Bill Text: AZ SB1374 | 2017 | Fifty-third Legislature 1st Regular | Introduced
Bill Title: Schools; data privacy
Spectrum: Partisan Bill (Republican 1-0)
Status: (Introduced - Dead) 2017-02-01 - Senate read second time [SB1374 Detail]
Download: Arizona-2017-SB1374-Introduced.html
|
REFERENCE TITLE: schools; data privacy |
|
State of Arizona Senate Fifty-third Legislature First Regular Session 2017
|
|
SB 1374 |
|
|
|
Introduced by Senator Montenegro
|
AN ACT
amending Title 15, chapter 9, article 8, Arizona Revised Statutes, by adding section 15-1044; relating to the student accountability information system.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it enacted by the Legislature of the State of Arizona:
Section 1. Title 15, chapter 9, article 8, Arizona Revised Statutes, is amended by adding section 15-1044, to read:
15-1044. School service providers; privacy information; definitions
A. A SCHOOL SERVICE PROVIDER SHALL DO ALL OF THE FOLLOWING:
1. PROVIDE CLEAR AND EASY‑TO‑UNDERSTAND INFORMATION ABOUT THE TYPES OF STUDENT PERSONAL INFORMATION THAT THE SCHOOL SERVICE PROVIDER COLLECTS AND HOW THE SCHOOL SERVICE PROVIDER USES AND SHARES THIS STUDENT PERSONAL INFORMATION.
2. PROVIDE PROMINENT NOTICE BEFORE MAKING MATERIAL CHANGES TO ITS PRIVACY POLICIES FOR SCHOOL SERVICES.
3. FACILITATE ACCESS TO AND CORRECTION OF STUDENT PERSONAL INFORMATION BY STUDENTS AND PARENTS OR GUARDIANS EITHER DIRECTLY OR THROUGH THE RELEVANT SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER.
4. OBTAIN CONSENT BEFORE USING STUDENT PERSONAL INFORMATION IN A MANNER THAT IS INCONSISTENT WITH THE school service PROVIDER'S PRIVACY POLICY FOR THE APPLICABLE SCHOOL SERVICE IN EFFECT AT THE TIME OF COLLECTION. IF THE STUDENT PERSONAL INFORMATION WAS COLLECTED DIRECTLY FROM a STUDENT, THE SCHOOL SERVICE PROVIDER SHALL OBTAIN CONSENT FROM THE STUDENT'S PARENT OR GUARDIAN OR THE STUDENT. IN ALL OTHER CASES, CONSENT MAY BE OBTAINED FROM THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER.
5. MAINTAIN A COMPREHENSIVE INFORMATION SECURITY PROGRAM THAT IS DESIGNED TO reasonably PROTECT THE SECURITY, PRIVACY, CONFIDENTIALITY AND INTEGRITY OF STUDENT PERSONAL INFORMATION AND THAT USES APPROPRIATE ADMINISTRATIVE, TECHNOLOGICAL AND PHYSICAL SAFEGUARDS.
6. OBLIGATE ANY THIRD PARTIES INVOLVED ON behalf of THE school service PROVIDER IN SUPPLYing SCHOOL SERVICES INVOLVING STUDENT PERSONAL INFORMATION TO ADHERE TO THE REQUIREMENTS OF THIS SECTION REGARDING that INFORMATION.
7. DELETE STUDENT PERSONAL INFORMATION WITHIN A REASONABLE PERIOD OF TIME IF THE RELEVANT SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER REQUESTS THE DELETION OF THE DATA that is UNDER THE CONTROL OF THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER UNLESS THE SCHOOL SERVICE PROVIDER HAS OBTAINED CONSENT FROM THE STUDENT'S PARENT OR GUARDIAN OR THE STUDENT TO RETAIN INFORMATION RELATED TO THAT STUDENT OR unless THE STUDENT HAS TRANSFERRED TO ANOTHER SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER AND THAT SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER HAS REQUESTED THAT THE school SERVICE PROVIDER RETAIN INFORMATION RELATED TO THAT STUDENT. A SCHOOL SERVICE PROVIDER may NOT KNOWINGLY RETAIN STUDENT PERSONAL INFORMATION BEYOND THE TIME PERIOD REQUIRED TO SUPPORT THE AUTHORIZED SCHOOL SERVICE UNLESS the retention is AUTHORIZED BY THE student's PARENT or guardian OR the STUDENT.
B. IF THE SCHOOL SERVICE IS OFFERED TO A SCHOOL DISTRICT OR CHARTER SCHOOL OR A TEACHER IN A SCHOOL DISTRICT OR CHARTER SCHOOL, THE INFORMATION PRESCRIBED IN SUBSECTION A, PARAGRAPHS 1 AND 2 OF THIS SECTION MAY BE PROVIDED TO THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER.
C. A SCHOOL SERVICE PROVIDER MAY COLLECT, USE AND SHARE STUDENT PERSONAL INFORMATION ONLY FOR THE PURPOSES AUTHORIZED BY THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER, OR WITH THE CONSENT OF THE STUDENT'S PARENT OR GUARDIAN OR THE STUDENT.
D. A SCHOOL SERVICE PROVIDER MAY NOT DO ANY OF THE FOLLOWING:
1. SELL STUDENT PERSONAL INFORMATION. THIS PROHIBITION DOES NOT APPLY TO THE PURCHASE, MERGER OR OTHER TYPE OF ACQUISITION OF A SERVICE PROVIDER OR ANY ASSETS OF A SERVICE PROVIDER BY ANOTHER ENTITY if THE SUCCESSOR ENTITY CONTINUES TO BE SUBJECT TO THIS SECTION WITH RESPECT TO PREVIOUSLY ACQUIRED STUDENT PERSONAL INFORMATION TO THE EXTENT THAT THE original SERVICE PROVIDER WAS subject to THIS SECTION.
2. USE OR SHARE ANY STUDENT PERSONAL INFORMATION FOR THE PURPOSE OF TARGETING ADVERTISEMENTS TO STUDENTS.
3. USE STUDENT PERSONAL INFORMATION TO CREATE A PERSONAL PROFILE OF A STUDENT OTHER THAN FOR SUPPORTING PURPOSES AUTHORIZED BY THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER, OR WITH THE CONSENT OF THE STUDENT'S PARENT OR GUARDIAN OR THE STUDENT. FOR THE PURPOSES OF THIS paragraph, CREATE A PERSONAL PROFILE DOES NOT INCLUDE THE COLLECTION AND RETENTION OF ACCOUNT INFORMATION THAT REMAINS UNDER THE CONTROL OF THE STUDENT, PARENT or guardian, SCHOOL OR SCHOOL DISTRICT.
E. IF A SCHOOL SERVICE PROVIDER ENTERED INTO A SIGNED, WRITTEN CONTRACT WITH A SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER BEFORE THE EFFECTIVE DATE OF THIS SECTION, THE SCHOOL SERVICE PROVIDER IS NOT REQUIRED TO COMPLY WITH THIS SECTION WITH RESPECT TO THAT CONTRACT UNTIL THE NEXT RENEWAL DATE OF THE CONTRACT.
F. THIS SECTION DOES NOT PROHIBIT a school service provider from doing any of the following:
1. USING STUDENT PERSONAL INFORMATION FOR THE PURPOSES OF ADAPTIVE LEARNING, PERSONALIZED LEARNING OR CUSTOMIZED EDUCATION.
2. USING STUDENT PERSONAL INFORMATION FOR MAINTAINING, DEVELOPING, SUPPORTING, IMPROVING OR DIAGNOSING THE SCHOOL SERVICE'S SITE, SERVICE OR APPLICATION.
3. PROVIDING RECOMMENDATIONS FOR SCHOOL, EDUCATIONAL, OTHER LEARNING OR EMPLOYMENT PURPOSES WITHIN AN ONLINE SITE, SERVICE OR APPLICATION WITHOUT THE RESPONSE BEING DETERMINED IN WHOLE OR IN PART BY PAYMENT OR OTHER CONSIDERATION FROM A THIRD PARTY.
4. RESPONDING TO A STUDENT'S REQUEST FOR INFORMATION OR FEEDBACK WITHOUT THE INFORMATION OR RESPONSE BEING DETERMINED IN WHOLE OR IN PART BY PAYMENT OR OTHER CONSIDERATION FROM A THIRD PARTY.
5. DISCLOSING STUDENT PERSONAL INFORMATION:
(a) TO ENSURE LEGAL OR REGULATORY COMPLIANCE OR to PROTECT AGAINST LIABILITY.
(b) TO PROTECT THE SECURITY OR INTEGRITY OF the service provider's webSITE, SERVICE OR APPLICATION.
(c) TO RESPOND TO OR PARTICIPATE IN JUDICIAL PROCESS.
(d) TO PROTECT THE SAFETY OF USERS OR OTHERS OR the SECURITY OF THE SCHOOL SERVICE'S SITE, SERVICE OR APPLICATION.
(e) TO A SERVICE PROVIDER if THE SCHOOL DISTRICT:
(i) CONTRACTUALLY PROHIBITS THE SERVICE PROVIDER FROM USING ANY STUDENT PERSONAL INFORMATION FOR ANY PURPOSE OTHER THAN PROVIDING THE CONTRACTED SERVICE TO, OR ON BEHALF OF, THE SCHOOL SERVICE PROVIDER.
(ii) PROHIBITS THE SERVICE PROVIDER FROM DISCLOSING ANY STUDENT PERSONAL INFORMATION PROVIDED BY THE SCHOOL SERVICE TO SUBSEQUENT THIRD PARTIES UNLESS THE DISCLOSURE IS EXPRESSLY PERMITTED BY this subsection.
(iii) REQUIRES THE SERVICE PROVIDER TO COMPLY WITH THE REQUIREMENTS OF THIS section.
G. THIS SECTION does NOT IMPEDE THE ABILITY OF a STUDENT TO DOWNLOAD, EXPORT, TRANSFER OR OTHERWISE SAVE OR MAINTAIN THE student's OWN STUDENT DATA OR DOCUMENTS.
H. IN ADDITION TO ANY ENFORCEMENT OR REGULATORY ACTIONS AUTHORIZED BY STATE OR FEDERAL LAW, A VIOLATION OF SUBSECTION C OR D of this section CONSTITUTEs an UNLAWFUL PRACTICE UNDER SECTION 44-1522, and THE ATTORNEY GENERAL MAY INVESTIGATE AND TAKE APPROPRIATE ACTION UNDER Title 44, chapter 10, article 7.
I. This section does not prohibit a local education agency from enacting policies and procedures regarding the collection and protection of student personal information.
J. FOR THE PURPOSES OF THIS SECTION:
1. "SCHOOL SERVICE" MEANS A WEBSITE, MOBILE APPLICATION OR ONLINE SERVICE THAT IS DESIGNED AND MARKETED FOR USE IN ELEMENTARY OR SECONDARY SCHOOLS, THAT IS USED AT THE DIRECTION OF TEACHERS OR OTHER SCHOOL EMPLOYEES AND THAT COLLECTS, MAINTAINS OR USES STUDENT PERSONAL INFORMATION. SCHOOL SERVICE DOES NOT INCLUDE A WEBSITE, MOBILE APPLICATION OR ONLINE SERVICE THAT IS DESIGNED AND MARKETED FOR USE BY INDIVIDUALS OR ENTITIES GENERALLY, EVEN IF THE WEBSITE, MOBILE APPLICATION OR ONLINE SERVICE IS ALSO MARKETED TO ELEMENTARY OR SECONDARY SCHOOLS.
2. "SCHOOL SERVICE PROVIDER" MEANS AN ENTITY THAT OPERATES A SCHOOL SERVICE TO THE EXTENT that the entity IS OPERATING IN THAT CAPACITY.
3. "STUDENT" MEANS A STUDENT WHO IS ENROLLED IN A SCHOOL DISTRICT OR CHARTER SCHOOL IN THIS STATE.
4. "STUDENT PERSONAL INFORMATION" MEANS INFORMATION that is COLLECTED THROUGH A SCHOOL SERVICE and THAT PERSONALLY IDENTIFIES AN INDIVIDUAL STUDENT OR INFORMATION that is COLLECTED AND MAINTAINED ABOUT AN INDIVIDUAL STUDENT AND THAT IS LINKED TO PERSONALLY IDENTIFIABLE INFORMATION. STUDENT PERSONAL INFORMATION DOES NOT INCLUDE INFORMATION THAT IS PUBLICLY AVAILABLE.
5. "TARGETing ADVERTISements" MEANS PRESENTING ADVERTISEMENTS TO A STUDENT if THE ADVERTISEMENT IS SELECTED BASED ON INFORMATION OBTAINED OR INFERRED OVER TIME FROM THAT STUDENT'S ONLINE BEHAVIOR, USAGE OF APPLICATIONS OR STUDENT PERSONAL INFORMATION. Targeting advertisements DOES NOT INCLUDE ADVERTISING TO A STUDENT AT AN ONLINE LOCATION BASED ON THAT STUDENT'S CURRENT VISIT TO THAT LOCATION OR IN RESPONSE TO THAT STUDENT'S REQUEST FOR INFORMATION OR FEEDBACK, WITHOUT THE RETENTION OF THAT STUDENT'S ONLINE ACTIVITIES OR REQUESTS OVER TIME FOR THE PURPOSE OF TARGETING SUBSEQUENT ADvertisements.
