Amended in Senate August 21, 2014

Amended in Senate July 1, 2014

Amended in Senate June 3, 2014

Amended in Assembly April 22, 2014

Amended in Assembly March 28, 2014

California Legislature—2013–14 Regular Session

Assembly Bill No. 1584

Introduced by Assembly Member Buchanan

(Principal coauthor: Assembly Member Chau)

February 3, 2014

An act to add Section 49073.1 to the Education Code, relating to pupil records.

LEGISLATIVE COUNSEL’S DIGEST

AB 1584, as amended, Buchanan. Pupil records: privacy: 3rd-party contracts: digital storage services and digital educational software.

Existing law prohibits a school district from permitting access to pupil records to any person without parental consent or without a judicial order, except to specified persons under certain circumstances, including to a contractor or consultant with a legitimate educational interest who has a formal written agreement or contract with the school district regarding the provision of outsourced institutional services or functions by the contractor or consultant.

This bill would authorize a local educational agency, as defined, begin insert pursuant to a policy adopted by its governing board or governing body, as appropriate, end insert to enter into a contract with a 3rd party, as defined, to provide services for the digital storage, management, and retrieval of pupil records, as defined, or to provide digital educational software, or both. The bill would require the contract to include specified provisions, including a statement that the pupil records continue to be the property of and under the control of the local educational agency, a description of the actions the 3rd party will take to ensure the security and confidentiality of pupil records, and a description of how the local educational agency and the 3rd party will jointly ensure compliance with begin delete specified federal privacy acts end delete begin insert end insert begin insert the federal Family Educational Rights and Privacy Act end insert . The bill would require that a contract that fails to comply with the requirements of this bill be rendered void if certain conditions are satisfied.

The bill would provide that, if these provisions are in conflict with the terms of a contract in effect before January 1, 2015, the provisions shall not apply to the local educational agency or the 3rd party subject to that agreement until the expiration, amendment, or renewal of the agreement.

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

Section 49073.1 is added to the Education Code,
to read:

49073.1.  

(a) A local educational agency begin delete may end delete begin insert may, pursuant
to a policy adopted by its governing board or, in the case of a
charter school, its governing body, end insert enter into a contract with a
third party for either or both of the following purposes:

(1) To provide services, including cloud-based services, for the
digital storage, management, and retrieval of pupil records.

(2) To provide digital educational software that authorizes a
third-party provider of digital educational software to begin delete access and
acquire end delete begin insert access, store, and use end insert pupil records begin insert in accordance with
the contractual provisions listed in subdivision (b) end insert .

(b) A local educational agency that enters into a contract with
a third party for purposes of subdivision (a) shall ensure the
contract contains all of the following:

(1) A statement that pupil records continue to be the property
of and under the control of the local educational agency. begin delete For
purposes of this paragraph, “pupil records” does not include
pupil-generated content. end delete

(2)  begin delete A end delete begin insert Notwithstanding paragraph (1), a end insert begin insert end insert description of the means
by which pupils may retain possession and control of their own
pupil-generated content, if begin delete any end delete begin insert applicable, including options by
which a pupil may transfer pupil-generated content to a personal
account end insert .

(3) A prohibition against the third party using any information
in the pupil record for any purpose other than begin delete for the requirements
of the contract end delete begin insert those required or specifically permitted by the
contract end insert .

(4) A description of the procedures by which a parent, legal
guardian, or eligible pupil may review begin insert personally identifiable
information in end insert the pupil’s records and correct erroneous
information.

(5) A description of the actions the third party will take,
including the designation and training of responsible individuals,
to ensure the security and confidentiality of pupil records.
Compliance with this requirement shall not, in itself, absolve the
third party of liability in the event of an unauthorized disclosure
of pupil records.

(6) A description of the procedures for notifying the affected
parent, legal guardian, begin delete and end delete begin insert or end insert eligible pupil in the event of an
unauthorized disclosure of the pupil’s records.

(7)  begin insert (A) end insert begin insert   end insert A certification that a pupil’s records shall not be retained
or available to the third party upon completion of the terms of the
contract and a description of how that certification will be enforced.

begin insert

(B) The requirements provided in subparagraph (A) shall not
apply to pupil-generated content if the pupil chooses to establish
or maintain an account with the third party for the purpose of
storing that content pursuant to paragraph (2).

end insert

(8) A description of how the local educational agency and the
third party will jointly ensure compliance with the federal Family
Educational Rights and Privacy Act begin delete (20 U.S.C. Sec. 1232g) and
the federal Children’s Online Privacy Protection Act of 1998 (15
U.S.C. Sec. 6501 et seq.) for all pupils, including pupils who are
more than 13 years of age end delete begin insert (20 U.S.C. Sec. 1232g) end insert .

begin insert

(9) A prohibition against the third party using personally
identifiable information in pupil records to engage in targeted
advertising.

end insert

(c) In addition to any other penalties, a contract that fails to
comply with the requirements of this section shall be rendered
void if, upon notice and a reasonable opportunity to cure, the
noncompliant party fails to come into begin delete immediate end delete compliance and
cure any defect. Written notice of noncompliance may be provided
by any party begin delete or intended beneficiary of end delete begin insert to end insert the contract. All parties
subject to a contract voided under this subdivision shall
begin delete immediately end delete return all pupil records in their possession to the local
educational agency.

(d) For purposes of this section, the following terms have the
following meanings:

(1) “Deidentified information” means information that cannot
be used to identify an individual pupil.

(2) “Eligible pupil” means a pupil who has reached 18 years of
age.

(3) “Local educational agency” includes school districts, county
offices of education, and charter schools.

(4) “Pupil-generated content” means materials created by a
pupil, including, but not limited to, essays, research reports,
portfolios, creative writing, music or other audio begin delete files, and
photographs end delete begin insert files, photographs, and account information that
enables ongoing ownership of pupil content. “Pupil-generated
content” does not include pupil responses to a standardized
assessment where pupil possession and control would jeopardize
the validity and reliability of that assessment end insert .

(5) (A) “Pupil records” means both of the following:

(i) Any information directly related to a pupil that is maintained
by the local educational agency.

(ii) Any information acquired directly from the pupil through
the use of instructional software or applications assigned to the
pupil by a teacher or other local educational agency employee.

(B) “Pupil records” does not mean any of the following:

(i) Deidentified information, including aggregated deidentified
information, used by the third party to improve educational
products for adaptive learning purposes and for customizing pupil
learning.

(ii) Deidentified information, including aggregated deidentified
information, used to demonstrate the effectiveness of the operator’s
products in the marketing of those products.

(iii) Deidentified information, including aggregated deidentified
information, used for the development and improvement of
educational sites, services, or applications.

(6) “Third party” refers to a provider of digital educational
software or services, including cloud-based services, for the digital
storage, management, and retrieval of pupil records.

(e) If the provisions of this section are in conflict with the terms
of a contract in effect before January 1, 2015, the provisions of
this section shall not apply to the local educational agency or the
third party subject to that agreement until the expiration,
amendment, or renewal of the agreement.

begin insert

(f) Nothing in this section shall be construed to impose liability
on a third party for content provided by any other third party.

end insert