II 

113TH CONGRESS 

2D SESSION S. 2690 

To amend the Family Educational Rights and Privacy Act of 1974 to ensure 

that student data handled by private companies is protected, and for 

other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 30, 2014 

Mr. MARKEY (for himself, Mr. HATCH, Mr. WALSH, and Mr. KIRK) introduced the following bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To amend the Family Educational Rights and Privacy Act 

of 1974 to ensure that student data handled by private 

companies is protected, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Student 

5 Privacy Act of 2014’’. 

6 SEC. 2. FERPA IMPROVEMENTS. 

7 Subsection (b) of section 444 of the General Edu8 cation Provisions Act (20 U.S.C. 1232g) (commonly reVerDate Mar 15 2010 23:36 Aug 05, 2014 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2690.IS S2690

smartinez on DSK4TPTVN1PROD with BILLS
2 

•S 2690 IS

1 ferred to as the ‘‘Family Educational Rights and Privacy 

2 Act of 1974’’) is amended— 

3 (1) by redesignating paragraphs (4) through 

4 (7) as paragraphs (8) through (11), respectively; 

5 (2) by inserting after paragraph (3) the fol6 lowing: 

7 ‘‘(4)(A) No funds shall be made available under any 

8 applicable program to any educational agency or institu9 tion that has not implemented information security poli10 cies and procedures that— 

11 ‘‘(i) protect personally identifiable information 

12 from education records maintained by the edu13 cational agency or institution; and 

14 ‘‘(ii) require each outside party to whom per15 sonally identifiable information from education 

16 records is disclosed to have information security poli17 cies and procedures that include a comprehensive se18 curity program designed to protect the personally 

19 identifiable information from education records. 

20 ‘‘(B) For purposes of this subsection, the term ‘out21 side party’ means a person that is not an employee, offi22 cer, or volunteer of the educational agency or institution 

23 or of a Federal, State, or local governmental agency and 

24 includes any contractor or consultant acting as a school 


smartinez on DSK4TPTVN1PROD with BILLS
3 

•S 2690 IS

1 official or authorized representative or in any other capac2 ity. 

3 ‘‘(5) Notwithstanding any other provision of this sec4 tion or paragraph (2)(A), no funds shall be made available 

5 under any applicable program to any educational agency 

6 or institution that has a policy or practice of using, know7 ingly releasing, or otherwise knowingly providing access to 

8 personally identifiable information, as described in para9 graph (2), in the education records of a student to adver10 tise or market a product or service. 

11 ‘‘(6) Each State educational agency receiving funds 

12 under an applicable program, and each educational agency 

13 or institution, shall ensure that any outside party with ac14 cess to education records with personally identifiable infor15 mation complies with the following: 

16 ‘‘(A) Any education records that are held by the 

17 outside party shall be held in a manner that pro18 vides, as directed by the educational agency or insti19 tution, parents with— 

20 ‘‘(i) the right to access the personally iden21 tifiable information held about their students by 

22 the outside party, to the same extent and in the 

23 same manner as provided in subsection (a)(1); 

24 and 


smartinez on DSK4TPTVN1PROD with BILLS
4 

•S 2690 IS

1 ‘‘(ii) a process to challenge, correct, or de2 lete any inaccurate, misleading, or otherwise in3 appropriate data in any education records of 

4 such student that are held by the outside party, 

5 through an opportunity for a hearing by the 

6 agency or institution providing the outside 

7 party with access, in accordance with subsection 

8 (a)(2). 

9 ‘‘(B) The outside party shall maintain a record 

10 of all individuals, agencies, or organizations that 

11 have requested or obtained access to the education 

12 records of a student held by the outside party, in the 

13 same manner as is required under paragraph (8). 

14 ‘‘(C) The outside party shall have policies or 

15 procedures in place regarding information security 

16 practices regarding the education records, in accord17 ance with paragraph (4). 

18 ‘‘(7) No funds under any applicable program shall be 

19 made available to any educational agency or institution, 

20 or any State educational agency, unless the agency or in21 stitution has a policy or practice that— 

22 ‘‘(A) promotes data minimization in order to 

23 safeguard individual privacy by meeting any request 

24 for student information with non-personally identifi25 able information, if the purpose of any appropriate 


smartinez on DSK4TPTVN1PROD with BILLS
5 

•S 2690 IS

1 request can be effectively met with non-personally 

2 identifiable information; and 

3 ‘‘(B) requires that all personally identifiable in4 formation on an individual student held by any out5 side party be destroyed when the information is no 

6 longer needed for the specified purpose.’’; and 

7 (3) in paragraph (8)(A), as redesignated by 

8 paragraph (1)— 

9 (A) by inserting ‘‘who are employees, offi10 cers, or volunteers of the agency or institution’’ 

11 after ‘‘of this subsection’’; 

12 (B) by striking ‘‘or organizations’’ and in13 serting ‘‘organizations, or outside parties’’; 

14 (C) by striking ‘‘or organization’’ and in15 serting ‘‘organization, or outside party’’; and 

16 (D) by inserting ‘‘and will describe the in17 formation shared with such person, outside 

18 party, agency, or organization’’ after ‘‘obtaining 

19 this information’’. 

Æ 


smartinez on DSK4TPTVN1PROD with BILLS