part of a pupil's education record, although the Department could provide the information to an educational management organization for a pupil enrolled in a PSA, if the PSA had a management agreement with the organization.
-- Within 30 days after the bill's effective date, the Department would have to post on its website a notice of the information it collected for a pupil's education record, including an inventory and description of all pupil data elements.
-- At least 30 days before it initiated the collection of any additional pupil data elements, the Department would have to post on its website a notice of the additional data elements it was proposing to collect and an explanation of the reasons for the proposal.
-- The Department could not disclose any information concerning a pupil that it collected or created except in accordance with a policy adopted and made publicly available by the State Board that clearly stated the criteria for disclosure.
-- The Department would have to ensure that any contract with a vendor that allowed access to education records expressly required the vendor to protect the privacy of education records and provided express penalties for noncompliance.
-- Upon written request by a pupil's parent or legal guardian, the Department would have to disclose to that individual, within 30 days and without charge, any information concerning the pupil that the Department collected or created as part of the pupil's education records.
In addition, if the Department provided any collected or created information to a person other than the pupil's school district, ISD, PSA or its authorizing body, or the pupil's parent or legal guardian, the Department would have to disclose to the parent or legal guardian, within 30 days and without charge, a) the specific information disclosed, b) the name and contact information of each person to whom the information was disclosed, and c) the reason for the disclosure.
The State Board also would have to ensure that the Department complied with all other applicable privacy law.
The board of a school district or ISD, board of directors of a PSA, or governing board of an authorizing body, would have to ensure that the school district, ISD, PSA, or authorizing body complied with both of the following: a) it could not sell or provide to a for-profit business entity any information that was part of a pupil's education record, except as provided for a PSA that had a management agreement with an educational management organization; and b) upon written request by a pupil's parent or legal guardian, it would have to disclose to that person, within 30 days and without charge, any information concerning the pupil that the district, PSA, or authorizing body collected or created as part of the pupil's education records.
If the school district, ISD, PSA, or authorizing body provided any collected or created information to any person, the district, PSA, or authorizing body would have to disclose to the parent or legal guardian, within 30 days and without charge, a) the specific information disclosed, b) the name and contact information of each person to whom the information was disclosed, and c) the reason for the disclosure. This requirement would not apply to a school district, ISD, PSA, or authorizing body providing the information to the Department or the pupil's parent or legal guardian. The requirement also would not apply to any of the following:
-- A PSA providing the information to its authorizing body or an educational management organization with which it had a management agreement.
-- A school district providing the information to its ISD.
-- An ISD providing the information to a school district in which the student was enrolled or resided.
-- An authorizing body providing the information to a PSA in which the student was enrolled.
If an educational management organization received information that was part of a pupil's education records from any source as permitted, the educational management organization could not sell or provide the information to any other person except as provided in the bill.
"Education records" would mean that term as defined in 34 CFR 99.3: those records that are directly related to a student, and are maintained by an educational agency or institution or by a party acting for the agency or institution. The term does not include, for example, records that are kept in the sole possession of the maker used only as a memory aid, records of an education agency or institution law enforcement unit, or records relating to an individual employed at the educational agency or institution kept in the normal course of business, unless the individual is employed as a result of his or her status as a student.
"Educational management organization" would mean that term as defined in Section 503c, 523c, or 553c of the Code, as applicable: an entity that enters into a management agreement with a PSA, an urban high school academy, or a school of excellence. "Management agreement" would mean that term as defined in Section 503c, 523c, or 553c, as applicable: an agreement to provide comprehensive educational, administrative, management, or instructional services or staff to a PSA, an urban high school academy, or a school of excellence.
"Authorizing body" would mean that term as defined in Part 6A (Public School Academies), 6C (Urban High School Academies), or 6E (Schools of Excellence), or Section 1311b of the Code, as applicable. (The term refers to various entities that issue a contract authorizing a PSA, an urban high school academy, or a school of excellence.)
BACKGROUND
The Family Educational Rights and Privacy Act and the regulations promulgated under it apply to any educational agency or institution that receives funds from any program administered by the U.S. Department of Education. As mentioned above, FERPA grants parents of pupils under 18 and eligible students certain rights with respect to education records. Under FERPA, a pupil's parent or an eligible student may inspect and review the student's education records maintained by a school within 45 days of his or her written request, and may request that a school correct inaccurate or misleading records. Generally, FERPA requires schools to have written permission from a parent or eligible student in order to release any information from a student's education record, with certain exceptions. Schools may disclose education records without consent to various parties, for example: a) school officials with legitimate educational interest; b) other schools to which a student is transferring; c) specified officials for evaluation purposes; d) appropriate parties in connection with financial aid; e) accrediting organizations; f) organizations conducting studies for the school; and g) appropriate officials in cases of health and safety emergencies or in connection with the juvenile justice system.[1] A school also may disclose education records in order to comply with a judicial order or subpoena.
In addition, FERPA allows a school to disclose, without consent, so-called "directory information", or "information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed".[2] This information can include the student's name, address, phone number, e-mail address, photograph, date and place of birth, major field of study, height and weight, awards, and when the student attended the school.[3] The school must inform parents and eligible students about the types of information the school has designated as directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information without prior consent.[4]
ARGUMENTS
(Please note: The arguments contained in this analysis originate from sources outside the Senate Fiscal Agency. The Senate Fiscal Agency neither supports nor opposes legislation.)
Supporting Argument
A significant amount of data and information pertaining to students is collected in public schools. These data include, for example, course grades, test scores, demographic information, programs, and attendance. Some of the data is personally identifiable information. It is possible that the data could be sold or transmitted to for-profit businesses, such as retailers or health-related companies, or the release of personal information could lead to identity theft. The bill would allow parents to see what information is collected by the Department and would give the public 30 days' notice if the Department wished to collect additional student data. The bill also would prohibit the sale of student data to a for-profit business entity, and would provide a mechanism for a parent to learn when information contained in his or her child's education records was disclosed to other parties.
Legislative Analyst: Jeff Mann
FISCAL IMPACT
The bill would result in a number of additional expenses for the Department of Education and the Center for Educational Performance and Information (CEPI), since both the Department and CEPI collect pupil information. First, the Department and CEPI would need to spend resources to list the current pupil information that is collected and post it on the webpage within 30 days. The Department and CEPI then would need to spend resources on reviewing existing contracts to ensure that they were in compliance with the statute. Finally, the Department and CEPI would need to develop a formal process that allowed parents and legal guardians to request information concerning their pupil's record and respond to the request within 30 days. Currently, CEPI receives these requests under Federal requirements; however, there is no formal process and no time line for a response. The 30-day response time and the possible increase in the volume of requests would result in additional costs. At this time, the total administrative costs are unknown.
The bill also would result in additional expenses for ISDs, school districts, and PSAs, which would have to ensure that current contracts and practices were in compliance with the statute. They also would have to have a formal process for parents and legal guardians to request their pupil's information, and respond within 30 days. At this time, the total administrative costs for local units are unknown.
This analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent.