BILL NUMBER: AB 1584 AMENDED
BILL TEXT
AMENDED IN SENATE JULY 1, 2014
AMENDED IN SENATE JUNE 3, 2014
AMENDED IN ASSEMBLY APRIL 22, 2014
AMENDED IN ASSEMBLY MARCH 28, 2014
INTRODUCED BY Assembly Member Buchanan
(Principal coauthor: Assembly Member Chau)
FEBRUARY 3, 2014
An act to add Section 49073.1 to the Education Code, relating to
pupil records.
LEGISLATIVE COUNSEL'S DIGEST
AB 1584, as amended, Buchanan. Pupil records: privacy:
third-party 3rd-party contracts: digital storage
services and digital educational software.
Existing law prohibits a school district from permitting access to
pupil records to any person without parental consent or without a
judicial order, except to specified persons under certain
circumstances, including to a contractor or consultant with a
legitimate educational interest who has a formal written agreement or
contract with the school district regarding the provision of
outsourced institutional services or functions by the contractor or
consultant.
This bill would authorize a local educational agency, as defined,
to enter into a contract with a third 3rd
party, as defined, to provide services for the digital storage,
management, and retrieval of pupil records, as defined, or to
provide digital educational software, or both. The bill would require
the contract to include specified provisions, including a statement
that the pupil records continue to be the property of and under the
control of the local educational agency, a description of the actions
the third 3rd party will take to
ensure the security and confidentiality of the
pupil records, and a description of how the local
educational agency and the third 3rd
party will jointly ensure compliance with specified federal privacy
acts. The bill would require that a contract that fails to
comply with the requirements of this bill be rendered void if certain
conditions are satisfied.
The bill would provide that, if these provisions are in conflict
with the terms of a contract in effect before January 1, 2015, the
provisions shall not apply to the local educational agency or the
third 3rd party subject to that
agreement until the expiration, amendment, or renewal of the
agreement.
Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 49073.1 is added to the Education Code, to
read:
49073.1. (a) A local educational agency may enter into a contract
with a third party for either or both of the following purposes:
(1) To provide services, including cloud-based services, for the
digital storage, management, and retrieval of pupil records.
(2) To provide digital educational software that authorizes a
third-party provider of digital educational software to access and
acquire pupil records.
(b) A local educational agency that enters into a contract with a
third party for purposes of subdivision (a) shall ensure the contract
contains all of the following:
(1) A statement that pupil records continue to be the property of
and under the control of the local educational agency. For
purposes of this paragraph, "pupil records" does not include
pupil-generated content.
(2) A description of the means by which pupils may retain
possession and control of their own pupil-generated content, if any.
(2) A prohibition against the third party using personally
identifiable information in individual pupil records for commercial
or advertising purposes.
(3) A prohibition against the third party using any information in
the pupil record for any purpose other than for the requirements of
the contract.
(4) A description of the procedures by which a parent, legal
guardian, or eligible pupil may review the pupil's records and
correct erroneous information.
(5) A description of the actions the third party will take,
including the designation and training of responsible individuals, to
ensure the security and confidentiality of pupil records.
Compliance with this requirement shall not, in itself, absolve the
third party of liability in the event of an unauthorized disclosure
of pupil records.
(6) A description of the procedures for notifying the affected
parent, legal guardian, and eligible pupil in the event of an
unauthorized disclosure of the pupil's records.
(7) A certification that a pupil's records shall not be retained
or available to the third party upon completion of the terms of the
contract and a description of how that certification will be
enforced.
(8) A description of how the local educational agency and the
third party will jointly ensure compliance with the federal Family
Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g) and the
federal Children's Online Privacy Protection Act of 1998 (15 U.S.C.
Sec. 6501 et seq.) for all pupils, including pupils who are more than
13 years of age.
(9) A contract that fails to comply with the requirements of this
subdivision shall be voidable and all pupil records in possession of
the third party shall be returned to the local educational agency.
(c) In addition to any other penalties, a contract that fails to
comply with the requirements of this section shall be rendered void
if, upon notice and a reasonable opportunity to cure, the
noncompliant party fails to come into immediate compliance and cure
any defect. Written notice of noncompliance may be provided by any
party or intended beneficiary of the contract. All parties subject to
a contract voided under this subdivision shall immediately return
all pupil records in their possession to the local educational
agency.
(c)
( d) For purposes of this section, the
following terms have the following meanings:
(1) "Deidentified information" means information that cannot be
used to identify an individual pupil.
(1)
( 2) "Eligible pupil" means a pupil who has
reached 18 years of age.
(2)
( 3) "Local educational agency" includes
school districts, county offices of education, and charter schools.
(3) "Personally identifiable information" means information that
may be used on its own or with other information to identify an
individual pupil.
(4) "Pupil-generated content" means materials created by a pupil,
including, but not limited to, essays, research reports, portfolios,
creative writing, music or other audio files, and photographs.
(4)
( 5) (A) "Pupil records" means both of the
following:
(i) Any information directly related to a pupil that is maintained
by the local educational agency.
(ii) Any information acquired directly from the pupil through the
use of instructional software or applications assigned to the pupil
by a teacher or other local educational agency employee.
(B) "Pupil records" do not include records of teachers and school
administrators that are kept in their sole possession and not
revealed to any other individual except a substitute teacher.
(B) "Pupil records" does not mean any of the following:
(i) Deidentified information, including aggregated deidentified
information, used by the third party to improve educational products
for adaptive learning purposes and for customizing pupil learning.
(ii) Deidentified information, including aggregated deidentified
information, used to demonstrate the effectiveness of the operator's
products in the marketing of those products.
(iii) Deidentified information, including aggregated deidentified
information, used for the development and improvement of educational
sites, services, or applications.
(5)
(6 ) "Third party" refers to a provider of
digital educational software or services, including cloud-based
services, for the digital storage, management, and retrieval of pupil
records.
(d)
( e) If the provisions of this section are
in conflict with the terms of a contract in effect before January 1,
2015, the provisions of this section shall not apply to the local
educational agency or the third party subject to that agreement until
the expiration, amendment, or renewal of the agreement.