Bill Text: AZ SB1306 | 2015 | Fifty-second Legislature 1st Regular | Engrossed
Bill Title: Schools; data privacy
Spectrum: Moderate Partisan Bill (Republican 6-1)
Status: (Engrossed - Dead) 2015-04-02 - House third reading FAILED voting: (29-30-1-0) [SB1306 Detail]
Download: Arizona-2015-SB1306-Engrossed.html
|
House Engrossed Senate Bill |
|
State of Arizona Senate Fifty-second Legislature First Regular Session 2015
|
|
SENATE BILL 1306 |
|
|
|
|
AN ACT
amending sections 15‑185, 15‑249.01 and 15‑874, Arizona Revised Statutes; amending Title 15, chapter 9, article 8, Arizona Revised Statutes, by adding section 15-1041.01; amending sections 15‑1042 and 15‑1043, Arizona Revised Statutes; repealing section 15‑1044, Arizona Revised Statutes; amending section 15‑1045, Arizona Revised Statutes; amending title 15, chapter 9, article 8, Arizona Revised Statutes, by adding section 15-1046; repealing section 41‑3016.23, Arizona Revised Statutes; relating to student data.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it enacted by the Legislature of the State of Arizona:
Section 1. Section 15-185, Arizona Revised Statutes, is amended to read:
15-185. Charter schools; financing; civil penalty; transportation; definitions
A. Financial provisions for a charter school that is sponsored by a school district governing board are as follows:
1. The charter school shall be included in the district's budget and financial assistance calculations pursuant to paragraph 3 of this subsection and chapter 9 of this title, except for chapter 9, article 4 of this title. The charter of the charter school shall include a description of the methods of funding the charter school by the school district. The school district shall send a copy of the charter and application, including a description of how the school district plans to fund the school, to the state board of education before the start of the first fiscal year of operation of the charter school. The charter or application shall include an estimate of the student count for the charter school for its first fiscal year of operation. This estimate shall be computed pursuant to the requirements of paragraph 3 of this subsection.
2. A school district is not financially responsible for any charter school that is sponsored by the state board of education, the state board for charter schools, a university under the jurisdiction of the Arizona board of regents, a community college district or a group of community college districts.
3. A school district that sponsors a charter school may:
(a) Increase its student count as provided in subsection B, paragraph 2 of this section during the first year of the charter school's operation to include those charter school pupils who were not previously enrolled in the school district. A charter school sponsored by a school district governing board is eligible for the charter additional assistance prescribed in subsection B, paragraph 4 of this section. The district additional assistance allocation as provided in section 15‑961 for the school district sponsoring the charter school shall be increased by the amount of the charter additional assistance. The school district shall include the full amount of the charter additional assistance in the funding provided to the charter school.
(b) Compute separate weighted student counts pursuant to section 15‑943, paragraph 2, subdivision (a) for its noncharter school versus charter school pupils in order to maintain eligibility for small school district support level weights authorized in section 15‑943, paragraph 1 for its noncharter school pupils only. The portion of a district's student count that is attributable to charter school pupils is not eligible for small school district support level weights.
4. If a school district uses the provisions of paragraph 3 of this subsection, the school district is not eligible to include those pupils in its student count for the purposes of computing an increase in its revenue control limit and district support level as provided in section 15‑948.
5. A school district that sponsors a charter school is not eligible to include the charter school pupils in its student count for the purpose of computing an increase in its district additional assistance as provided in section 15‑961, subsection B, except that if the charter school was previously a school in the district, the district may include in its student count any charter school pupils who were enrolled in the school district in the prior year.
6. A school district that sponsors a charter school is not eligible to include the charter school pupils in its student count for the purpose of computing the revenue control limit which is used to determine the maximum budget increase as provided in chapter 4, article 4 of this title unless the charter school is located within the boundaries of the school district.
7. If a school district converts one or more of its district public schools to a charter school and receives assistance as prescribed in subsection B, paragraph 4 of this section, and subsequently converts the charter school back to a district public school, the school district shall repay the state the total charter additional assistance received for the charter school for all years that the charter school was in operation. The repayment shall be in one lump sum and shall be reduced from the school district's current year equalization assistance. The school district's general budget limit shall be reduced by the same lump sum amount in the current year.
B. Financial provisions for a charter school that is sponsored by the state board of education, the state board for charter schools, a university, a community college district or a group of community college districts are as follows:
1. The charter school shall calculate a base support level as prescribed in section 15‑943, except that section 15‑941 does not apply to these charter schools.
2. Notwithstanding paragraph 1 of this subsection, the student count shall be determined initially using an estimated student count based on actual registration of pupils before the beginning of the school year. Notwithstanding section 15‑1042, subsection F E, student level data submitted to the department may be used to determine estimated student counts. After the first forty days, one hundred days or two hundred days in session, as applicable, the charter school shall revise the student count to be equal to the actual average daily membership, as defined in section 15‑901, of the charter school. Before the fortieth day, one hundredth day or two hundredth day in session, as applicable, the state board of education, the state board for charter schools, the sponsoring university, the sponsoring community college district or the sponsoring group of community college districts may require a charter school to report periodically regarding pupil enrollment and attendance, and the department of education may revise its computation of equalization assistance based on the report. A charter school shall revise its student count, base support level and charter additional assistance before May 15. A charter school that overestimated its student count shall revise its budget before May 15. A charter school that underestimated its student count may revise its budget before May 15.
3. A charter school may utilize section 15‑855 for the purposes of this section. The charter school and the department of education shall prescribe procedures for determining average daily membership.
4. Equalization assistance for the charter school shall be determined by adding the amount of the base support level and charter additional assistance. The amount of the charter additional assistance is one thousand seven hundred seven dollars seventy‑seven cents per student count in preschool programs for children with disabilities, kindergarten programs and grades one through eight and one thousand nine hundred ninety dollars thirty‑eight cents per student count in grades nine through twelve.
5. The state board of education shall apportion state aid from the appropriations made for such purposes to the state treasurer for disbursement to the charter schools in each county in an amount as determined by this paragraph. The apportionments shall be made as prescribed in section 15‑973, subsection B.
6. The charter school shall not charge tuition for pupils who reside in this state, levy taxes or issue bonds. A charter school may admit pupils who are not residents of this state and shall charge tuition for those pupils in the same manner prescribed in section 15‑823.
7. Not later than noon on the day preceding each apportionment date established by paragraph 5 of this subsection, the superintendent of public instruction shall furnish to the state treasurer an abstract of the apportionment and shall certify the apportionment to the department of administration, which shall draw its warrant in favor of the charter schools for the amount apportioned.
C. If a pupil is enrolled in both a charter school and a public school that is not a charter school, the sum of the daily membership, which includes enrollment as prescribed in section 15‑901, subsection A, paragraph 1, subdivisions (a) and (b) and daily attendance as prescribed in section 15‑901, subsection A, paragraph 5, for that pupil in the school district and the charter school shall not exceed 1.0. If a pupil is enrolled in both a charter school and a public school that is not a charter school, the department of education shall direct the average daily membership to the school with the most recent enrollment date. On validation of actual enrollment in both a charter school and a public school that is not a charter school and if the sum of the daily membership or daily attendance for that pupil is greater than 1.0, the sum shall be reduced to 1.0 and shall be apportioned between the public school and the charter school based on the percentage of total time that the pupil is enrolled or in attendance in the public school and the charter school. The uniform system of financial records shall include guidelines for the apportionment of the pupil enrollment and attendance as provided in this section.
D. Charter schools are allowed to accept grants and gifts to supplement their state funding, but it is not the intent of the charter school law to require taxpayers to pay twice to educate the same pupils. The base support level for a charter school or for a school district sponsoring a charter school shall be reduced by an amount equal to the total amount of monies received by a charter school from a federal or state agency if the federal or state monies are intended for the basic maintenance and operations of the school. The superintendent of public instruction shall estimate the amount of the reduction for the budget year and shall revise the reduction to reflect the actual amount before May 15 of the current year. If the reduction results in a negative amount, the negative amount shall be used in computing all budget limits and equalization assistance, except that:
1. Equalization assistance shall not be less than zero.
2. For a charter school sponsored by the state board of education, the state board for charter schools, a university, a community college district or a group of community college districts, the total of the base support level and the charter additional assistance shall not be less than zero.
3. For a charter school sponsored by a school district, the base support level for the school district shall not be reduced by more than the amount that the charter school increased the district's base support level and district additional assistance allocation.
E. If a charter school was a district public school in the prior year and is now being operated for or by the same school district and sponsored by the state board of education, the state board for charter schools, a university, a community college district, a group of community college districts or a school district governing board, the reduction in subsection D of this section applies. The reduction to the base support level of the charter school or the sponsoring district of the charter school shall equal the sum of the base support level and the charter additional assistance received in the current year for those pupils who were enrolled in the traditional public school in the prior year and are now enrolled in the charter school in the current year.
F. Equalization assistance for charter schools shall be provided as a single amount based on average daily membership without categorical distinctions between maintenance and operations or capital.
G. At the request of a charter school, the county school superintendent of the county where the charter school is located may provide the same educational services to the charter school as prescribed in section 15‑308, subsection A. The county school superintendent may charge a fee to recover costs for providing educational services to charter schools.
H. If the sponsor of the charter school determines at a public meeting that the charter school is not in compliance with federal law, with the laws of this state or with its charter, the sponsor of a charter school may submit a request to the department of education to withhold up to ten per cent percent of the monthly apportionment of state aid that would otherwise be due the charter school. The department of education shall adjust the charter school's apportionment accordingly. The sponsor shall provide written notice to the charter school at least seventy‑two hours before the meeting and shall allow the charter school to respond to the allegations of noncompliance at the meeting before the sponsor makes a final determination to notify the department of education of noncompliance. The charter school shall submit a corrective action plan to the sponsor on a date specified by the sponsor at the meeting. The corrective action plan shall be designed to correct deficiencies at the charter school and to ensure that the charter school promptly returns to compliance. When the sponsor determines that the charter school is in compliance, the department of education shall restore the full amount of state aid payments to the charter school.
I. In addition to the withholding of state aid payments pursuant to subsection H of this section, the sponsor of a charter school may impose a civil penalty of one thousand dollars per occurrence if a charter school fails to comply with the fingerprinting requirements prescribed in section 15‑183, subsection C or section 15‑512. The sponsor of a charter school shall not impose a civil penalty if it is the first time that a charter school is out of compliance with the fingerprinting requirements and if the charter school provides proof within forty-eight hours of written notification that an application for the appropriate fingerprint check has been received by the department of public safety. The sponsor of the charter school shall obtain proof that the charter school has been notified, and the notification shall identify the date of the deadline and shall be signed by both parties. The sponsor of a charter school shall automatically impose a civil penalty of one thousand dollars per occurrence if the sponsor determines that the charter school subsequently violates the fingerprinting requirements. Civil penalties pursuant to this subsection shall be assessed by requesting the department of education to reduce the amount of state aid that the charter school would otherwise receive by an amount equal to the civil penalty. The amount of state aid withheld shall revert to the state general fund at the end of the fiscal year.
J. A charter school may receive and spend monies distributed by the department of education pursuant to section 42‑5029, subsection E and section 37‑521, subsection B.
K. If a school district transports or contracts to transport pupils to the Arizona state schools for the deaf and the blind during any fiscal year, the school district may transport or contract with a charter school to transport sensory impaired pupils during that same fiscal year to a charter school if requested by the parent of the pupil and if the distance from the pupil's place of actual residence within the school district to the charter school is less than the distance from the pupil's place of actual residence within the school district to the campus of the Arizona state schools for the deaf and the blind.
L. Notwithstanding any other law, a university under the jurisdiction of the Arizona board of regents, a community college district or a group of community college districts shall not include any student in the student count of the university, community college district or group of community college districts for state funding purposes if that student is enrolled in and attending a charter school sponsored by the university, community college district or group of community college districts.
M. The governing body of a charter school shall transmit a copy of its proposed budget or the summary of the proposed budget and a notice of the public hearing to the department of education for posting on the department of education's website no later than ten days before the hearing and meeting. If the charter school maintains a website, the charter school governing body shall post on its website a copy of its proposed budget or the summary of the proposed budget and a notice of the public hearing.
N. The governing body of a charter school shall collaborate with the private organization that is approved by the state board of education pursuant to section 15‑792.02 to provide approved board examination systems for the charter school.
O. If permitted by federal law, a charter school may opt out of federal grant opportunities if the charter holder or the appropriate governing body of the charter school determines that the federal requirements impose unduly burdensome reporting requirements.
P. For the purposes of this section:
1. "Monies intended for the basic maintenance and operations of the school" means monies intended to provide support for the educational program of the school, except that it does not include supplemental assistance for a specific purpose or title VIII of the elementary and secondary education act of 1965 monies. The auditor general shall determine which federal or state monies meet the definition in this paragraph.
2. "Operated for or by the same school district" means the charter school is either governed by the same district governing board or operated by the district in the same manner as other traditional schools in the district or is operated by an independent party that has a contract with the school district. The auditor general and the department of education shall determine which charter schools meet the definition in this subsection.
Sec. 2. Section 15-249.01, Arizona Revised Statutes, is amended to read:
15-249.01. Data governance commission; membership; terms; duties; commission termination; definition
A. The data governance commission is established in the department of education consisting of:
1. The chief technology managers, or the managers' designees, of each of the universities under the jurisdiction of the Arizona board of regents.
2. The chief technology manager, or the manager's designee, of a community college district located in a county with a population of eight hundred thousand persons or more who has expertise in technology and who is appointed by the governor.
3. The chief technology manager, or the manager's designee, of a community college district located in a county with a population of less than eight hundred thousand persons who has expertise in technology and who is appointed by the governor.
4. The chief executive officer of the Arizona early childhood development and health board or the chief executive officer's designee.
5. An officer or employee of a school district located in a county with a population of eight hundred thousand persons or more who has expertise in technology and who is appointed by the governor.
6. An officer or employee of a school district located in a county with a population of less than eight hundred thousand persons who has expertise in technology and who is appointed by the governor.
7. An officer or employee of a charter school located in a county with a population of eight hundred thousand persons or more who has expertise in technology and who is appointed by the president of the senate.
8. An officer or employee of a charter school located in a county with a population of less than eight hundred thousand persons who has expertise in technology and who is appointed by the speaker of the house of representatives.
9. Two representatives of the business community, one of whom is appointed by the president of the senate and one of whom is appointed by the speaker of the house of representatives.
10. The director of the department of administration or the director's designee.
11. The superintendent of public instruction or the superintendent's designee.
B. The initial appointed members shall assign themselves by lot to terms of two, three and four years in office. All subsequent appointed members of the commission shall serve four‑year terms. The chairperson shall notify the governor, the speaker of the house of representatives and the president of the senate on appointments of these terms. Members of the commission shall elect a chairperson from among the members of the commission. Members of the commission shall not receive compensation. The department of education shall provide adequate staff support for the commission.
C. The commission shall identify, examine and evaluate the needs of public institutions that provide instruction to pupils in preschool programs, kindergarten programs, grades one through twelve and postsecondary programs in Arizona and shall:
1. Establish guidelines related to the following:
(a) Managed data access.
(b) Technology.
(c) Privacy and security.
(d) Adequacy of training.
(e) Adequacy of data model implementation.
(f) Prioritization of funding opportunities.
(g) Resolution of data conflicts.
(h) The form and format of data elements that are required for state and federal reporting and interagency data sharing.
2. Provide recommendations on technology spending.
3. Provide analyses and recommendations of the following:
(a) The control of data confidentiality and data security for stored data and data in transmission.
(b) Access privileges and access management.
(c) Data audit management, including data quality metrics, sanctions and incentives for data quality improvement.
(d) Data standards for stored data and data in transmission, including rules for definition, format, source, provenance, element level and contextual integrity.
(e) Documentation standards for data elements and systems components.
(f) Data archival and retrieval management systems, including change control and change tracking.
(g) Publication of standard and ad hoc reports for state and local level use on student achievement.
(h) Publication of implementation timelines and progress.
4. Create, publish and make publicly available on the department's website a data dictionary with definitions of student data elements in the education data system, including:
(a) Student data elements required to be reported by state and federal education mandates.
(b) Any student data element that has been proposed for inclusion in the education data system with a statement regarding the purpose or reason for the proposed collection.
(c) Any student data elements the department collects or maintains with no currently identified purpose.
5. Review and approve data elements to be included in the education data system pursuant to section 15-1042. Any new student data collection shall be announced to the general public and posted for a review and comment period of at least sixty days.
4. 6. Ensure that the guidelines and recommendations adopted pursuant to this subsection reduce duplication and administrative requirements for public schools, postsecondary institutions and public agencies.
5. 7. Submit an annual report on or before December 1 regarding the commission's activities to the governor, the speaker of the house of representatives and the president of the senate. The data governance commission shall provide copies of this report to the secretary of state. The report shall include:
(a) Any new data elements proposed for inclusion in the education data system.
(b) Changes to existing data collections required for any reason, including changes to federal reporting requirements.
(c) An explanation of any exceptions granted by the department during the year regarding the release of student level data out of state pursuant to section 15-1045, subsection E.
(d) The results of any privacy or security audit conducted within the preceding year. The report may not include any information that would pose a threat to the security or the confidentiality of the education data system or to the secure transmission of data between school districts, charter schools and the department.
D. The commission established by this section ends on July 1, 2020 pursuant to section 41‑3103.
E. For the purposes of this section, "education data system" has the same meaning prescribed in section 15-1041.01.
Sec. 3. Section 15-874, Arizona Revised Statutes, is amended to read:
15-874. Records; reporting requirements
A. Each pupil's immunizations shall be recorded on the school immunization record. The school immunization record shall be a standardized form developed by the department of health services in conjunction with the department of education and provided by the department of health services and shall be a part of the mandatory permanent student record maintained according to standards set by the Arizona state library, archives and public records. The records are open to inspection by the department of health services and the local health department.
B. Each immunization record shall contain at least the following information:
1. The pupil's name and birth date.
2. The date of the pupil's admission to the school.
3. The type of immunizing agents administered to the pupil.
4. The date each dose of immunizing agent is administered to the pupil.
5. The established schedule for completion of immunizations if the pupil is admitted to or allowed to continue to attend a school pursuant to section 15‑872, subsection E.
6. Laboratory evidence of immunity if this evidence is presented as part of a pupil's documentary proof.
7. If an exemption from immunization as provided in section 15‑873 is submitted to the school administrator, the date the exemption is submitted and the reason for the exemption.
8. Additional information prescribed by the director of the department of health services by rule.
C. A school shall transfer an immunization record with the mandatory permanent student record and provide at no charge, on request, a copy of the immunization record to the parent or guardian of the pupil.
D. By November 30 of each school year, each school district and private school shall complete and file a report with the local health department and the department of health services, using forms provided by the department of health services. The report shall state the number of pupils attending who have completed required immunizations or who have submitted laboratory evidence of immunity, the number of pupils attending with uncompleted required immunizations and the number of pupils attending with an exemption from immunization pursuant to section 15‑873.
Sec. 4. Title 15, chapter 9, article 8, Arizona Revised Statutes, is amended by adding section 15-1041.01, to read:
15-1041.01. Definitions
In this article, unless the context otherwise requires:
1. "Aggregated data" means data that is collected or reported at the group, cohort, school, school district, charter school or state level.
2. "Education data system" means the student accountability information system established by section 15-1041, or its successor system, and the education learning and accountability system established pursuant to section 15-249, or its successor system, and all of those systems' respective components.
3. "Local education agency" means a school district, charter holder, or education service agency.
4. "Masked student level data" means student level data collected and unique pupil identifiers that utilizes a secondary identifier created by the department to ensure that data used for research or other purposes cannot be used to personally identify students.
5. "Personally identifiable information" means information that may be used on its own or with other information to identify an individual pupil.
6. "Pupil records" means either of the following:
(a) Any pupil-related information maintained by a local education agency.
(b) Any information acquired directly from the pupil through the use of software or applications assigned to the pupil by a local education agency or its employees.
7. "Student level data" means all data elements that are compiled and submitted for each individual student in this state and that are necessary for the completion of the statutory requirements of the department of education and the state board of education relating to the calculation of funding for public education, the determination of student academic progress as measured by student testing programs in this state, state and federal reporting requirements and other duties prescribed by law to the department of education or the state board of education. Student level data does not include data elements that are related to student behavior, discipline, criminal history, medical history, religious affiliation, personal physical descriptors or family information and that are not authorized by the parent or guardian of the pupil or not otherwise required by law.
8. "Third-party provider" means a provider of digital software and services, including cloud-based services, for instructional, diagnostic and assessment purposes and for the digital storage, management and retrieval of pupil records.
9. "Unique pupil identifier" means the method of identifying each individual student established by the department pursuant to section 15‑1045.
Sec. 5. Section 15-1042, Arizona Revised Statutes, is amended to read:
15-1042. Student level data; requirements; confidentiality
A. The department of education shall notify school districts, joint technical education districts and charter schools of electronic data submission procedures and shall distribute a list of the specific student level data elements, including the statutory or regulatory reference for each data element, that school districts, joint technical education districts and charter schools are required to submit. The department of education shall not make any changes to the student level data elements to be collected unless the student level data element has been reviewed and adopted by the data governance commission established by section 15‑249.01.
B. Each school district, joint technical education district and charter school shall submit electronic data on a school-by-school basis, including student level data, to the department of education in order for the school district, joint technical education district or charter school to receive monies for the cost of educating students pursuant to this title.
C. The department of education shall grant a school district, joint technical education district or charter school an extension to the deadline for the submission of student level data or may provide for an alternative method for the submission of student level data if the school district, joint technical education district or charter school proves that good cause exists for the extension, and the school district, joint technical education district or charter school shall continue to receive monies for the cost of educating students pursuant to this title. The request for an extension of the deadline for the submission of student level data pursuant to this subsection shall include a justification for the extension and the status of current efforts towards complying with the submission of student level data.
D. C. A pupil or the parent or guardian of a pupil shall not be required to submit data that does not relate to the provision of educational services or assistance to the pupil.
E. D. Unless otherwise prescribed, school districts, joint technical education districts and charter schools shall begin to report new data elements on July 1 of the year that follows the effective date of the law that requires the collection of the data.
F. E. Student level data items submitted to the department of education by school districts, joint technical education districts and charter schools pursuant to this section shall not be used to adjust funding levels or calculate the average daily membership for the purpose of funding school districts at any time other than the fortieth, one hundredth and two hundredth days of the school year.
G. F. A school district, joint technical education district or charter school is not required to submit student level data to the department of education more often than once every twenty school days.
H. G. Notwithstanding subsection J of this section, The student level data shall include reasons for the withdrawal if reasons are provided by the withdrawing pupil or the pupil's parent or guardian. For the purposes of this subsection, the department of education shall include in the specific student level data elements that school districts, joint technical education districts and charter schools are required to submit data relating to students who withdraw from school because the student is pregnant or because the student is the biological parent of a child.
I. H. All student level data collected pursuant to this section is confidential and is not a public record. The data collected may be used for aggregate research and reporting and for providing access of student level data to school districts, joint technical education districts, charter schools, community colleges and universities under the jurisdiction of the Arizona board of regents.
J. For the purposes of this section, "student level data" means all data elements that are compiled and submitted for each student in this state and that are necessary for the completion of the statutory requirements of the department of education and the state board of education relating to the calculation of funding for public education, the determination of student academic progress as measured by student testing programs in this state, state and federal reporting requirements and other duties prescribed to the department of education or the state board of education by law. Student level data does not include data elements related to student behavior, discipline, criminal history, medical history, religious affiliation, personal physical descriptors or family information not authorized by the parent or guardian of the pupil or otherwise required by law.
Sec. 6. Section 15-1043, Arizona Revised Statutes, is amended to read:
15-1043. Student level data; access; confidentiality
A. Any disclosure of educational records compiled by the department of education pursuant to this article shall comply with the family educational rights and privacy act of 1974 (20 United States Code section 1232g).
B. Student level data may not be updated unless the change is authorized by the school district, joint technical education district or charter school.
C. The department of education shall adopt policies and procedures to allow access of to student level data for currently enrolled students to school districts, joint technical education districts and charter schools, subject to section 15‑1045, subsection D.
D. The department shall develop criteria for the approval of data requests from state and local agencies, the legislature and researchers. If the department approves a request pursuant to this subsection, the department shall only release masked student level data unless otherwise allowed by law or if the department determines the request qualifies for an exception under the family educational rights and privacy act of 1974 (20 United States Code section 1232g).
Sec. 7. Repeal
Section 15-1044, Arizona Revised Statutes, is repealed.
Sec. 8. Section 15-1045, Arizona Revised Statutes, is amended to read:
15-1045. Education data system; pupil privacy
A. Any collection, maintenance or disclosure of pupil educational records compiled by the department of education in an education database of pupil records data system shall comply with the family educational rights and privacy act of 1974 (20 United States Code section 1232g).
B. The department of education shall maintain the database in the following manner:
1. The use of the information is limited to comply with statutory obligations.
2. Personally identifiable information is confidential and is not public record.
3. Proper security measures are employed to ensure the confidentiality and integrity of the education database.
4. Data is secured from breaches and identity theft through implementation of protections and standards.
B. Personally identifiable information and student level data contained in the education data system are confidential and are not a public record.
C. The department shall create a unique pupil identifier for each pupil in the education data system. The pupil identifier in the education database is unique, may not be identifiable by anyone other than officials maintaining the education database data system and shall may not be the pupil's social security number or any variation of the pupil's social security number.
D. The department shall develop, publish and make publicly available policies and procedures to comply with all relevant state and federal privacy laws, including the family educational rights and privacy act of 1974 (20 United States Code section 1232g). The policies shall require that:
1. Access to student level data in the education data system be restricted to:
(a) The authorized staff of the department who require access to perform their assigned duties as required by law, by interagency data sharing agreements or other legal obligations.
(b) School district and charter school administrators, teachers and school personnel who require access to perform their assigned duties.
(c) A student and the student's parents, except that the student and parents may have access to data about only that particular student.
(d) The authorized staff of other state agencies in this state or political subdivisions of this state as required by law or as defined by interagency data sharing agreements pursuant to this section.
(e) Researchers conducting studies that have been approved pursuant to section 15-1043, subsection d.
2. The department use only aggregated data that does not contain personally identifiable information in public reports and in response to public records requests, except as provided in subsection E of this section.
3. Students and parents be notified of their rights to privacy of educational records under federal and state law.
E. Unless otherwise allowed by law, subject to section 15-1043, the department may not transfer student level data deemed confidential under this article to any federal agency or any state or local agency.
F. The department shall develop and implement a detailed security plan that includes:
1. Procedures for authorizing access to the education data system and to student level data.
2. Standards for compliance with federal and state privacy laws and regulations.
3. Privacy and security audits.
4. Planning for a possible breach of data security, including notification procedures to entities that own data that may be affected.
5. Data retention and destruction policies, consistent with guidelines adopted by the Arizona state library, archives and public records.
6. At a minimum, compliance with statewide technology security standards adopted by the department of administration.
G. The department shall ensure that any contracts with private vendors governing databases, assessments or instructional supports that include student level data include express provisions that safeguard privacy and security and include civil penalties for noncompliance.
H. School districts and charter schools may not report the following student level data to the department:
1. Juvenile delinquency records.
2. Criminal records, except for incident data required to be reported for school safety purposes.
3. Medical and health records.
I. School districts and charter schools may not collect the following data about any student:
1. Political affiliation.
2. Religious affiliation.
3. Biometric information, except as provided in section 15-109.
4. Firearms ownership.
J. The superintendent shall appoint a chief privacy officer, who shall assume primary responsibility for the agency privacy policy. The chief privacy officer shall:
1. Ensure that the use of technologies sustain, and do not erode, privacy protections.
2. Ensure that student level data contained in the education data system is handled in full compliance with this section and other applicable state and federal laws.
3. In conjunction with the chief data officer, evaluate legislative and regulatory proposals involving the collection, use and disclosure of student data by the department.
4. In conjunction with the chief data officer, conduct a privacy impact assessment on proposed rules of the department in general, and the proposed rules of the department on the privacy of student data, including the type of personal information collected and the number of students affected.
5. Coordinate with the attorney general and chief data officer to ensure that programs, policies and procedures affecting civil rights, civil liberties and privacy considerations are addressed in an integrated and comprehensive manner.
6. Establish and operate a process for parents to file complaints of possible privacy violations, including complaints made pursuant to section 15-142, subsection C, and to provide redress.
7. Ensure that all privacy-related incidents are properly reported, investigated and mitigated, as appropriate.
8. Work with the chief data officer to provide training, education and outreach to build a culture of privacy throughout the department.
9. Make investigations and reports regarding the administration of programs and operations of the department regarding privacy matters and shall have access to all records, reports, audits, reviews, documents, papers, recommendations and other materials available to the department that are necessary to complete the chief privacy officer's responsibilities.
K. The chief information officer of the department shall appoint a chief data officer. The chief data officer shall:
1. Coordinate with the chief privacy officer to fulfill the requirements of this section.
2. Establish policies and procedures to ensure the efficient and secure collection, storage, maintenance and disposition of all data collected in the education data system according to applicable laws.
3. Establish department policies necessary for implementing fair information practice principles to enhance privacy protections.
4. Work with the chief privacy officer and other officials in engaging stakeholders about the quality, usefulness, openness and privacy of data.
5. Establish and operate a department privacy incident response process in coordination with the chief information officer.
L. The department may assess fees for the production of requests for data pursuant to section 15-1043 or for the assembly of data that is otherwise confidential and not a public record, into aggregated reports that are not already available from the department.
M. The parent or guardian of a student may request to review a copy of the student's educational record, including data submitted to the education data system, using the process prescribed in section 15-102.
Sec. 9. Title 15, chapter 9, article 8, Arizona Revised Statutes, is amended by adding section 15-1046, to read:
15-1046. School service providers; privacy information; definitions
A. A school service provider shall do all of the following:
1. Provide clear and easy to understand information about the types of student personal information that the school service provider collects and about how the school service provider uses and shares this student personal information.
2. Provide prominent notice before making material changes to its privacy policies for school services.
3. Facilitate access to and correction of student personal information by students and parents or guardians either directly or through the relevant school district, charter school or teacher.
4. Obtain consent before using student personal information in a manner that is inconsistent with the provider's privacy policy for the applicable school service in effect at the time of collection. If the student personal information was collected directly from students, the school service provider shall obtain consent from the student's parent or guardian or the student. In all other cases, consent may be obtained from the school district, charter school or teacher.
5. Maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality and integrity of student personal information and that uses appropriate administrative, technological and physical safeguards.
6. School service providers must obligate any third parties involved on the providers' behalf in the supply of school services involving student personal information to adhere to the requirements of this section regarding such information.
7. Delete a student's personal information within a reasonable period of time if the relevant school district, charter school or teacher requests the deletion of the data under the control of the school district, charter school or teacher unless the school service provider has obtained consent from the student's parent or guardian or the student to retain information related to that student or the student has transferred to another school district, charter school or teacher and that school district, charter school or teacher has requested that the service provider retain information related to that student.
B. If the school service is offered to a school district or charter school or a teacher in a school district or charter school, the information prescribed in subsection A, paragraphs 1 and 2 of this section may be provided to the school district, charter school or teacher.
C. A school service provider may collect, use and share student personal information only for the purposes authorized by the school district, charter school or teacher, or with the consent of the student's parent or guardian or the student.
D. A school service provider may not do any of the following:
1. Sell student personal information. This prohibition does not apply to the purchase, merger or other type of acquisition of a service provider or any assets of a service provider by another entity provided the successor entity continues to be subject to the provisions of this section with respect to previously acquired student personal information to the extent that the service provider was regulated by this section.
2. Use or share any student personal information for the purpose of targeting advertisements to students.
3. Use student personal information to create a personal profile of a student other than for supporting purposes authorized by the school district, charter school or teacher, or with the consent of the student's parent or guardian or the student. For the purposes of this section "create a personal profile" does not include the collection and retention of account records or information that remains under the control of the student, parent, school or school district.
E. If a school service provider entered into a signed, written contract with a school district, charter school or teacher before the effective date of this section, the school service provider is not required to comply with this section with respect to that contract until the next renewal date of the contract.
F. This section does not prohibit:
1. Using student personal information for the purposes of adaptive learning, personalized learning or customized education.
2. Using student personal information for maintaining, developing, supporting, improving or diagnosing the school service's site, service or application.
3. Providing recommendations for school, educational, other learning or employment purposes within a school service's site, service or application without the response being determined in whole or in part by payment or other consideration from a third party.
4. Responding to a student's request for information or for feedback without the information or response being determined in whole or in part by payment or other consideration from a third party.
5. Disclosing student personal information:
(a) To ensure legal or regulatory compliance or protect against liability.
(b) To protect the security or integrity of its site, service or application.
(c) To respond to or participate in judicial process.
(d) To protect the safety of users or others or security of the school service's site, service or application.
(e) To a service provider provided the school district:
(i) Contractually prohibits the service provider from using any student personal information for any purpose other than providing the contracted service to, or on behalf of, the school service provider.
(ii) Prohibits the service provider from disclosing any student personal information provided by the school service to subsequent third parties unless the disclosure is expressly permitted by subsection F, paragraphs 1, 2, 3, 4 and 5.
(iii) Requires the service provider to comply with the requirements of this act.
G. This section shall not be construed to impede the ability of students to download, export or otherwise save or maintain their own student data or documents.
H. For the purposes of this section:
1. "School service" means a website, mobile application or online service that is designed and marketed for use in elementary or secondary schools, that is used at the direction of teachers or other school employees and that collects, maintains or uses student personal information. school service does not include a website, mobile application or online service that is designed and marketed for use by individuals or entities generally, even if the website, mobile application or online service is also marketed to elementary or secondary schools.
2. "School service provider" means an entity that operates a school service to the extent it is operating in that capacity.
3. "Student" means a student who is enrolled in a school district or charter school in this state.
4. "Student personal information" means information collected through a school service that personally identifies an individual student or information collected and maintained about an individual student and that is linked to personally identifiable information.
5. "Targeted advertising" means sending advertisements to a student where the advertisement is selected based on information obtained or inferred from that student's online behavior, usage of applications or student personal information. Targeted advertising does not include:
(a) Advertising to a student at an online location based upon that student's current visit to that location without the collection and retention of a student's online activities over time.
(b) Adaptive learning, personalized learning or customized education.
Sec. 10. Repeal
Section 41-3016.23, Arizona Revised Statutes, is repealed.
Sec. 11. Short title
Section 9, as added by this act, may be cited as the "Student User Privacy in Education Rights Act" or "S.U.P.E.R. Act".
