I 

114TH CONGRESS 

1ST SESSION H. R. 2092 

To require operators that provide online and similar services to educational 

agencies or institutions to protect the privacy and security of personally 

identifiable information, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 29, 2015 

Mr. MESSER (for himself and Mr. POLIS) introduced the following bill; which 

was referred to the Committee on Energy and Commerce, and in addition 

to the Committee on Education and the Workforce, for a period to be 

subsequently determined by the Speaker, in each case for consideration 

of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To require operators that provide online and similar services 

to educational agencies or institutions to protect the 

privacy and security of personally identifiable information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Student Digital Pri5 vacy and Parental Rights Act of 2015’’. 


SSpencer on DSK4SPTVN1PROD with BILLS
2 

•HR 2092 IH

1 SEC. 2. DEFINITIONS. 

2 (a) IN GENERAL.—In this Act: 

3 (1) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (2) COVERED INFORMATION.—The term ‘‘cov6 ered information’’ means personally identifiable in7 formation, and information that is linked or linkable 

8 to personally identifiable information, that— 

9 (A) is collected or generated through a 

10 school service; and 

11 (B)(i) the operator of the school service 

12 knows or should know relates to a student; or 

13 (ii) is collected, generated, or maintained 

14 at the direction of an educational agency or in15 stitution serving the student or officials of such 

16 an agency or institution, including teachers. 

17 (3) EDUCATIONAL AGENCY OR INSTITUTION.— 

18 The term ‘‘educational agency or institution’’ has 

19 the meaning given such term in section 444 of the 

20 General Education Provisions Act (20 U.S.C. 

21 1232g), except that such term does not include an 

22 institution of higher education. 

23 (4) ELIGIBLE STUDENT.—The term ‘‘eligible 

24 student’’ means a student who— 

25 (A) is 18 years of age or older; 


SSpencer on DSK4SPTVN1PROD with BILLS
3 

•HR 2092 IH

1 (B) is enrolled in an institution of higher 

2 education; or 

3 (C) has graduated from a secondary 

4 school. 

5 (5) INSTITUTION OF HIGHER EDUCATION.—The 

6 term ‘‘institution of higher education’’ has the 

7 meaning given such term in section 102 of the High8 er Education Act of 1965 (20 U.S.C. 1002). 

9 (6) K-12 PURPOSES.—The term ‘‘K-12 pur10 poses’’ means purposes that— 

11 (A) aid in the administration of activities 

12 by an educational agency or institution, includ13 ing instruction in the classroom or at home, ad14 ministrative activities, and collaboration be15 tween students, school personnel, or parents; or 

16 (B) are for the use and benefit of the edu17 cational agency or institution. 

18 (7) ONLINE CONTACT INFORMATION.—The 

19 term ‘‘online contact information’’ means, with re20 spect to a student, an email address or any other 

21 substantially similar identifier that permits direct 

22 contact with the student online, including an instant 

23 messaging user identifier, a voice over Internet Pro24 tocol identifier, a video chat user identifier, or a 


SSpencer on DSK4SPTVN1PROD with BILLS
4 

•HR 2092 IH

1 screen name or user name that permits such con2 tact. 

3 (8) OPERATOR.—The term ‘‘operator’’ means 

4 an entity that operates a school service, except that 

5 such term does not include an educational agency or 

6 institution. 

7 (9) PERSONALLY IDENTIFIABLE INFORMA8 TION.—The term ‘‘personally identifiable informa9 tion’’ includes, with respect to a student— 

10 (A) the student’s first and last name; 

11 (B) the first and last name of the stu12 dent’s parent or another family member; 

13 (C) the home or physical address of the 

14 student or student’s family; 

15 (D) online contact information for the stu16 dent; 

17 (E) a personal identifier, such as the stu18 dent’s social security number, student number, 

19 or biometric record; 

20 (F) a persistent identifier that can be used 

21 to recognize a user over time and across dif22 ferent Internet Web sites, online services, online 

23 applications, or mobile applications, including a 

24 customer number held in a cookie, an Internet 


SSpencer on DSK4SPTVN1PROD with BILLS
5 

•HR 2092 IH

1 Protocol address, a processor or device serial 

2 number, or another unique identifier; 

3 (G) a photograph, video, or audio record4 ing that contains the student’s image or voice; 

5 (H) geolocation information sufficient to 

6 identify street name and name of a city or 

7 town; 

8 (I) other indirect identifiers, such as the 

9 student’s date of birth, place of birth, or moth10 er’s maiden name; 

11 (J) other information that, alone or in 

12 combination, would allow an operator or a rea13 sonable person in the school community, who 

14 does not have personal knowledge of the rel15 evant circumstances, to identify a specific stu16 dent with reasonable certainty; and 

17 (K) information requested by a person who 

18 the educational agency or institution reasonably 

19 believes knows the identity of the student to 

20 whom the information relates. 

21 (10) SCHOOL SERVICE.—The term ‘‘school serv22 ice’’ means an Internet Web site, online service (in23 cluding a cloud computing service), online applica24 tion, or mobile application that is used for K-12 purVerDate Sep 11 2014 02:13 May 09, 2015 Jkt 049200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H2092.IH H2092

SSpencer on DSK4SPTVN1PROD with BILLS
6 

•HR 2092 IH

1 poses and was designed and marketed for K-12 pur2 poses. 

3 (11) STATE.—The term ‘‘State’’ means each 

4 State of the United States, the District of Columbia, 

5 each territory or possession of the United States, 

6 and each federally recognized Indian tribe. 

7 (12) STUDENT.—The term ‘‘student’’ means 

8 any individual who is or has been enrolled in an ele9 mentary school or secondary school. 

10 (13) TARGETED ADVERTISING.— 

11 (A) IN GENERAL.—The term ‘‘targeted ad12 vertising’’ means presenting advertisements to a 

13 student or the student’s parent, where the ad14 vertisements are selected based on information 

15 obtained or inferred from the student’s online 

16 behavior or use of online applications or mobile 

17 applications or from covered information about 

18 the student maintained by the operator of a 

19 school service. 

20 (B) EXCLUSION.—Such term does not in21 clude presenting advertisements to a student or 

22 the student’s parent at an online location or 

23 through an online application or mobile applica24 tion, if— 


SSpencer on DSK4SPTVN1PROD with BILLS
7 

•HR 2092 IH

1 (i) the advertisements are contextually 

2 relevant; 

3 (ii) the advertisements are selected 

4 based on a single visit or session of use 

5 during which the advertisements are pre6 sented; and 

7 (iii) information about the student’s 

8 online behavior or use of online applica9 tions or mobile applications is not collected 

10 or retained over time. 

11 (b) TERMS DEFINED IN ELEMENTARY AND SEC12 ONDARY EDUCATION ACT OF 1965.—In this Act, the 

13 terms ‘‘elementary school’’, ‘‘parent’’, and ‘‘secondary 

14 school’’ have the meanings given such terms in section 

15 9101 of the Elementary and Secondary Education Act of 

16 1965 (20 U.S.C. 7801). 

17 SEC. 3. PROTECTING STUDENT PRIVACY. 

18 (a) PROHIBITED PRACTICES.—An operator may not 

19 knowingly— 

20 (1) engage in or permit targeted advertising on 

21 a school service; 

22 (2) collect, generate, use, or disclose any cov23 ered information for purposes of targeted adver24 tising; 

25 (3) sell covered information to a third party; 


SSpencer on DSK4SPTVN1PROD with BILLS
8 

•HR 2092 IH

1 (4) collect, generate, or use covered information 

2 (including using covered information to create a per3 sonal profile of a student) other than for K-12 pur4 poses; or 

5 (5) disclose covered information, unless the dis6 closure is made— 

7 (A) pursuant to lawful process or to ensure 

8 legal and regulatory compliance with Federal or 

9 State law; 

10 (B) in accordance with subsection (c), pur11 suant to a request for disclosure— 

12 (i) in the case of information about a 

13 student, from the student’s parent; or 

14 (ii) in the case of information about a 

15 student’s parent or another user of the 

16 school service, from the parent or such 

17 other user, as the case may be; 

18 (C) in accordance with subsection (c), pur19 suant to a request for disclosure from a student 

20 who is or has been enrolled in a secondary 

21 school or from the student’s parent for the ex22 clusive purpose of— 

23 (i) providing or authenticating the 

24 student’s transcript, standardized test 

25 scores, letters of recommendation, or other 


SSpencer on DSK4SPTVN1PROD with BILLS
9 

•HR 2092 IH

1 information required by an institution of 

2 higher education for an application for ad3 mission or by a potential employer for an 

4 application for employment; or 

5 (ii) providing information relating 

6 to— 

7 (I) admission to an institution of 

8 higher education; or 

9 (II) a scholarship or financial aid 

10 for attendance at an institution of 

11 higher education; 

12 (D) to protect the safety of users or others 

13 or the security of the school service; 

14 (E) to an educational agency or institution, 

15 as permitted by Federal and State law; or 

16 (F) to a third-party service provider of the 

17 operator, and the operator contractually— 

18 (i) prohibits the service provider from 

19 using any covered information for any pur20 pose other than providing the contracted 

21 service to, or on behalf of, the operator; 

22 (ii) prohibits the service provider from 

23 disclosing to subsequent third parties any 

24 covered information disclosed by the oper25 ator to the service provider; and 


SSpencer on DSK4SPTVN1PROD with BILLS
10 

•HR 2092 IH

1 (iii) requires the service provider to 

2 establish, implement, and maintain reason3 able security procedures as described in 

4 subsection (b)(1). 

5 (b) REQUIREMENTS.—An operator shall— 

6 (1) establish, implement, and maintain reason7 able security procedures appropriate to the nature of 

8 covered information to protect the confidentiality, se9 curity, and integrity of covered information; 

10 (2) delete a student’s covered information (ex11 cept for information that is required to be main12 tained by Federal or State law) within a reasonable 

13 time, not to exceed 45 days, after receiving— 

14 (A) a request from an educational agency 

15 or institution serving the student; or 

16 (B) a request (either directly or through 

17 the educational agency or institution) from the 

18 student’s parent, except in the case of informa19 tion that is included in the student’s education 

20 records (as defined in section 444 of the Gen21 eral Education Provisions Act (20 U.S.C. 

22 1232g)), such as the student’s test scores or 

23 grades, or that is directed by the educational 

24 agency or institution to be maintained for edu25 cational or administrative purposes; 


SSpencer on DSK4SPTVN1PROD with BILLS
11 

•HR 2092 IH

1 (3) disclose publicly and to each educational 

2 agency or institution to which the operator provides 

3 a school service, in contracts or privacy policies in a 

4 manner that is clear and easy to understand, the 

5 types of covered information collected or generated 

6 (if any), the purposes for which the covered informa7 tion is used or disclosed to third parties, and the 

8 identity of any such party; 

9 (4) facilitate access to and correction of covered 

10 information, either directly or through an edu11 cational agency or institution— 

12 (A) in the case of information about a stu13 dent, by the student’s parent; or 

14 (B) in the case of information about a par15 ent or another user of the school service, by the 

16 parent or such other user, as the case may be; 

17 (5) implement policies and procedures for re18 sponding to data breaches involving unauthorized ac19 quisition of or access to personally identifiable infor20 mation that occur on a school service, in compliance 

21 with any obligations imposed by Federal or State 

22 law; 

23 (6) notify the Commission and, as appropriate, 

24 students, parents, educational agencies or institu25 tions, or officials of such agencies or institutions (inVerDate Sep 11 2014 02:13 May 09, 2015 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H2092.IH H2092

SSpencer on DSK4SPTVN1PROD with BILLS
12 

•HR 2092 IH

1 cluding teachers) of each data breach involving un2 authorized acquisition of or access to personally 

3 identifiable information that occurs on a school serv4 ice, in compliance with any obligations imposed by 

5 Federal or State law; and 

6 (7) delete any covered information maintained 

7 by a school service (except for information that is re8 quired to be maintained by Federal or State law)— 

9 (A) except as provided in subparagraph 

10 (B), within a reasonable time, not to exceed one 

11 year, after the operator ceases to provide the 

12 service to the educational agency or institution, 

13 unless the information is required to be main14 tained at the direction of the educational agen15 cy or institution or the student’s parent; or 

16 (B) if the operator continues providing the 

17 service in whole or in part to a student after 

18 ceasing to provide the service to the educational 

19 agency or institution, within a reasonable time, 

20 not to exceed one year, after the operator 

21 ceases to provide the service to the student, un22 less the information is required to be main23 tained at the direction of the student’s parent. 

24 (c) REQUIREMENTS FOR CERTAIN DISCLOSURES.— 

25 An operator may disclose covered information under subVerDate Sep 11 2014 02:13 May 09, 2015 Jkt 049200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H2092.IH H2092

SSpencer on DSK4SPTVN1PROD with BILLS
13 

•HR 2092 IH

1 paragraph (B) or (C) of subsection (a)(5) only after the 

2 operator— 

3 (1) receives from the student, the student’s par4 ent, or other user of the school service, as the case 

5 may be (in this subsection referred to as the ‘‘re6 questing party’’), an affirmative express request 

7 (whether made directly or through an educational 

8 agency or institution serving the student) to disclose 

9 information specified in the request; 

10 (2) provides to the requesting party, in a man11 ner that is clear and easy to understand, a descrip12 tion of the types of covered information that will be 

13 disclosed to a third party, any fees collected by the 

14 operator to cover administrative costs, and the pur15 poses for which the covered information will be dis16 closed to and used by the third party; 

17 (3) ensures that the third party agrees, in writ18 ing or an electronic equivalent— 

19 (A) not to use any covered information re20 ceived pursuant to the request for any purpose 

21 other than fulfilling the purpose for which the 

22 request was made; 

23 (B) not to disclose to subsequent third 

24 parties any covered information received pursu25 ant to the request; and 


SSpencer on DSK4SPTVN1PROD with BILLS
14 

•HR 2092 IH

1 (C) to establish, implement, and maintain 

2 reasonable security procedures as described in 

3 subsection (b)(1); and 

4 (4) provides a readily available mechanism for 

5 the requesting party to revoke the request. 

6 (d) EFFECT ON MERGERS AND ACQUISITIONS.—The 

7 prohibitions of this section on sale and disclosure of cov8 ered information do not apply to the merger of an operator 

9 with another entity or the acquisition of the operator by 

10 another entity (including any subsequent merger or acqui11 sition), provided that the operator or successor entity con12 tinues to be subject to the provisions of this section with 

13 respect to covered information acquired before the merger 

14 or acquisition. 

15 (e) CONTINUED APPLICATION.—This section shall 

16 continue to apply, after a student is no longer enrolled 

17 in an elementary school or secondary school, to covered 

18 information relating to the student that was collected or 

19 generated while the student was enrolled. 

20 SEC. 4. RULES OF CONSTRUCTION. 

21 (a) IN GENERAL.—This Act shall not— 

22 (1) be construed to affect or otherwise alter the 

23 protections and guarantees set forth in section 444 

24 of the General Education Provisions Act (20 U.S.C. 

25 1232g) (commonly known as the ‘‘Family EduVerDate Sep 11 2014 02:13 May 09, 2015 Jkt 049200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\H2092.IH H2092

SSpencer on DSK4SPTVN1PROD with BILLS
15 

•HR 2092 IH

1 cational Rights and Privacy Act of 1974’’), the Chil2 dren’s Online Privacy Protection Act of 1998 (15 

3 U.S.C. 6501 et seq.), or any other Federal statute 

4 relating to privacy protection; 

5 (2) be construed to limit the authority of a law 

6 enforcement agency to obtain content or information 

7 from an operator as authorized by law or pursuant 

8 to an order of a court of competent jurisdiction; 

9 (3) limit the ability of an operator to use infor10 mation, including covered information, for adaptive 

11 or personalized student learning purposes; 

12 (4) limit an educational agency or institution 

13 from providing Internet access service for its own 

14 use, to other educational agencies or institutions, or 

15 to students and their families; 

16 (5) be construed to prohibit an operator’s use 

17 of covered information for maintaining, developing, 

18 supporting, improving, or diagnosing the operator’s 

19 school service; 

20 (6) be construed to prohibit an operator of a 

21 school service from marketing educational products 

22 directly to parents, provided that the marketing does 

23 not result from the use of covered information; 

24 (7) impose a duty upon a provider of an elec25 tronic store, gateway, marketplace, or other means 


SSpencer on DSK4SPTVN1PROD with BILLS
16 

•HR 2092 IH

1 of purchasing or downloading software or applica2 tions to review or enforce compliance with this Act 

3 by operators of school services; 

4 (8) impede the ability of a student or the stu5 dent’s parent to download, export, create, or other6 wise save or maintain data or documents created by 

7 or about the student or noncommercial applications 

8 created by the student, except to the extent any such 

9 activity would result in disclosure prohibited by this 

10 Act of covered information of other students or 

11 users of a school service; or 

12 (9) be construed to prohibit an operator from 

13 collecting a reasonable fee to cover the administra14 tive costs of making a disclosure under section 

15 3(a)(5)(C). 

16 (b) DE-IDENTIFIED AND AGGREGATED COVERED IN17 FORMATION.— 

18 (1) IN GENERAL.—Nothing in this Act pro19 hibits an operator from— 

20 (A) using de-identified and aggregated cov21 ered information— 

22 (i) within the operator’s school service 

23 or other sites, services, or applications 

24 owned by the operator to improve edu25 cational products; or 


SSpencer on DSK4SPTVN1PROD with BILLS
17 

•HR 2092 IH

1 (ii) to demonstrate the effectiveness of 

2 the operator’s products or services, includ3 ing in the marketing of such products or 

4 services; or 

5 (B) disclosing de-identified and aggregated 

6 covered information for research and develop7 ment, including— 

8 (i) research, development, and im9 provement of educational sites, services, 

10 and applications; and 

11 (ii) advancements in the science of 

12 learning. 

13 (2) STEPS TO PREVENT RE-IDENTIFICATION OR

14 DISAGGREGATION.—If an operator uses or discloses 

15 covered information as described in paragraph (1), 

16 the operator shall take reasonable steps to ensure 

17 that the information cannot be manipulated in a 

18 manner that would enable— 

19 (A) identification of an individual to whom 

20 the information relates; or 

21 (B) disaggregation of aggregated informa22 tion into its component parts. 

23 (c) POWER TO CONSENT AND RIGHTS REGARDING

24 INFORMATION ABOUT ELIGIBLE STUDENT.—Any provi25 sion of this Act that refers to the consent of the student’s 


SSpencer on DSK4SPTVN1PROD with BILLS
18 

•HR 2092 IH

1 parent for the use or disclosure of covered information or 

2 the right of the student’s parent to access or otherwise 

3 obtain, use, correct, request disclosure of, or request dele4 tion of covered information, shall, in the case of covered 

5 information about an eligible student, be considered to 

6 refer to the consent or right of the student and not the 

7 student’s parent. 

8 (d) NO EFFECT ON CONSENT UNDER OTHER

9 LAW.—Except as provided in section 5(g), this Act does 

10 not modify the requirements or standards for consent, in11 cluding consent from minors and employees on behalf of 

12 educational institutions, under any other provision of Fed13 eral law or under State law. 

14 SEC. 5. IMPLEMENTATION AND ENFORCEMENT. 

15 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS16 SION.— 

17 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC18 TICES.—A violation of this Act or a regulation pro19 mulgated under this Act shall be treated as a viola20 tion of a regulation under section 18(a)(1)(B) of the 

21 Federal Trade Commission Act (15 U.S.C. 

22 57a(a)(1)(B)) regarding unfair or deceptive acts or 

23 practices. 

24 (2) POWERS OF THE COMMISSION.—The Com25 mission shall enforce this Act and the regulations 


SSpencer on DSK4SPTVN1PROD with BILLS
19 

•HR 2092 IH

1 promulgated under this Act in the same manner, by 

2 the same means, and with the same jurisdiction, 

3 powers, and duties as though all applicable terms 

4 and provisions of the Federal Trade Commission Act 

5 (15 U.S.C. 41 et seq.) were incorporated into and 

6 made a part of this Act, and any person who violates 

7 this Act or a regulation promulgated under this Act 

8 shall be subject to the penalties entitled to the privi9 leges and immunities provided in the Federal Trade 

10 Commission Act, except as provided in paragraph 

11 (3). 

12 (3) ENFORCEMENT WITH RESPECT TO NON13 PROFIT ORGANIZATIONS.—Notwithstanding sections 

14 4 and 5(a)(2) of the Federal Trade Commission Act 

15 (15 U.S.C. 44; 45(a)(2)), any jurisdictional limita16 tion of the Commission with respect to nonprofit or17 ganizations shall not apply for purposes of this Act. 

18 (b) PRESERVATION OF COMMISSION AUTHORITY.— 

19 Nothing in this Act may be construed in any way to limit 

20 or affect the Commission’s authority under any other pro21 vision of law. 

22 (c) REGULATIONS.—The Commission may promul23 gate regulations under section 553 of title 5, United 

24 States Code, to carry out this Act. 


SSpencer on DSK4SPTVN1PROD with BILLS
20 

•HR 2092 IH

1 (d) CONSULTATION AND COOPERATION WITH SEC2 RETARY OF EDUCATION.—The Commission shall consult 

3 and cooperate with the Secretary of Education in imple4 menting and enforcing this Act, including in promulgating 

5 any regulations to carry out this Act, in matters involving 

6 educational agencies or institutions. 

7 (e) REPORT BY COMMISSION.—Not later than 1 year 

8 after the effective date described in section 6, and annu9 ally thereafter, the Commission shall submit to Congress 

10 and make available on the Internet Web site of the Com11 mission a report on the number, scope, and nature of the 

12 data breaches about which the Commission receives notice 

13 under section 3(b)(6). 

14 (f) GUIDANCE AND TECHNICAL ASSISTANCE FROM

15 SECRETARY OF EDUCATION.—The Secretary of Edu16 cation shall provide educational agencies or institutions 

17 with reasonable guidance and technical assistance with re18 spect to preventing and responding to data breaches in19 volving unauthorized acquisition of or access to personally 

20 identifiable information that occur on a school service, in 

21 compliance with any obligations imposed by Federal or 

22 State law. 

23 (g) RELATIONSHIP TO STATE LAW.— 

24 (1) IN GENERAL.—This Act does not annul, 

25 alter, or affect, or exempt any person subject to the 


SSpencer on DSK4SPTVN1PROD with BILLS
21 

•HR 2092 IH

1 provisions of this Act from complying with, the laws 

2 of any State with respect to the treatment of covered 

3 information by operators of school services, except to 

4 the extent that such laws are inconsistent with any 

5 provision of this Act, and then only to the extent of 

6 the inconsistency. For purposes of this paragraph, a 

7 law of a State is not inconsistent with this Act if the 

8 protection such law affords any user of a school 

9 service is greater than the protection provided by 

10 this Act. 

11 (2) RULE OF CONSTRUCTION.—Any reference 

12 in this Act to State law shall be considered also to 

13 refer to the law of a political subdivision of a State. 

14 SEC. 6. EFFECTIVE DATE. 

15 This Act shall take effect on the date that is 18 

16 months after the date of the enactment of this Act. 

Æ 


SSpencer on DSK4SPTVN1PROD with BILLS