BILL ANALYSIS �
AB 1442
Page 1
Date of Hearing: April 1, 2014
ASSEMBLY COMMITTEE ON JUDICIARY
Bob Wieckowski, Chair
AB 1442 (Gatto) - As Amended: March 25, 2014
As Proposed to be Amended
SUBJECT : School Districts: Social Media Monitoring
KEY ISSUE : Should school districts be required to notify
parents before collecting publicly-accessible information from a
student's social media account and to destroy that information
within one year after the student turns 18 or no longer attends
the school, whichever comes first?
SYNOPSIS
This bill seeks to protect student privacy when a school
district adopts a program to monitor information that students
post on social media. According to the author, this bill was
introduced in response to concerns raised by students and
parents in the Glendale Unified School District when they
learned that the district hired a company to monitor student's
social media accounts, compile information about the students,
and then report this information back to the school. While the
school district claimed that this was done only to track and
prevent harmful behavior, such as violence or bullying, many
parents and students apparently saw the practice as an
unwarranted intrusion into their private lives. Moreover, as
the author points out, however well-intended, allowing a private
company to collect and compile this information creates the
possibility that the information could be further disclosed
without the student's consent or obtained by hackers who gain
access to the information. This bill, therefore, would limit
(but not prohibit) the ability of school districts to collect
and store a student's social media postings and related
information, such as locational data. Specifically, it would
require a school district to notify parents and students about
any plan to monitor social media and provide an opportunity for
public comment before any such program is adopted. It would
only allow the school to gather and maintain social media
postings that are publicly accessible, and it would require the
school district to destroy the social media information one-year
after the student turns 18 or leaves the district, whichever
AB 1442
Page 2
comes first. If the school district contracts with a third
party to monitor student social media content, this bill
subjects the third party to similar limitations on how
information can be used, shared, and maintained. The following
bill summary and analysis reflects amendments that the author
will take in this Committee, most notably moving the bill's
provision from the privacy provisions of the Civil Code to the
privacy provisions of the Education Code. In addition to the
author's amendments, the Committee may wish to discuss with the
author an amendment that would clarify that nothing in the bill
would prevent a school district from using the information to
fulfill existing legal obligations or to prevent a reasonably
foreseeable harm.
SUMMARY : Requires a school district that gathers and maintains
information about a student from social media to notify parents,
limit the information that it collects, and to destroy the
information when no longer needed, as specified. Specifically,
this bill :
1)Requires a school district, county office of education, or
charter school administration (school district) that considers
a program to gather and maintain in its records personal
information obtained through social media on any student
enrolled in the school district to notify the students,
parents, and guardians and provide an opportunity for public
comment prior to the adoption of any such program. In
addition, a school district that adopts such a program shall
do all of the following:
a) Gather and maintain only information that was made
publicly accessible, as defined, and not including either
of the following: (i) information that the school district
knows or has reason to believe was reposted or otherwise
made available by another party without the express consent
of the original author; or (ii) any secondary information,
including but not limited to geolocation information,
derived from content posted to social media unless that
secondary information was intentionally made publicly
accessible.
b) Provide students with access to any personal information
about the student gathered or maintained by the school
district and obtained from social media, and the
opportunity to correct or delete information gathered or
AB 1442
Page 3
maintained in violation of this bill.
c) Destroy personal information gathered from social media
maintained in its records within one year of a student
turning 18 years of age or within one year after the
student is no longer enrolled in the school district,
whichever is first, and notify each parent or guardian of
this policy.
d) If the school district contracts with a third party to
gather personal information from social media on any
student enrolled in the school district, then the contract
shall do all of following:
i) Prohibit the third party from using the information
for its own purposes.
ii) Prohibit the third party from selling the
information or sharing the information with any person or
entity other than the school district.
iii) Require the third party to destroy the information
immediately upon satisfying the terms of the contract, or
within one year of a student turning 18 years of age, or
within one year after the student is no longer enrolled
in the school district, whichever is first.
EXISTING LAW :
1)Prohibits, consistent with the federal Family Educational
Rights and Privacy Act (FERPA), a school district from
disclosing information in a student record without parental
consent or a judicial order, unless disclosure is expressly
authorized by statute. (Education Code Sections 49073 -
49079.7.)
2)Prohibits an employer from doing any of the following: require
or request an employee to disclose a username or password to
his or her personal social media account; require an employee
to open his or her social media account in the presence of an
employer; or require an employee to disclose any of the
content of his or her social media account, except when
relevant to legitimate investigation of misconduct, as
specified. (Labor Code Section 980.)
3)Prohibits an operator of an Internet Web site, online service,
online application, or mobile application, from marketing or
AB 1442
Page 4
advertising specified products or services to a minor and from
knowingly disclosing the personal information of a minor to a
third party for the purpose of marketing or advertising
specified types of products or services. (Business and
Professions Code Section 22580.)
4)Requires the operator of an Internet Web site, online service,
online application, or mobile application to permit a minor,
who is a registered user of the operator's service, to remove
or request removal of any content that was posted on the
operator's service by the minor, except as specified.
(Business and Professions Code Section 22581.)
FISCAL EFFECT : As currently in print this bill is keyed fiscal.
COMMENTS : In recent years, in California and elsewhere, parents
and school officials have confronted the problem of
"cyberbullying" - or the use of electronic media by one student
to harass, intimidate, or generally terrorize another student.
As students spend more time peering into their mobile devices
and communicating with each other via Twitter, Facebook,
Instagram, or the latest social networking application (whatever
that may be), the opportunities for cyberbullying have
increased. (See e.g. The National Crime Prevention Council
webpage on Cyberbullying at http://www.ncpc.org/cyberbullying.)
Glendale Unified School District became interested in monitoring
cyberbullying and other harmful online activities after two
students within the school district committed suicide in the
same school year. One of the students committed suicide by
jumping from the roof of a three-story campus building during
the school's lunch hour, when other students were outside on the
campus grounds and could witness the event. Although the
deceased student's parents, school officials, and police
investigators eventually came to different conclusions about the
extent to which "bullying" or the use of social media had played
any role in the suicide, it was at least initially assumed to be
a factor. Whatever the cause of the student suicides, in 2013
the Glendale district contracted with Geo Listening, a Hermosa
Beach-based company that monitors the publicly accessible
messages and images that students post on blogs and Internet
services such as Facebook, Twitter, and Instagram. The
company's computer flags certain words that might suggest, among
other things, suicidal thoughts, bullying, self-harm, substance
AB 1442
Page 5
abuse, domestic violence or abuse, and hate speech. Although
the effectiveness of such monitoring remains uncertain, the firm
hired by the Glendale district claimed that it successfully
intervened with a student "who was speaking of ending his life"
on social media. In a second incident, a student posted a photo
appearing to depict a gun. Though further investigation showed
that it was a fake gun, the incident may indicate the ability of
monitoring to alert school officials to potential problems or
dangers. Thus far the Glendale district has not disciplined any
student based upon his or her postings, but a school official
did not rule out that possibility in appropriate circumstances.
(See e.g. "Glendale District Says Social Media Monitoring is for
Student Safety," Los Angeles Times, September 14, 2013.)
Privacy Implications of Social Media Monitoring Programs: There
may indeed be benefits to social media monitoring, especially if
it truly allows the school to identify and reduce bullying, or
if it alerts school officials to students who may harm
themselves or others. However, according to the author and
privacy advocates, such monitoring raises significant privacy
concerns. In recent years, this Committee has heard numerous
bills seeking to protect individual privacy by imposing limits
on the ability of businesses and government agencies to collect,
use, or share personal information. The Legislature has been
especially concerned with protecting the privacy rights of
minors. For example, last year's SB 568 (Chapter 336, Stats. of
2013) prohibited website operators and online and mobile
services from sending advertisements to minors for products that
they were not old enough to legally use or purchase. SB 568
also permitted minors to remove or demand removal of messages or
images that they had posted online.
Concerns about the privacy and security of digital information -
of both minors and adults - were greatly heightened by the
recent and well-publicized data breaches involving Target and
other major retailers. Indeed, the Target breach prompted joint
hearings in both the Assembly and the Senate. One point of
consensus that emerged from those hearings is that, while data
breaches can never be completely prevented, the consequences of
data breaches can be greatly mitigated by limiting the amount of
personal data that is collected and stored - and thus available
to database hackers. In short, businesses and government
agencies should only collect as much information as is necessary
to complete a transaction or perform a designated function, and
the data collected should be deleted or otherwise destroyed once
AB 1442
Page 6
it is no longer needed for a legitimate purpose. A second point
of consensus is that, to the fullest extent to which it is
practical, people should know what, when, how, and why data is
being collected about them.
This bill appropriately reflects these points of consensus by
requiring notice, limiting upfront collection, and requiring the
destruction of the information at a certain point.
Specifically, this bill would only permit the school to monitor
social media postings that were accessible to the general
public. It would not, for example, permit the school district
to gather content that the student intended to keep private or
only intended to share with a designated group of friends. The
bill would require the school to notify students and parents of
any plan to gather social media content, and to provide an
opportunity for public comment before adopting such a program.
The bill would also permit a student to have access to any
information that the school maintains and demand that the school
correct or delete any information that is gathered or maintained
in violation of this bill's provisions. Finally, the bill would
require the school district to destroy any social media
information that it gathers and maintains within one year of the
student turning 18 years of age, or within one year after the
student is no longer enrolled in the school district, whichever
comes first. Recognizing that many districts may, like the
Glendale district, contract with a third party to perform the
monitoring, this bill would also impose similar restrictions on
the third party, and expressly prohibits the third party from
selling, sharing, or disclosing the information to any entity
other than the school district.
The Bill Limits Social Media Monitoring; It Does Not Authorize
It : It is important to stress what this bill does not do. It
does not authorize schools to engage in any form of monitoring
in which they cannot already engage. Although schools, like any
other person or entity, have the right to access social media
information that is publicly posted and accessible, a school's
ability to use and act upon such information is limited by any
number of legal and constitutional principles. For example, a
school could not punish a student for social media postings if
those postings constituted protected speech under the First
Amendment, nor could a student be punished for his or her
postings if the punishment did not meet the grounds for
disciplinary actions set forth in Education Code Section 48907
et seq. If a school district maintains the information in its
AB 1442
Page 7
school records, then the school district cannot disclose any
information from those records in violation of the federal
Family Educational Rights and Privacy Act (FERPA), or the
parallel privacy provisions in the California Education Code
that protects the privacy of student records. This bill would
similarly impose constraints if a school district adopts a
social media monitoring program that is not otherwise
prohibited.
PROPOSED AUTHOR AMENDMENTS: In addition to restricting social
media monitoring by schools, an earlier version of this bill
would have amended the Civil Code in order to apply the
Information Practices Act (IPA) to local government agencies,
including school districts. (The IPA, with one exception,
currently only applies to state, not local, agencies.) However,
the author wishes to amend the bill so as to only address a
school districts' use of social media; therefore, the bill as
proposed to be amended will add a section to the privacy
provisions of the Education Code. Specifically, the author
wishes to amend the bill in this Committee as follows:
Amendments
Delete entire contents of the bill in print and insert the
following:
Section 49073.6 is added to the Education Code to read:
Section 49073.6
(a) For purposes of this section
(1) "Social media" means an electronic service or account,
or electronic content, including, but not limited to,
videos, still photographs, blogs, video blogs, podcasts,
instant and text messages, email, online services or
accounts, or Internet Web site profiles or locations.
(2) "Publicly accessible" means anything posted on social
media or any other Internet Web site that is accessible to
the general public. "Publicly accessible" does not mean
anything posted on social media or any other Internet Web
site that is only accessible to a restricted group of
persons.
AB 1442
Page 8
(b)A school district, county office of education, or charter
school administration that considers a program to gather or
maintain in its records personal information obtained through
social media on any student enrolled in the school district
shall notify students, parents, and guardians about the any
proposed program and provide an opportunity for public comment
prior to the adoption of any such program.
(c)A school district, county office of education, or charter
school administration that adopts a program pursuant to
subdivision (b) shall do all of the following:
(1) Gather or maintain only information that was made publically
accessible, not to include either:
(A) Information that the district, county office of
education, or charter school administration knows or has
reason to believe was reposted or otherwise made available
by another party without the express consent of the
original author.
(B) Any secondary information, including but not limited to
geolocation information, derived from content posted to
social media unless that secondary information was
intentionally made publicly accessible.
(2) Provide students with access to any personal information
about the student gathered or maintained by the district, county
office of education, or charter school administration and
obtained through social media, and the opportunity to correct or
delete information gathered or maintained in violation of
paragraph (1).
(3) Destroy personal information gathered from social media
maintained in its records within one year of a student turning
18 years of age, or within one year after the student is no
longer enrolled in the school district, county office of
education, or charter school administration, whichever is first.
(4) Notify each parent or guardian of the student that personal
information is being gathered from social media and that any
information maintained in its records with regard to the student
shall be destroyed in accordance with paragraph (3).
(5) If the school district, county office of education, or
charter school administration contracts with a third party to
AB 1442
Page 9
gather personal information from social media on any student
enrolled in the school district, county office of education, or
charter school administration, then the contract shall do all of
following:
(A) Prohibit the third party from using the information for
its own purposes.
(B) Prohibit the third party from selling the information or
sharing the information with any person or entity other
than the school district.
(C) Require the third party to destroy the information
immediately upon satisfying the terms of the contract, or
within one year of a student turning 18 years of age, or
within one year after the student is no longer enrolled in
the school district, county office of education, or charter
school administration, whichever is first.
The Committee may wish to consider whether it is necessary to
clarify that nothing in the bill would prevent a school from
taking certain actions based on information that it receives
from the student's social media. For example, if a student
posted a note that he or she was contemplating suicide, and
another student re-posted that note, would the school be
prohibited from disclosing that post to the student's parents
because the school was not able to determine whether the student
contemplating suicide had provided "express consent" to the
student that re-posted the note? If the school came across
postings suggesting that a student was being sexually or
physically abused at home, would the school be prohibited from
gathering and sharing that information with authorities, as the
school is otherwise required to due under the mandatory reporter
law? The author has communicated to the Committee that he is
confident that such a clarification is not necessary because the
school's duty to comply with other laws and to take emergency
actions is already "implicit." Whether this is implicit or not,
it has long been the custom of the Legislature to remove any
potential ambiguity if the commands of one statute could be
reasonably construed to conflict with the commands of another
statute. Therefore, the Committee may wish to discuss with the
author whether adding the following subdivision would be
advisable:
(a)Nothing in this section shall be construed to prevent a
school district from taking any action otherwise required by
law, or to take action necessary to prevent reasonably
AB 1442
Page 10
foreseeable harm to a student or another person, if the school
district determines, based on any information received or
gathered as a result of the program, that such action is
necessary.
Definition of "Social Media" : The author has sensibly borrowed
the only two code sections that define "social media," Education
Code Section 99120 and Labor Code Section 980. While it makes
sense to keep definitions of "social media" consistent
throughout the Code, the two existing definitions - and thus the
definition adopted here - include e-mail within the definition
of "social media." E-mail is not generally considered "social
media," at least in popular parlance, and it would not be deemed
"publicly posted" under this bill since e-mail is always
addressed to a selected individual or limited group of
recipients. Presumably, then, the only time e-mail would be at
issue under this bill is if an e-mail message were publicly
re-posted on an Internet website or posted to the general public
on a social networking website.
ARGUMENTS IN SUPPORT: According to the author, social media
monitoring by schools "raises concerns that pictures and text
posted by still young and impressionable students could be
stored by private companies, only to be released (or threatened
to be released) decades later by a hacker or an unscrupulous
employee (perhaps while a former student is engaged in a job
search or grad-school application)." The author stresses that
he does not necessarily wish to prohibit schools from engaging
in social media monitoring. However, this measure, the author
believes, will "provide parents reasonable warning and an
assurance to students that any potentially embarrassing or
harmful information gathered about students in their formative
years would be properly destroyed after its need had passed and
not 'come back to haunt them' in their adult lives." The author
concludes: "During an era of omnipresent intrusion in our lives
and increasingly frequent data breaches, all levels of
government must take steps to safeguard our personal
information. Whether it is the NSA, a city, or a school
district, people have the right to know when, and for how long,
the government can gather and keep their personal data before
destroying it. AB 1442 will strengthen these rights."
REGISTERED SUPPORT / OPPOSITION :
AB 1442
Page 11
Support
None on file
Opposition
None on file
Analysis Prepared by : Thomas Clark and Vignesh Ganapathy /
JUD. / (916) 319-2334