BILL ANALYSIS Ó
AB 2097
Page 1
Date of Hearing: April 13, 2016
ASSEMBLY COMMITTEE ON EDUCATION
Patrick O'Donnell, Chair
AB 2097
(Melendez) - As Amended March 18, 2016
[Note: This bill has been double referred to the Assembly
Committee on Privacy and Consumer Protection and will be heard
by that committee as it relates to issues under its
jurisdiction.]
SUBJECT: Pupil records: social security numbers
SUMMARY: Prohibits the collection of social security numbers
(SSNs) of pupils by the California Department of Education
(CDE). Specifically, this bill:
1) Makes finding and declarations regarding the importance
of pupil data privacy and the misuse of SSNs by criminals
perpetrating identity thefts.
2) Prohibits school districts from collecting or soliciting
SSNs or the last four digits of SSNs from pupils or their
parents or guardians unless otherwise required to do so by
state or federal law.
3) Authorizes the CDE to prohibit the collection and
AB 2097
Page 2
solicitation of other personally identifiable information
as recommended by the SPI and approved by the State Board
of Education (SBE).
4) Repeals the authority of the SPI to collect and use SSNs
of special education pupils as pupil identification
numbers.
5) Requires the SPI, commencing in 2017-18, to assign a
pupil identification number to individuals with exceptional
needs for the purposes of evaluating special education
programs and related services.
EXISTING LAW: Authorizes the SPI to collect and use SSNs-or
assign another number if the SSN is not available-of special
education pupils to use as pupil identification numbers for the
purposes of evaluating special education programs and related
services.
FISCAL EFFECT: Unknown
COMMENTS: Information contained in pupil records is subject to
the protection of the federal Family Educational Rights and
Privacy Act (FERPA). State law is generally consistent with
FERPA. These laws permit education agencies, including the CDE,
to collect and retain personally identifiable information on
pupils, including SSNs. However, they also prohibit education
agencies from disclosing SSNs and other personal information
without the prior written consent of the parent or guardian
except in specified circumstances.
Federal regulations define personally identifiable information
to include the following:
AB 2097
Page 3
The student's name;
The name of the student's parent or other family
members;
The address of the student or student's family;
A personal identifier, such as the student's social
security number, student number, or biometric record;
Other indirect identifiers, such as the student's date
of birth, place of birth, and mother's maiden name;
Other information that, alone or in combination, is
linked or linkable to a specific student that would allow a
reasonable person in the school community, who does not
have personal knowledge of the relevant circumstances, to
identify the student with reasonable certainty; or
Information requested by a person who the educational
agency or institution reasonably believes knows the
identity of the student to whom the education record
relates.
For purposes of California's assessment program, Education Code
60603(t) defines "personally identifiable information" to
include "a pupil's name and other direct personal identifiers,
such as the pupil's identification number. Personally
identifiable information also includes indirect identifiers,
AB 2097
Page 4
such as the pupil's address and personal characteristics, or
other information that would make the pupil's identity easily
traceable through the use of a single or multiple data sources,
including publicly available information."
Personally identifiable information may be disclosed without
prior written consent in specified cases, including if the
disclosure is to comply with a judicial order or lawfully issued
subpoena. In these cases, the educational agency may disclose
the information if it makes a reasonable effort to notify the
parent or eligible student of the order or subpoena in advance
of compliance, so that the parent or eligible student may seek
protective action, unless the disclosure is in compliance with:
A federal grand jury subpoena and the court has ordered
that the existence or the contents of the subpoena or the
information furnished in response to the subpoena not be
disclosed;
Any other subpoena issued for a law enforcement purpose
and the court or other issuing agency has ordered that the
existence or the contents of the subpoena or the
information furnished in response to the subpoena not be
disclosed; or
An ex parte court order obtained by the United States
Attorney General (or designee not lower than an Assistant
Attorney General) concerning investigations or prosecutions
of an act of domestic or international terrorism.
In addition, if an educational agency initiates legal action
against a parent or student, the educational agency may disclose
to the court, without a court order or subpoena, the education
records of the student that are relevant for the educational
agency to proceed with the legal action as plaintiff. Also, if
AB 2097
Page 5
a parent or eligible student initiates legal action against an
educational agency, the educational agency may disclose to the
court, without a court order or subpoena, the student's
education records that are relevant for the educational agency
to defend itself.
This bill is in response to the case of Morgan Hill Concerned
Parents Association and Concerned Parents Association vs.
California Department of Education, in which the plaintiffs
allege the CDE is failing to ensure that special education
students are receiving the services to which they are entitled.
As part of the discovery process, the plaintiffs have sought
access to the records of approximately 10 million special
education students. The records are contained in the California
Longitudinal Pupil Achievement Data System (CALPADS).
On May 5, 2014 the court approved a "discovery protective order"
and subsequently approved an "E-discovery Protocol," which
identifies and describes the CDE databases that may contain
discoverable material and discusses methods by which discovery
can proceed while protecting personal identifying information.
The E-discovery Protocol identified two options for discovery of
data. Option 1 was the transfer of data in CALPADS if and when
the plaintiffs establish a secure environment approved by a
Special Master. In Option 2, CDE would retain the data but
would facilitate the running of searches to meet the plaintiffs'
discovery needs.
This was widely reported in the media as a court-ordered release
of data and resulted in an outcry among parents who were
concerned about the security of their children's information and
the possibility of identity theft. In the midst of this, the
CDE posted a FERPA notice on its website that included an
"Objection to Disclosure of Student Information and Records"
form for parents to fill out and send to the court. After being
inundated with the forms, the court held a special status on
AB 2097
Page 6
February 29, 2016 to discuss the public posting of the FERPA
notice, the public's response, and the implications for
discovery.
This was followed by a court order on March 1, 2016 in which the
court affirmed the rights of parents to be notified but ruled
that parental consent is not required for the disclosure of
student records. In addition, the court eliminated Option 1 and
directed the Special Master to proceed with Option 2 and to meet
and confer with the parties to recommend further modifications
to the E-discovery Protocol.
There is no way of knowing if the public response to the court
order would have been as strong if the CALPADS data did not
include SSNs. There is little doubt, however, that the
existence of SSNs in the data base is a major concern. The CDE
uses SSNs as identifiers for special education students but not
for regular education students. However, the CDE is phasing out
the use of SSNs and indicates it can comply with the timeline
required by this bill.
Technical amendment needed. This bill prohibits school
districts from collecting or soliciting SSNs from pupils.
However, pupils are also enrolled in charter schools and county
office of education schools, collectively known as local
education agencies (LEAs). To ensure all students are
protected, staff recommends that the bill be amended to replace
the reference to school districts with a reference to all LEAs.
REGISTERED SUPPORT / OPPOSITION:
Support
California State PTA
AB 2097
Page 7
Opposition
None received
Analysis Prepared by:Rick Pratt / ED. / (916) 319-2087