NASBE Policy Update Highlights 2016 Trends in Data Privacy Legislation
Alexandria, Va. – State legislatures in 2016 considered 185 bills on student privacy, many with significant new language and protections for students, according to a new NASBE Policy Update released today. Eighteen of these bills are now law. The report notes 17 states introduced at least one bill crafted by the American Civil Liberties Union (ACLU), and new laws in Colorado and Connecticut include some of the most stringent third-party restrictions yet. Notably, more than 50 bills expand the role of state boards of education.
In “Trends in Student Data Privacy Bills in 2016,” NASBE Director of Education Data and Technology Amelia Vance describes key elements in education data legislation introduced or passed this year and notes some states to watch:
Stricter language on third-party vendors and data protections, with emphasis on training. Colorado and Connecticut adopted laws that build on California’s SOPIPA law but go further, distinguishing between third-party service provider contracts and other programs that students use in the classroom that are not covered by school contracts. In addition, Connecticut now requires districts to notify parents every time they sign a new third-party vendor contract. Both laws also emphasize training. Colorado, for example, explicitly requires the state education agency to help districts with training. An additional 15 states considered bills that would require parent and student consent whenever student information is directly collected from service providers.
New features appear in data legislation. Several states are beginning to look at student privacy in statewide longitudinal data systems (SLDS). New Hampshire has created a commission to study its system. A new West Virginia law creates an SLDS and includes privacy provisions modeled after Oklahoma’s 2013 Student DATA Act. States like California, New Jersey, and Alabama are now incorporating privacy protections in early childhood student data collection.
States adopt ACLU-inspired bills. A growing number of states contemplated legislation addressing student data privacy more broadly. Seventeen states considered legislation put out by the ACLU to address discrepancies between the privacy available on devices students bring from home and the more limited protections on school-owned devices.
Lessons from 2015. States must be wary of unintended consequences that can come from new data privacy legislation. In New Hampshire, a 2015 law overly restricted privacy protections in the use of video recording for teacher trainings, and the state is working to address shortcomings now. In Texas, a law that requires districts to videotape special education students at a parent or educator’s request could prove a major burden for districts and has the potential to harm students when it is implemented in the 2016-17 school year.
State boards more important than ever. Fifty-four bills in 2016 mention state boards. Many of these bills task the state board with ensuring compliance with privacy rules and handling violations. Five states require state boards to participate in state privacy or data commissions, and at least 10 bills require them to promulgate rules, regulations, and model policies.
“2016 saw almost as many student data privacy bills in play as in 2015, and it is likely that more states will end up passing a law this year than last,” writes Vance. “New language from the ACLU model bills, Colorado, and Connecticut could inspire similar bills in other states or cause accidental consequences that will need to be fixed in subsequent sessions. State boards and others will want to keep a close eye on new developments and lessons.”
Find out more at www.nasbe.org