STUDENT DATA; PRIVACY S.B. 33 (S-3):
SUMMARY OF BILL
ON THIRD READING
Senate Bill 33 (Substitute S-3 as reported by the Committee of the Whole)
CONTENT
The bill would amend the Revised School Code to require the State Board of Education and the State Budget Director to ensure that the Department of Education and the Center for Educational Performance and Information (CEPI), respectively, complied with the following:
-- The Department or CEPI could not sell any information that was part of a pupil's education records.
-- Within 30 days after the bill's effective date, the Department and CEPI would have to post on their respective websites a notice of the information collected for a pupil's education record, including an inventory and description of all pupil data elements.
-- At least 30 days before the Department or CEPI initiated the collection of any additional pupil data elements, it would have to post on its website a notice of those data elements and an explanation of the reasons for the proposal.
-- The Department or CEPI could not disclose any information concerning a pupil that it collected or created except in accordance with a policy adopted and made publicly available by the State Board or the State Budget Director, as applicable, that clearly stated the criteria for disclosure.
-- The Department or CEPI would have to ensure that any contract with a vendor that allowed access to education records expressly required the vendor to protect the privacy of education records and provided express penalties for noncompliance.
-- If the Department or CEPI provided any collected or created personally identifiable information to a person other than the pupil's school district, intermediate school district (ISD), public school academy (PSA) or its authorizing body, preschool, postsecondary institution, or the pupil's parent or legal guardian, the Department or CEPI would have to disclose to the parent or legal guardian upon written request, within 30 days and without charge, a) the specific data fields disclosed, b) the name and contact information of each person, agency, or organization to which the information was disclosed, and c) the reason for the disclosure.
In addition, the State Board and the State Budget Director would have to ensure that the Department and CEPI, respectively, complied with all other applicable privacy laws.
The board of a school district or ISD, board of directors of a PSA, or governing board of an authorizing body, would have to ensure that the school district, ISD, PSA, or authorizing body complied with both of the following:
-- It could not sell or provide to a for-profit business entity any personally identifiable information that was part of a pupil's education record, except as provided for: a) a PSA that had a management agreement with an educational management organization; b) providing information as necessary for standardized testing; and c) providing information to an individual or entity providing educational or educational support services to a pupil.
-- Upon written request by a pupil's parent or legal guardian, it would have to disclose to that person, within 30 days and without charge, any personally identifiable information concerning the pupil that the district, PSA, or authorizing body collected or created as part of the pupil's education records.
If the school district, ISD, PSA, or authorizing body provided any collected or created information to any person, the district, PSA, or authorizing body would have to disclose to the parent or legal guardian, within 30 days and without charge, a) the specific information disclosed, b) the name and contact information of each person, agency, or organization to which the information was disclosed, and c) the legitimate reason the entity had in obtaining the information. This requirement would not apply to a school district, ISD, PSA, or authorizing body providing the information to the Department, CEPI, or the pupil's parent or legal guardian. The requirement also would not apply to the following: a) a PSA providing the information to its authorizing body or an educational management organization with which it had a management agreement, b) a school district providing the information to its ISD, c) an ISD providing the information to a school district in which the student was enrolled or resided, d) an authorizing body providing the information to a PSA in which the student was enrolled e) providing the information to an entity with written consent from the pupil's parent or legal guardian, or if the pupil were at least age 18, the pupil, f) providing the information to an entity under a subpoena or court order, or g) providing the information for standardized testing.
If an educational management organization received information that was part of a pupil's education records from any source as permitted, the educational management organization could not sell or provide the information to any other person except as provided in the bill.
Proposed MCL 380.1136 Legislative Analyst: Jeff Mann
FISCAL IMPACT
The bill would result in a number of additional expenses for the Department of Education and the Center for Education Performance and Information, since both the Department and CEPI collect pupil information. First, the Department and CEPI would have to spend resources to list the current pupil information that was collected and post it on the webpage within 30 days. The Department and CEPI then would have to spend resources on reviewing existing contracts to ensure that they were in compliance with the statute. Finally, the Department and CEPI would have to develop a formal process that allowed parents and legal guardians to request information concerning their pupil's record and respond to the request within 30 days. Currently, CEPI receives these requests under Federal requirements; however, there is no formal process and no time line for a response. The 30-day response time and the possible increase in the volume of requests would result in additional costs. At this time, the total administrative costs are unknown.
The bill also would result in additional expenses for ISDs, school districts, and PSAs, which would have to ensure that current contracts and practices were in compliance with the statute. They also would have to have a formal process for parents and legal guardians to request their pupil's information, and respond within 30 days. At this time, the total administrative costs for local units are unknown.
Date Completed: 11-4-15 Fiscal Analyst: Cory Savino
This analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent.