BILL ANALYSIS Ó ----------------------------------------------------------------- |SENATE RULES COMMITTEE | AB 1584| |Office of Senate Floor Analyses | | |1020 N Street, Suite 524 | | |(916) 651-1520 Fax: (916) | | |327-4478 | | ----------------------------------------------------------------- THIRD READING Bill No: AB 1584 Author: Buchanan (D), et al. Amended: 8/21/14 in Senate Vote: 21 SENATE EDUCATION COMMITTEE : 7-0, 6/11/14 AYES: Liu, Wyland, Block, Correa, Hancock, Huff, Monning SENATE JUDICIARY COMMITTEE : 7-0, 6/24/14 AYES: Jackson, Anderson, Corbett, Lara, Leno, Monning, Vidak ASSEMBLY FLOOR : 75-0, 5/5/14 (Consent) - See last page for vote SUBJECT : Pupil records: third party contracts and digital storage services SOURCE : Author DIGEST : This bill authorizes a local educational agency (LEA), pursuant to a policy adopted by its governing board or governing body, as appropriate, to enter into a contract with a third party to provide services for the digital storage, management, and retrieval of pupil records, provided the contract includes specific provisions about the use, ownership, and control of the pupil records, as specified. Senate Floor Amendments of 8/21/14 make clarifying changes to the contractual requirements that an LEA must adhere to if it elects to enter into a contract with a third party for digital storage services. CONTINUED AB 1584 Page 2 ANALYSIS : Existing law prohibits a school district from permitting access to student records to any person without written parental consent or pursuant to a judicial order except as set forth in the federal Family Educational Rights and Privacy Act (FERPA). Access to those particular records relevant to the legitimate educational interests of the requester shall be permitted to the following requesters: 1. School officials, employees of the district, and members of a school attendance review board. 2. Officials and employees of other public schools where the pupil intends to or is enrolled. 3. The Controller General of the U. S., the U. S. Secretary of Education, state and local educational authorities, or the U. S. Department of Education's Office of Civil Rights, if the information is necessary to audit or evaluate a federally funded program. 4. Other state and local officials if the information is required to be reported pursuant to state law adopted before November 19, 1974. 5. Parents of a pupil 18 years of age or older if the pupil is a dependent. 6. A pupil who is 16 years of age or older or who has completed 10th grade and a pupil who is 14 years of age or older who is a homeless or unaccompanied youth. 7. A district attorney conducting a truancy mediation program or investigating a violation of compulsory attendance laws. 8. A probation officer, district attorney, or counsel of record for a minor for purposes of conducting a criminal investigation or an investigation in regards to declaring a person a ward of the court or involving a violation of a condition of probation. 9. A judge or probation officer in relation to a truancy mediation program. CONTINUED AB 1584 Page 3 10.A county placing agency. 11.A representative of a child welfare agency. 12.Appropriate persons in connection with a health or safety emergency. 13.Agencies in connection with the application of a pupil for financial aid. 14.Accrediting associations. 15.A contractor or consultant with a legitimate educational interest who has a formal written agreement or contract with the school district regarding the provision of outsourced institutional services or functions. Existing law requires an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its Web site to conspicuously post its privacy policy. The federal FERPA is intended to protect the privacy of student education records. It applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, federal FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions: 1. School officials with legitimate educational interest. 2. Other schools to which a student is transferring. 3. Specified officials for audit or evaluation purposes. 4. Appropriate parties in connection with financial aid to a student. 5. Organizations conducting certain studies for or on behalf of the school. 6. Accrediting organizations. 7. To comply with a judicial order or lawfully issued subpoena. 8. Appropriate officials in cases of health and safety emergencies. CONTINUED AB 1584 Page 4 9. State and local authorities, within a juvenile justice system, pursuant to specific state law. Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, and date and place of birth. However, schools must tell parents and eligible students about directory information and allow them a reasonable amount of time to request that the school not disclose such information. Schools must also notify parents and eligible students annually of their rights under federal FERPA. This bill: 1. Authorizes a LEA, pursuant to a policy adopted by its governing board or, in the case of a charter school, its governing body, to enter into a contract with a third party for either or both of the following purposes: A. To provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records. B. To provide digital educational software that authorizes a third party provider of digital educational software to access, store and use pupil records, in accordance with the contractual provisions listed, as specified. 1. Requires an LEA that enters into a contract with a third party to ensure the contract contains all of the following: A. A statement that pupil records continue to be the property of and under the control of the LEA. B. A description of the means by which pupils may retain possession and control of their own pupil-generated content, if applicable, including options by which a pupil may transfer pupil-generated content to a personal account. C. A prohibition against the third party using any information in the pupil record for any purpose other than for those required or specifically permitted by the contract. CONTINUED AB 1584 Page 5 D. A description of the procedures by which a parent, legal guardian, or eligible pupil may review personally identifiable information in the pupil's records and correct erroneous information. E. A description of the actions the third party will take, including the designation and training of responsible individuals, to ensure the security and confidentiality of pupil records. Compliance with this requirement shall not, in itself, absolve the third party of liability in the event of an unauthorized disclosure of pupil records. F. A description of the procedures for notifying the affected parent, legal guardian, or eligible pupil in the event of an unauthorized disclosure of pupil's records. G. A certification that a pupil's records shall not be retained or available to the third party upon completion of the terms of the contract and a description of how that certification will be enforced. Provides this requirement shall not apply to pupil-generated content if the pupil chooses to establish or maintain an account with the third party for the purpose of storing that content, as specified. H. A description of how the LEA and the third party will jointly ensure compliance with the federal FERPA. I. A prohibition against the third party using personally identifiable information in pupil records to engage in targeted advertising. 2. Provides that in addition to any other penalties, a contract that fails to comply with the requirements, as specified, shall be rendered void if, upon notice and a reasonable opportunity to cure, the noncompliant party fails to come into compliance and cure any defect. Written notice of noncompliance may be provided by any party to the contract. All parties subject to a contract voided under this bill shall return all pupil records in their possession to the LEA. CONTINUED AB 1584 Page 6 3. States, for the purposes of this bill, the following terms have the following meanings: A. "Deidentified information" means information that cannot be used to identify an individual pupil. B. "Eligible pupil" means a pupil who has reached 18 years of age. C. "Local educational agency" includes school districts, county offices of education, and charter schools. D. "Pupil-generated content" means materials created by a pupil, including, but not limited to, essays, research reports, portfolios, creative writing, music or other audio files, photographs, and account information that enables ongoing ownership of pupil content. "Pupil-generated content" does not include pupil responses to a standardized assessment where pupil possession and control would jeopardize the validity and reliability of that assessment. 1. Defines pupil records as any information directly related to a pupil that is maintained by the LEA or any information acquired directly from the pupil through the use of instructional software of applications assigned to the pupil by a teacher or other employees of the LEA. 2. Provides that "pupil records" does not mean any of the following: A. Deidentified information, including aggregated deidentified information, used by the third party to improve educational products for adaptive learning purposes and for customizing pupil learning. B. Deidentified information, including aggregated deidentified information, used to demonstrate the effectiveness of the operator's products in the marketing of those products. C. Deidentified information, including aggregated deidentified information, used for the development and improvement of educational sites, services, or CONTINUED AB 1584 Page 7 applications. 1. Defines third party as a provider of digital educational software or services, including cloud-based services, for the digital storage, management, and retrieval of pupil records. 2. Provides that if the provisions of this bill are in conflict with the terms of a contract in effect before January 1, 2015, the provisions of this bill shall not apply to the LEA or the third party subject to that agreement until the expiration, amendment, or renewal of the agreement. 3. States nothing in this bill shall be construed to impose liability on a third party for content provided by any other third party. FISCAL EFFECT : Appropriation: No Fiscal Com.: No Local: No SUPPORT : (Verified 8/22/14) Association of California School Administrators California State PTA Common Sense Media ARGUMENTS IN SUPPORT : According to the author's office, the growing use of online and cloud-based services for providing instructional software and assessment and for maintaining student records has put student privacy at risk. There are loopholes in current law that permit the disclosure of confidential student records to private vendors without parental knowledge or consent. The protections afforded by existing state and federal law have not kept pace with the use of cloud-based and online services by private, for-profit companies to "data mine" student records. The author's office indicates that private companies are currently acquiring access to student records with little oversight to ensure the confidentiality of those records. This bill is intended to strengthen protections against the misuse or improper disclosure of student records by requiring contracts entered into between a K-12 education agency and a third party provider to contain specified, privacy-related provisions. CONTINUED AB 1584 Page 8 ASSEMBLY FLOOR : 75-0, 5/5/14 AYES: Achadjian, Alejo, Allen, Ammiano, Atkins, Bigelow, Bloom, Bocanegra, Bonilla, Bonta, Bradford, Brown, Buchanan, Ian Calderon, Campos, Chau, Chávez, Chesbro, Conway, Cooley, Dababneh, Dahle, Daly, Dickinson, Donnelly, Eggman, Fong, Fox, Frazier, Beth Gaines, Garcia, Gatto, Gomez, Gonzalez, Gordon, Gorell, Gray, Grove, Hagman, Harkey, Roger Hernández, Holden, Jones, Jones-Sawyer, Levine, Linder, Lowenthal, Maienschein, Medina, Mullin, Muratsuchi, Nazarian, Nestande, Olsen, Pan, Patterson, Perea, V. Manuel Pérez, Quirk, Quirk-Silva, Rendon, Ridley-Thomas, Rodriguez, Salas, Skinner, Stone, Ting, Wagner, Waldron, Weber, Wieckowski, Wilk, Williams, Yamada, John A. Pérez NO VOTE RECORDED: Hall, Logue, Mansoor, Melendez, Vacancy PQ:k 8/22/14 Senate Floor Analyses SUPPORT/OPPOSITION: SEE ABOVE **** END **** CONTINUED