BILL ANALYSIS Ó
SENATE COMMITTEE ON EDUCATION
Senator Carol Liu, Chair
2015 - 2016 Regular
Bill No: AB 2097
-----------------------------------------------------------------
|Author: |Melendez |
|-----------+-----------------------------------------------------|
|Version: |April 25, 2016 Hearing |
| |Date: June 15, 2016 |
-----------------------------------------------------------------
-----------------------------------------------------------------
|Urgency: |No |Fiscal: |Yes |
-----------------------------------------------------------------
-----------------------------------------------------------------
|Consultant:|Lynn Lorber |
| | |
-----------------------------------------------------------------
Subject: Pupil records: social security numbers
SUMMARY
This bill prohibits a local educational agency from collecting
or soliciting social security numbers or the last four digits of
social security numbers from students or their parents.
BACKGROUND
Existing federal law, the Family Educational Rights and Privacy
Act (FERPA):
1) Generally requires schools to have written permission from
the parent or eligible student in order to release any
information from a student's education record. However,
FERPA allows schools to disclose those records, without
consent, to the following parties or under the following
conditions:
a) School officials with legitimate educational
interest.
b) Other schools to which a student is transferring.
c) Specified officials for audit or evaluation
purposes.
d) Appropriate parties in connection with financial
AB 2097 (Melendez) Page 2
of ?
aid to a student.
e) Organizations conducting certain studies for or
on behalf of the school.
f) Accrediting organizations.
g) To comply with a judicial order or lawfully
issued subpoena.
h) Appropriate officials in cases of health and
safety emergencies.
i) State and local authorities, within a juvenile
justice system, pursuant to specific State law.
2) Authorizes schools to disclose, without consent,
"directory" information such as a student's name, address,
telephone number, and date and place of birth. Existing
law requires schools to notify parents and eligible
students about directory information and allow them a
reasonable amount of time to request that the school not
disclose such information. Existing law requires schools
to also notify parents and eligible students annually of
their rights under Family Educational Rights and Privacy
Act (FERPA). (United States Code, Title 20, § 1232(g), and
Code of Federal Regulations, Title 34, Part 99)
Existing state law:
1) Authorizes the Superintendent of Public Instruction (SPI),
in order to assist the State in evaluating the
effectiveness of special education programs, to collect and
use social security numbers of individuals with exceptional
needs as student identification numbers.
2) Prohibits the SPI from disclosing personally identifiable,
individual student records to any person, institution,
agency, or organization except as authorized by federal
law. (Education Code § 56601)
3) Prohibits a school district from permitting access to
student records to any person without written parental
consent or pursuant to a judicial order except as set forth
AB 2097 (Melendez) Page 3
of ?
in federal law. Existing law requires access to those
particular records relevant to the legitimate educational
interests of the requester to be permitted to specified
requesters of that information. (EC § 49076)
4) Requires local educational agencies to retain individual
student records, including a unique student identification
number. (EC § 60900)
ANALYSIS
This bill prohibits a local educational agency from collecting
or soliciting social security numbers or the last four digits of
social security numbers from students or their parents.
Specifically, this bill:
1) Prohibits a school district, county office of education, or
charter school from collecting or soliciting social
security numbers or the last four digits of social security
numbers from students or their parents, unless otherwise
required to do so by state or federal law.
2) Authorizes the California Department of Education to
additionally prohibit the collection and solicitation of
other personally identifiable information, as recommended
by the SPI and approved by the State Board of Education.
3) Eliminates the authority for the SPI to collect and use
social security numbers, associated with students receiving
special education or related services.
4) States legislative findings and declarations regarding
prioritizing student data privacy, and that social security
numbers are the single most misused piece of information
associated with identity theft.
STAFF COMMENTS
1) Need for the bill. According to the author, "In 2012, the
Morgan Hill Concerned Parents Association and the Concerned
AB 2097 (Melendez) Page 4
of ?
Parents Association files a lawsuit alleging the Department
was not ensuring that students with disabilities were being
given the appropriate special education services mandated
under federal law. As part of the discovery process, the
plaintiffs requested access to thousands of data points
stored by the Department, many of which contain personally
identifiable information (such as social security numbers)
of not only students with disabilities, but all children
who are attending or who have attended a California school
at any time since January 1, 2008. The judge ruled to
allow the plaintiffs access to the data, and as a result,
the information of 10 million students may be released to
the plaintiffs, a parent-run non-profit organization. Due
to the amount of opposition the judge received from
parents, she ordered that the Department maintain custody
of the most sensitive of its databases California
Longitudinal Pupil Achievement Data System (CALPADS), while
running searches for information requested by the
plaintiffs. The court also reiterated that no student's
personally identifiable information may be released to
plaintiffs unless they demonstrate to the satisfaction of
the court that the method to be used to store the sensitive
student data is secure."
2) Morgan Hill case. This bill is in response to issues
related to Morgan Hill Concerned Parents Association and
Concerned Parents Association vs. California Department of
Education, in which the plaintiffs allege the California
Department of Education (CDE) is failing to ensure that
special education students are receiving the services to
which they are entitled. As part of the discovery process,
the plaintiffs have sought access to the records of
approximately 10 million special education students. The
records are contained in the CALPADS.
On May 5, 2014 the court approved a "discovery protective order"
and subsequently approved an "E-discovery Protocol," which
identifies and describes the CDE databases that may contain
discoverable material and discusses methods by which
discovery can proceed while protecting personal identifying
information. The E-discovery Protocol identified two
options for discovery of data. Option 1 was the transfer
of data in CALPADS if and when the plaintiffs establish a
secure environment approved by a Special Master. In Option
AB 2097 (Melendez) Page 5
of ?
2, CDE would retain the data but would facilitate the
running of searches to meet the plaintiffs' discovery
needs.
The ensuing media coverage reported that the court ordered the
release of data, resulting in a huge outcry among parents
who were concerned about the security of their children's
information and the possibility of identity theft. In the
midst of this, the CDE posted a Family Educational Rights
and Privacy Act (FERPA) notice on its Web site that
included an "Objection to Disclosure of Student Information
and Records" form for parents to fill out and send to the
court. After being inundated with the forms, the court
held a special status on February 29, 2016, to discuss the
public posting of the FERPA notice, the public's response,
and the implications for discovery.
On March 1, 2016, the court eliminated Option 1 and directed the
Special Master to proceed with Option 2 and to meet and
confer with the parties to recommend further modifications
to the E-discovery Protocol. This means that the
California Department of Education (CDE) maintains custody
of California Longitudinal Pupil Achievement Data System
(CALPADs) data, while running searches for information
requested by the plaintiffs. The court also reiterated
that no student personally identifiable information may be
released to the plaintiffs unless and until they
demonstrate to the satisfaction of the court that the
method to be used to store the sensitive student data is
secure. The parties continue to litigate the extent of the
disclosure of student data.
3) Only special education. The CDE used social security
numbers as identifiers only for students receiving special
education as a means to comply with federal requirements to
track the postsecondary activities of students (neither
postsecondary education nor the workplace uses the unique
student identifiers). The CDE indicates, they are
currently working to remove social security numbers from
the California Special Education Management Information
System (CASEMIS), and are in the process of incorporating
the data for all students into the CALPADs. The CDE further
notes they have already assigned unique student identifiers
to all students, including those receiving special
education. While the CDE is already complying with the
AB 2097 (Melendez) Page 6
of ?
provisions of this bill, the bill also prohibits schools
from collecting or soliciting social security numbers or
the last four digits of social security numbers.
4) Fiscal impact. According to the Assembly Appropriations
Committee, this bill would impose no administrative costs
to the CDE to remove social security numbers from their
databases and provide new pupil identifiers as these
activities are currently underway.
SUPPORT
California State PTA
California Teachers Association
The Arc and United Cerebral Palsy California Collaboration
OPPOSITION
None received.
-- END --