Amended in Assembly April 13, 2015

California Legislature—2015–16 Regular Session

Assembly Bill No. 817

Introduced by Assembly Member Calderon

February 26, 2015

An act to amend Section 22584 of the Business and Professions Code, relating to privacy.

LEGISLATIVE COUNSEL’S DIGEST

AB 817, as amended, Calderon. Privacy: students.

Existing law, commencing on January 1, 2016, prohibits an operator from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. Existing law defines an “operator” as the operator of an Internet Web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school begin delete purposes end delete begin insert purposes, as defined, end insert and was designed and marketed for K-12 school purposes. begin insert Under existing law, “K-12 school purposes” means those purposes that customarily take place at the direction of the K-12 school, teacher, or school district or aid in the administration of school activities. end insert

begin delete

This bill would redefine an “operator” as the operator of an Internet Web site, online service, online application, or mobile application that, pursuant to a contract or agreement with a school or district, establishes the site, service, or application used primarily for K-12 school purposes and was designed and marketed primarily for K-12 school purposes.

end delete begin insert

This bill would specify that “K-12 school purposes” do not include communications to and from parents or students 14 years of age or older regarding postsecondary or extracurricular educational, military, or career products or services, as specified.

end insert

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

Section 22584 of the Business and Professions
Code is amended to read:

22584.  

(a) For the purposes of this section, “operator” means
the operator of an Internet Web site, online service, online
application, or mobile application begin delete that, end delete begin delete pursuant to a contract or
agreement with a school or district, establishes end delete begin insert with actual
knowledge that end insert the site, service, or application begin delete that end delete is used primarily
for K-12 school purposes and was designed and marketed begin delete primarily end delete
for K-12 school purposes.

(b) An operator shall not knowingly engage in any of the
following activities with respect to their site, service, or application:

(1) (A) Engage in targeted advertising on the operator’s site,
service, or application, or (B) target advertising on any other site,
service, or application when the targeting of the advertising is
based upon any information, including covered information and
persistent unique identifiers, that the operator has acquired because
of the use of that operator’s site, service, or application described
in subdivision (a).

(2) Use information, including persistent unique identifiers,
created or gathered by the operator’s site, service, or application,
to amass a profile about a K-12 student except in furtherance of
K-12 school purposes.

(3) Sell a student’s information, including covered information.
This prohibition does not apply to the purchase, merger, or other
type of acquisition of an operator by another entity, provided that
the operator or successor entity continues to be subject to the
provisions of this section with respect to previously acquired
student information.

(4) Disclose covered information unless the disclosure is made:

(A) In furtherance of the K-12 purpose of the site, service, or
application, provided the recipient of the covered information
disclosed pursuant to this subparagraph:

(i) Shall not further disclose the information unless done to
allow or improve operability and functionality within that student’s
classroom or school; and

(ii) Is legally required to comply with subdivision (d);

(B) To ensure legal and regulatory compliance;

(C) To respond to or participate in judicial process;

(D) To protect the safety of users or others or security of the
site; or

(E) To a service provider, provided the operator contractually
(i) prohibits the service provider from using any covered
information for any purpose other than providing the contracted
service to, or on behalf of, the operator, (ii) prohibits the service
provider from disclosing any covered information provided by the
operator with subsequent third parties, and (iii) requires the service
provider to implement and maintain reasonable security procedures
and practices as provided in subdivision (d).

(c) Nothing in subdivision (b) shall be construed to prohibit the
operator’s use of information for maintaining, developing,
supporting, improving, or diagnosing the operator’s site, service,
or application.

(d) An operator shall:

(1) Implement and maintain reasonable security procedures and
practices appropriate to the nature of the covered information, and
protect that information from unauthorized access, destruction,
use, modification, or disclosure.

(2) Delete a student’s covered information if the school or
district requests deletion of data under the control of the school or
district.

(e) Notwithstanding paragraph (4) of subdivision (b), an operator
may disclose covered information of a student, as long as
paragraphs (1) to (3), inclusive, of subdivision (b) are not violated,
under the following circumstances:

(1) If other provisions of federal or state law require the operator
to disclose the information, and the operator complies with the
requirements of federal and state law in protecting and disclosing
that information.

(2) For legitimate research purposes: (A) as required by state
or federal law and subject to the restrictions under applicable state
and federal law or (B) as allowed by state or federal law and under
the direction of a school, school district, or state department of
education, if no covered information is used for any purpose in
furtherance of advertising or to amass a profile on the student for
purposes other than K-12 school purposes.

(3) To a state or local educational agency, including schools
and school districts, for K-12 school purposes, as permitted by
state or federal law.

(f) Nothing in this section prohibits an operator from using
deidentified student covered information as follows:

(1) Within the operator’s site, service, or application or other
sites, services, or applications owned by the operator to improve
educational products.

(2) To demonstrate the effectiveness of the operator’s products
or services, including in their marketing.

(g) Nothing in this section prohibits an operator from sharing
aggregated deidentified student covered information for the
development and improvement of educational sites, services, or
applications.

(h) “Online service” includes cloud computing services, which
must comply with this section if they otherwise meet the definition
of an operator.

(i) “Covered information” means personally identifiable
information or materials, in any media or format that meets any
of the following:

(1) Is created or provided by a student, or the student’s parent
or legal guardian, to an operator in the course of the student’s,
parent’s, or legal guardian’s use of the operator’s site, service, or
application for K-12 school purposes.

(2) Is created or provided by an employee or agent of the K-12
school, school district, local education agency, or county office of
education, to an operator for K-12 school purposes.

(3) Is gathered by an operator through the operation of a site,
service, or application described in subdivision (a) and is
descriptive of a student or otherwise identifies a student, including,
but not limited to, information in the student’s educational record
or email, first and last name, home address, telephone number,
email address, or other information that allows physical or online
contact, discipline records, test results, special education data,
juvenile dependency records, grades, evaluations, criminal records,
medical records, health records, social security number, biometric
information, disabilities, socioeconomic information, food
purchases, political affiliations, religious information, text
messages, documents, student identifiers, search activity, photos,
voice recordings, or geolocation information.

(j) “K-12 school purposes” means purposes that customarily
take place at the direction of the K-12 school, teacher, or school
district or aid in the administration of school activities, including,
but not limited to, instruction in the classroom or at home,
administrative activities, and collaboration between students, school
personnel, or parents, or are for the use and benefit of the school.
begin insert “K-12 school purposes” do not include communications to and
from parents or students 14 years of age or older regarding
postsecondary or extracurricular educational, military, or career
products or services, including, but not limited to, college readiness
assessments and preparation for them, recruitment for and
financing of the costs of those product and service opportunities,
and educational assistance or enrichment opportunities. end insert

(k) This section shall not be construed to limit the authority of
a law enforcement agency to obtain any content or information
from an operator as authorized by law or pursuant to an order of
a court of competent jurisdiction.

(l) This section does not limit the ability of an operator to use
student data, including covered information, for adaptive learning
or customized student learning purposes.

(m) This section does not apply to general audience Internet
Web sites, general audience online services, general audience
online applications, or general audience mobile applications, even
if login credentials created for an operator’s site, service, or
application may be used to access those general audience sites,
services, or applications.

(n) This section does not limit Internet service providers from
providing Internet connectivity to schools or students and their
families.

(o) This section shall not be construed to prohibit an operator
of an Internet Web site, online service, online application, or
mobile application from marketing educational products directly
to parents so long as the marketing did not result from the use of
covered information obtained by the operator through the provision
of services covered under this section.

(p) This section does not impose a duty upon a provider of an
electronic store, gateway, marketplace, or other means of
purchasing or downloading software or applications to review or
enforce compliance of this section on those applications or
software.

(q) This section does not impose a duty upon a provider of an
interactive computer service, as defined in Section 230 of Title 47
of the United States Code, to review or enforce compliance with
this section by third-party content providers.

(r) This section does not impede the ability of students to
download, export, or otherwise save or maintain their own student
created data or documents.