```

[Congressional Bills 114th Congress]
[From the U.S. Government Publishing Office]
[S. 1341 Introduced in Senate (IS)]

114th CONGRESS
  1st Session
                                S. 1341

 To amend section 444 of the General Education Provisions Act in order 
  to improve the privacy protections available to students and their 
                    parents, and for other purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                              May 14, 2015

  Mr. Vitter introduced the following bill; which was read twice and 
  referred to the Committee on Health, Education, Labor, and Pensions

_______________________________________________________________________

                                 A BILL

 
 To amend section 444 of the General Education Provisions Act in order 
  to improve the privacy protections available to students and their 
                    parents, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Student Privacy Protection Act''.

SEC. 2. DEFINING STUDENT DATA.

    (a) Definition.--Section 444(a) of the General Education Provisions 
Act (commonly referred to as the ``Family Educational Rights and 
Privacy Act'') (20 U.S.C. 1232g) is amended--
            (1) by striking paragraph (4) and inserting the following:
            ``(4)(A) For the purposes of this section, the term 
        `student data' means information about a student collected and 
        maintained by an educational agency or institution, by a person 
        or third party collecting or maintaining such information 
        through the active intervention, facilitation, or authorization 
        of such agency or institution, or by a person or third party 
        acting for such agency or institution.
    ``(B) The term `student data' does not include--
            ``(i) records of instructional, supervisory, and 
        administrative personnel and educational personnel ancillary 
        thereto which are in the sole possession of the maker thereof 
        and which are not accessible or revealed to any other person 
        except a substitute;
            ``(ii) records maintained by a law enforcement unit of the 
        educational agency or institution that were created by that law 
        enforcement unit for the purpose of law enforcement;
            ``(iii) in the case of persons who are employed by an 
        educational agency or institution but who are not in attendance 
        at such agency or institution, records made and maintained in 
        the normal course of business which relate exclusively to such 
        person in that person's capacity as an employee and are not 
        available for use for any other purpose; or
            ``(iv) records on a student who is eighteen years of age or 
        older, or is attending an institution of postsecondary 
        education, which are made or maintained by a physician, 
        psychiatrist, psychologist, or other recognized professional or 
        paraprofessional acting in his professional or paraprofessional 
        capacity, or assisting in that capacity, and which are made, 
        maintained, or used only in connection with the provision of 
        treatment to the student, and are not available to anyone other 
        than persons providing such treatment, except that such records 
        can be personally reviewed by a physician or other appropriate 
        professional of the student's choice.''; and
            (2) in paragraph (5)(A), by striking ``includes the 
        following'' and inserting ``consists of only the following''.
    (b) Conforming Amendments.--Section 444 of such Act (20 U.S.C. 
1232g), as amended by subsection (a), is further amended--
            (1) in subsection (a)--
                    (A) in paragraph (1)--
                            (i) in subparagraph (A), by striking 
                        ``educational records'' and inserting ``student 
                        data''; and
                            (ii) in subparagraph (C)(ii), by striking 
                        ``placed in the education records'' and 
                        inserting ``obtained''; and
                    (B) in paragraph (2)--
                            (i) by striking ``the records'' each place 
                        the term appears and inserting ``the data''; 
                        and
                            (ii) by striking ``such records'' each 
                        place the term appears and inserting ``such 
                        data'';
            (2) in subsection (b)--
                    (A) in paragraph (1)--
                            (i) in subparagraph (B), by striking ``the 
                        record'' each place the term appears and 
                        inserting ``the data'';
                            (ii) in subparagraph (E), by striking 
                        ``whose records'' each place the term appears 
                        and inserting ``whose student data''; and
                            (iii) in subparagraph (L), by striking 
                        ``such records'' and inserting ``such data'';
                    (B) in paragraph (2)(A), by striking ``records'' 
                each place the term appears and inserting ``student 
                data''; and
                    (C) in paragraph (4)(A), by striking ``such 
                records'' and inserting ``such data'';
            (3) in subsection (j)(1)(B), by striking ``such records'' 
        and inserting ``such student data'';
            (4) by striking ``education records'' each place the term 
        appears and inserting ``student data''; and
            (5) by striking ``education record'' each place the term 
        appears and inserting ``student data''.

SEC. 3. RELEASE OF PERSONALLY IDENTIFIABLE INFORMATION.

    Section 444 of the General Education Provisions Act (commonly 
referred to as the ``Family Educational Rights and Privacy Act'') (20 
U.S.C. 1232g), as amended by section 2, is further amended--
            (1) in subsection (b)--
                    (A) in paragraph (1)--
                            (i) in subparagraph (A), by striking 
                        ``other school officials, including teachers'' 
                        and inserting ``employees and other school 
                        officials, including teachers, under the direct 
                        control of'';
                            (ii) in subparagraph (C), by striking 
                        ``authorized representatives of'' each place 
                        the term appears and inserting ``authorized 
                        representatives under the direct control of'';
                            (iii) by striking subparagraph (F); and
                            (iv) by redesignating subparagraphs (G) 
                        through (K) as subparagraphs (F) through (J), 
                        respectively;
                    (B) in paragraph (2)--
                            (i) in the matter preceding subparagraph 
                        (A), by striking ``any personally identifiable 
                        information'' through ``directory 
                        information,'' and inserting ``any student 
                        data, including personally identifiable 
                        information (other than directory information) 
                        that is not first aggregated, anonymized, and 
                        de-identified'';
                            (ii) by striking subparagraph (A) and 
                        inserting the following:
                    ``(A) the educational agency or institution meets 
                the requirements of paragraph (8) with respect to the 
                student data, including providing notice and obtaining 
                parental consent; or''; and
                            (iii) in subparagraph (B), by striking 
                        ``(1)(J)'' and inserting ``(1)(I)'';
                    (C) in paragraph (3)--
                            (i) by striking ``authorized 
                        representatives of'' and inserting ``authorized 
                        representatives under the direct control of'';
                            (ii) by inserting ``administered by State 
                        or local public educational agencies or 
                        institutions'' after ``Federally-supported 
                        education programs''; and
                            (iii) by inserting before the period at the 
                        end the following: ``: Provided further, That 
                        notice is provided, and consent is obtained, 
                        from the parents consistent with paragraph 
                        (8)'';
                    (D) in paragraph (4)(B)--
                            (i) by inserting ``and consistent with the 
                        requirements of paragraph (8)'' after 
                        ``student'';
                            (ii) by inserting ``or paragraph (8)'' 
                        after ``paragraph (2)(A)''; and
                            (iii) by inserting ``(as in effect on the 
                        day before the date of enactment of the Student 
                        Privacy Protection Act)'' after ``paragraph 
                        (1)(F)'';
                    (E) in paragraph (5)--
                            (i) by inserting ``administered by a State 
                        or local public educational agency or 
                        institution'' after ``supported education 
                        program''; and
                            (ii) by striking ``the proviso'' and 
                        inserting ``both provisos''; and
                    (F) by adding at the end the following:
            ``(7) No appending data.--
                    ``(A) In general.--No funds provided to the 
                Department or under any applicable program may be 
                provided to any educational agency or institution that 
                appends any student data with personally identifiable 
                information obtained from Federal or State agencies 
                through data matches.
                    ``(B) Federal prohibition.--Notwithstanding any 
                other provision of law, the Secretary shall not append 
                any student data of a student with personally 
                identifiable information obtained from Federal or State 
                agencies through data matches.
            ``(8) Limitations on third party use.--Notwithstanding 
        paragraph (1) or any other provision of this section (not 
        including paragraph (6)), no funds provided to the Department 
        or under any applicable program may be provided to an 
        educational agency (including a State educational agency) or 
        institution that allows any third party (including any 
        contractor or other person acting under direct control of the 
        agency or institution) to access student data of students, 
        including personally identifiable information and directory 
        information, unless--
                    ``(A) the agency or institution receives consent 
                from the parents of the student for the student data to 
                be made available to the third party;
                    ``(B) prior to receiving the consent described in 
                subparagraph (A), the agency or institution provides 
                the parents with notice, not less than 30 days before 
                the records would be provided to such outside party if 
                consent is obtained, that informs the parent--
                            ``(i) of the student data that would be 
                        accessed;
                            ``(ii) that the student data will only be 
                        made available if the parent consents;
                            ``(iii) that the parent have the ability, 
                        under subsection (a), to access the student 
                        data of their students held by the agency or 
                        institution or outside party, and a description 
                        of the process to make corrections for 
                        inaccurate data; and
                            ``(iv) that the agency or institution and 
                        the outside party are liable for any violation 
                        of this section and that the remedies described 
                        in subsection (k) are available;
                    ``(C) the agency or institution, and the third 
                party, have in place methods sufficient to ensure that 
                a reasonable person could not use any of the data 
                provided to determine the identity of the student, by 
                itself or when combined with other publicly available 
                information;
                    ``(D) the agency or institution requires that all 
                student data remain the property of the agency or 
                institution and that any student data, including data 
                made available through the Internet or data hosted by a 
                third party service provider, is destroyed when the 
                individual is no longer a student served by the agency 
                or institution; and
                    ``(E) the third party agrees, as a condition of 
                receiving such access, to be liable for any violation 
                of this section, including civil liability under 
                subsection (k).
            ``(9) No tracking of students.--
                    ``(A) In general.--No funds provided to the 
                Department or to an applicable program may be used to 
                track children or for career tracking.
                    ``(B) Only aggregate data in longitudinal data 
                systems.--Student data shall not be used for or from 
                State longitudinal data programs, including 
                prekindergarten through grade 20 (`P-20') workforce 
                programs, unless the student data is first aggregated, 
                anonymized, and de-identified.
                    ``(C) Definitions.--In this paragraph:
                            ``(i) Track.--The term `track' shall mean 
                        to collect and maintain records of a student's 
                        activities through the student's educational 
                        career, beginning in preschool and including 
                        postsecondary education, and the student's 
                        entrance into, and progression through, the 
                        workforce or the military.
                            ``(ii) Career tracking.--The term `career 
                        tracking' shall mean any effort to obligate an 
                        elementary school or secondary school student 
                        to involuntarily select a career, career 
                        interest, employment goals, or related job 
                        training via any curriculum, instruction, 
                        employment-related activity, survey, test, 
                        assessment, or data collection.
            ``(10) Rules of construction.--
                    ``(A) Applicability to federal government.--Nothing 
                in this section shall be construed to allow the 
                Secretary, the Attorney General, or the head of any 
                other Federal agency to provide any outside party 
                access to student data, or personally identifiable 
                information in student data, that has not first been 
                aggregated, anonymized, and de-identified.
                    ``(B) No data collection.--Nothing in this section 
                shall be construed to authorize the collection, 
                storage, sharing, or use, in any manner, of student 
                data, including personally identifiable information of 
                students, for the development or improvement of 
                products or services, unless the student data has first 
                been aggregated, anonymized, and de-identified.
                    ``(C) No national database.--Nothing in this 
                section shall be construed to authorize the collection, 
                storage, sharing, or use, in any manner, of student 
                data, including personally identifiable information, to 
                support or inform a national or interstate database of 
                student data or the linking of State longitudinal 
                databases, unless the student data has been aggregated, 
                anonymized, and de-identified.''.

SEC. 4. REQUIRING PARENTAL CONSENT TO RELEASE RECORDS OF OTHER 
              STUDENTS.

    Section 444(a) of the General Education Provisions Act (20 U.S.C. 
1232g(a)), as amended by section 2, is further amended--
            (1) in paragraph (1)--
                    (A) in subparagraph (A), by striking ``students who 
                are or have been in attendance at a school of such 
                agency or at such institution, as the case may be,'' 
                and inserting ``students for whom the agency or 
                institution maintains student data''; and
                    (B) in subparagraph (B), by inserting ``, or for 
                whom the agency or institution maintains student data'' 
                before ``that is subject'';
            (2) in paragraph (2), by striking ``who are or have been in 
        attendance at a school of such agency or at such institution'' 
        and inserting ``for whom the agency or institution maintains 
        student data'';
            (3) in paragraph (5)(B), by striking ``attending the 
        institution or agency'' and inserting ``for whom the agency or 
        institution maintains student data''; and
            (4) in paragraph (6), by striking ``, but does not include 
        a person who has not been in attendance at such agency or 
        institution''.

SEC. 5. REMEDIES.

    Section 444 of the General Education Provisions Act (20 U.S.C. 
1232g), as amended by sections 2, 3, and 4, is further amended by 
adding at the end the following:
    ``(k) Civil Liability.--
            ``(1) In general.--
                    ``(A) Agencies, institutions, and contractors.--As 
                a condition of receiving any funds provided to the 
                Department or under any applicable program, an 
                educational agency or institution, and any third party 
                that collects, maintains, or otherwise obtains access 
                to student data through such agency or institution, 
                that fails to comply with any requirement imposed under 
                this section with respect to any individual shall be 
                liable to that person in the amount determined under 
                paragraph (2).
                    ``(B) Federal government liability.--Any Federal 
                agency that fails to comply with any requirement 
                imposed under this section with respect to any 
                individual shall be liable to that person in the amount 
                determined under paragraph (2).
            ``(2) Amount of award.--
                    ``(A) Individual action.--In an individual action, 
                the sum awarded for liability under paragraph (1) is 
                equal to--
                            ``(i) in the case of a first violation, an 
                        amount of not less than $1,000;
                            ``(ii) in the case of a second violation by 
                        the same person involving the student data and 
                        privacy of the same student, an amount of not 
                        less than than $5,000; and
                            ``(iii) in the case of a third or any 
                        subsequent violation by the same person 
                        involving the student data and privacy of the 
                        same student, an amount of not less than 
                        $10,000.
                    ``(B) Individual violation.--For purposes of this 
                subsection, each violation of this section that 
                involves different student data of an individual, or a 
                different student, shall be considered a separate 
                violation.
            ``(3) Costs and attorney fees.--In the case of any 
        successful action to enforce liability under paragraph (1), the 
        defendant shall be liable for the costs of the action and 
        reasonable attorney fees as determined by the court.''.

SEC. 6. PROHIBITION ON PSYCHOLOGICAL TESTING.

    Section 445 of the General Education Provisions Act (20 U.S.C. 
1232h) is amended--
            (1) by redesignating subsections (d) through (f) as 
        subsections (f) through (h), respectively;
            (2) by inserting after subsection (c) the following:
    ``(d) Prohibition on Psychological Testing.--
            ``(1) Definitions.--In this section:
                    ``(A) Affective computing.--The term `affective 
                computing' means systems and devices that can or 
                attempt to recognize, interpret, process, or simulate 
                aspects of human feelings or emotions.
                    ``(B) Interpersonal resources or interpersonal 
                skills.--The term `interpersonal resources' or 
                `interpersonal skills' means non-cognitive emotional 
                and psychological characteristics and attributes and 
                skills used to manage relationships and interactions 
                between or among individuals.
                    ``(C) Intrapersonal resources or intrapersonal 
                skills.--The term `intrapersonal resources' or 
                `intrapersonal skills' means non-cognitive emotional 
                and psychological characteristics and attributes used 
                to manage emotions and attitudes within an individual.
                    ``(D) Predictive modeling.--The term `predictive 
                modeling' means the use of educational data-mining 
                methods to make predictions about future behaviors or 
                performance.
                    ``(E) Process.--The term `process' or `processing' 
                means to use, access, manipulate, scan, modify, 
                transform, disclose, store, transmit, transfer, retain, 
                aggregate, or dispose of student or teacher data.
                    ``(F) Psychological resources.--The term 
                `psychological resources' means non-cognitive, 
                emotional characteristics, attributes, and skills, 
                including mindsets, learning strategies, and effortful 
                control, used by an individual to address or manage 
                various life situations.
            ``(2) In general.--Notwithstanding any other provision of 
        law, no funds provided to the Department or Federal funds 
        provided under any applicable program shall be spent to support 
        any survey or academic assessment allowing any of the following 
        types of data collection via assessments or any other means, 
        including digitally:
                    ``(A) Any data collected via affective computing, 
                including analysis of facial expressions, EEG brain 
                wave patterns, skin conductance, galvanic skin 
                response, heart-rate variability, pulse, blood volume, 
                posture, and eye-tracking.
                    ``(B) Any data (including any resulting from 
                national or State assessments) that measure 
                psychological resources, mindsets, learning strategies, 
                effortful control, attributes, dispositions, social 
                skills, attitudes, intrapersonal resources, or any 
                other type of social, emotional, or psychological 
                parameter.
                    ``(C) Any data collected through predictive 
                modeling to be used to detect behaviors, beliefs, or 
                value systems, or for predicting or forecasting student 
                outcomes.
                    ``(D) Any type of psychological data, including 
                assessment of non-cognitive skills or attributes, 
                psychological resources, mindsets, learning strategies, 
                effortful control, attitudes, dispositions, social 
                skills, or other interpersonal or intrapersonal 
                resources collected via any national or State student 
                assessment.
            ``(3) Special rule.--Paragraph (2) shall not apply to an 
        applicable program carried out or funded under the Individuals 
        with Disabilities Education Act if the data collection is 
        required under such Act.
            ``(4) No national assessment using psychological data.--No 
        funds provided to the Department or to an applicable program 
        may be used to pilot test, field test, implement, administer, 
        or distribute in any way any federally sponsored national 
        assessment collecting any psychological data or any federally 
        sponsored research on social-emotional data in education.
    ``(e) Video Monitoring and Computer Surveillance Protections.--
            ``(1) Protections for video monitoring.--
                    ``(A) Elementary schools and secondary schools.--No 
                funds provided to the Department or under any 
                applicable program shall be made available to any 
                public elementary school or secondary school served by 
                an educational agency receiving funds under any 
                eligible program that conducts video monitoring of 
                classrooms in the school, for any purpose, including 
                for teacher evaluation, without the approval of the 
                local educational agency after a public hearing and the 
                written consent of the teacher and the parents of all 
                students in the classroom.
                    ``(B) Other agencies and institutions.--No funds 
                provided to the Department or under any applicable 
                program shall be made available to any educational 
                agency or institution not covered under subparagraph 
                (A) that conducts video monitoring of classrooms in a 
                school or institution, for any purpose, including for 
                teacher evaluation, without a public hearing and the 
                written consent of the teacher, and of the parents of 
                all students in the classroom.
            ``(2) Protections for computer camera surveillance.--
                    ``(A) Elementary schools and secondary schools.--No 
                funds provided to the Department under any applicable 
                program shall be made available to any public 
                elementary school or secondary school that supplies, 
                through the school to a teacher or student, a computing 
                device on which remote camera surveillance software has 
                been installed, without first obtaining the approval of 
                the local educational agency after a public hearing. 
                Any such elementary school or secondary school that 
                provides computing devices to teachers or students 
                shall adopt a policy prohibiting the use of remote 
                camera surveillance software on a school supplied 
                computing device without the written consent of the 
                teacher and the parent of each affected student.
                    ``(B) Other agencies and institutions.--No funds 
                under any applicable program shall be made available to 
                any educational agency or institution not covered under 
                subparagraph (A) that supplies, through the school to a 
                student or teacher, a computing device on which remote 
                camera surveillance software has been installed without 
                first providing a public hearing and adopting a policy 
                prohibiting the use of remote camera surveillance 
                software on an institution-supplied computing device 
                without the written consent of the teacher and the 
                parent of each affected student.
            ``(3) Permission and consent.--For the purposes of this 
        subsection, whenever a student has attained eighteen years of 
        age, or is attending an institution of postsecondary education, 
        the permission or consent required of and the rights accorded 
        to the parents of the student shall thereafter only be required 
        of and accorded to the student.
            ``(4) Definitions.--In this subsection, the term 
        `educational agency or institution' has the meaning given the 
        term in section 444.''.

SEC. 7. PROHIBITION ON COLLECTING CERTAIN PRIVATE INFORMATION.

    Section 445 of the General Education Provisions Act (20 U.S.C. 
1232h) is amended--
            (1) by striking subsection (b) and inserting the following:
    ``(b) Neither the Secretary nor any educational agency or 
institution receiving assistance under any applicable program shall 
administer any student survey, assessment, analysis, evaluation, or 
similar instrument that solicits information about the student or the 
student's family concerning the following:
            ``(1) Political affiliations or beliefs.
            ``(2) Mental or psychological problems, psychological 
        resources, mindsets, learning strategies, effortful control, 
        attributes, dispositions, social skills, attitudes, or 
        intrapersonal resources (as defined in subsection (d)(1)).
            ``(3) Sexual behavior or attitudes.
            ``(4) Illegal, antisocial, self-incriminating, or demeaning 
        behavior.
            ``(5) Critical appraisals of another individual with whom a 
        student has a close relationship.
            ``(6) Legally recognized privileged or analogous 
        relationships, such as those with a lawyer, physician, or 
        member of the clergy.
            ``(7) Religious practices, affiliations, or beliefs.
            ``(8) Personal or family gun ownership.
            ``(9) Income or other income-related information except 
        that required by law to determine eligibility to participate in 
        or receive financial assistance under a program.''; and
            (2) in subsection(c)(1)--
                    (A) by striking subparagraph (B);
                    (B) by redesignating subparagraphs (C) through (F) 
                as subparagraphs (B) through (E), respectively; and
                    (C) in subparagraph (E)(i), as redesignated by 
                subparagraph (B), by striking ``subparagraph (E)'' and 
                inserting ``subparagraph (D)''.

SEC. 8. SEVERABILITY.

    If any provision of this Act or an amendment made by this Act, or 
the application of the provision to any person or circumstance, is held 
to be unconstitutional, the remainder of this Act and the amendments 
made by this Act, and the application of the provisions of this Act and 
the amendments made by this Act to any other person or circumstance, 
shall not be affected thereby.
                                 <all>
```