Student Privacy Protection Act

To amend section 444 of the General Education Provisions Act in order to improve the privacy protections available to students and their parents, and for other purposes. 1. Short title This Act may be cited as the Student Privacy Protection Act 2. Defining student data (a) Definition Section 444(a) of the General Education Provisions Act (commonly referred to as the Family Educational Rights and Privacy Act 20 U.S.C. 1232g (1) by striking paragraph (4) and inserting the following: (4) (A) For the purposes of this section, the term student data (B) The term student data (i) records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto which are in the sole possession of the maker thereof and which are not accessible or revealed to any other person except a substitute; (ii) records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement; (iii) in the case of persons who are employed by an educational agency or institution but who are not in attendance at such agency or institution, records made and maintained in the normal course of business which relate exclusively to such person in that person's capacity as an employee and are not available for use for any other purpose; or (iv) records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student's choice. ; and (2) in paragraph (5)(A), by striking includes the following consists of only the following (b) Conforming amendments Section 444 of such Act ( 20 U.S.C. 1232g (1) in subsection (a)— (A) in paragraph (1)— (i) in subparagraph (A), by striking educational records student data (ii) in subparagraph (C)(ii), by striking placed in the education records obtained (B) in paragraph (2)— (i) by striking the records the data (ii) by striking such records such data (2) in subsection (b)— (A) in paragraph (1)— (i) in subparagraph (B), by striking the record the data (ii) in subparagraph (E), by striking whose records whose student data (iii) in subparagraph (L), by striking such records such data (B) in paragraph (2)(A), by striking records student data (C) in paragraph (4)(A), by striking such records such data (3) in subsection (j)(1)(B), by striking such records such student data (4) by striking education records student data (5) by striking education record student data 3. Release of personally identifiable information Section 444 of the General Education Provisions Act (commonly referred to as the Family Educational Rights and Privacy Act 20 U.S.C. 1232g (1) in subsection (b)— (A) in paragraph (1)— (i) in subparagraph (A), by striking other school officials, including teachers employees and other school officials, including teachers, under the direct control of (ii) in subparagraph (C), by striking authorized representatives of authorized representatives under the direct control of (iii) by striking subparagraph (F); and (iv) by redesignating subparagraphs (G) through (K) as subparagraphs (F) through (J), respectively; (B) in paragraph (2)— (i) in the matter preceding subparagraph (A), by striking any personally identifiable information directory information, any student data, including personally identifiable information (other than directory information) that is not first aggregated, anonymized, and de-identified (ii) by striking subparagraph (A) and inserting the following: (A) the educational agency or institution meets the requirements of paragraph (8) with respect to the student data, including providing notice and obtaining parental consent; or ; and (iii) in subparagraph (B), by striking (1)(J) (1)(I) (C) in paragraph (3)— (i) by striking authorized representatives of authorized representatives under the direct control of (ii) by inserting administered by State or local public educational agencies or institutions Federally-supported education programs (iii) by inserting before the period at the end the following: : Provided further (D) in paragraph (4)(B)— (i) by inserting and consistent with the requirements of paragraph (8) student (ii) by inserting or paragraph (8) paragraph (2)(A) (iii) by inserting (as in effect on the day before the date of enactment of the Student Privacy Protection Act paragraph (1)(F) (E) in paragraph (5)— (i) by inserting administered by a State or local public educational agency or institution supported education program (ii) by striking the proviso both provisos (F) by adding at the end the following: (7) No appending data (A) In general No funds provided to the Department or under any applicable program may be provided to any educational agency or institution that appends any student data with personally identifiable information obtained from Federal or State agencies through data matches. (B) Federal prohibition Notwithstanding any other provision of law, the Secretary shall not append any student data of a student with personally identifiable information obtained from Federal or State agencies through data matches. (8) Limitations on third party use Notwithstanding paragraph (1) or any other provision of this section (not including paragraph (6)), no funds provided to the Department or under any applicable program may be provided to an educational agency (including a State educational agency) or institution that allows any third party (including any contractor or other person acting under direct control of the agency or institution) to access student data of students, including personally identifiable information and directory information, unless— (A) the agency or institution receives consent from the parents of the student for the student data to be made available to the third party; (B) prior to receiving the consent described in subparagraph (A), the agency or institution provides the parents with notice, not less than 30 days before the records would be provided to such outside party if consent is obtained, that informs the parent— (i) of the student data that would be accessed; (ii) that the student data will only be made available if the parent consents; (iii) that the parent have the ability, under subsection (a), to access the student data of their students held by the agency or institution or outside party, and a description of the process to make corrections for inaccurate data; and (iv) that the agency or institution and the outside party are liable for any violation of this section and that the remedies described in subsection (k) are available; (C) the agency or institution, and the third party, have in place methods sufficient to ensure that a reasonable person could not use any of the data provided to determine the identity of the student, by itself or when combined with other publicly available information; (D) the agency or institution requires that all student data remain the property of the agency or institution and that any student data, including data made available through the Internet or data hosted by a third party service provider, is destroyed when the individual is no longer a student served by the agency or institution; and (E) the third party agrees, as a condition of receiving such access, to be liable for any violation of this section, including civil liability under subsection (k). (9) No tracking of students (A) In general No funds provided to the Department or to an applicable program may be used to track children or for career tracking. (B) Only aggregate data in longitudinal data systems Student data shall not be used for or from State longitudinal data programs, including prekindergarten through grade 20 ( P–20 (C) Definitions In this paragraph: (i) Track The term track (ii) Career tracking The term career tracking (10) Rules of construction (A) Applicability to Federal Government Nothing in this section shall be construed to allow the Secretary, the Attorney General, or the head of any other Federal agency to provide any outside party access to student data, or personally identifiable information in student data, that has not first been aggregated, anonymized, and de-identified. (B) No data collection Nothing in this section shall be construed to authorize the collection, storage, sharing, or use, in any manner, of student data, including personally identifiable information of students, for the development or improvement of products or services, unless the student data has first been aggregated, anonymized, and de-identified. (C) No national database Nothing in this section shall be construed to authorize the collection, storage, sharing, or use, in any manner, of student data, including personally identifiable information, to support or inform a national or interstate database of student data or the linking of State longitudinal databases, unless the student data has been aggregated, anonymized, and de-identified. . 4. Requiring parental consent to release records of other students Section 444(a) of the General Education Provisions Act ( 20 U.S.C. 1232g(a) (1) in paragraph (1)— (A) in subparagraph (A), by striking ‘‘students who are or have been in attendance at a school of such agency or at such institution, as the case may be,’’ and inserting students for whom the agency or institution maintains student data (B) in subparagraph (B), by inserting , or for whom the agency or institution maintains student data that is subject (2) in paragraph (2), by striking who are or have been in attendance at a school of such agency or at such institution for whom the agency or institution maintains student data (3) in paragraph (5)(B), by striking attending the institution or agency for whom the agency or institution maintains student data (4) in paragraph (6), by striking , but does not include a person who has not been in attendance at such agency or institution 5. Remedies Section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g (k) Civil liability (1) In general (A) Agencies, institutions, and contractors As a condition of receiving any funds provided to the Department or under any applicable program, an educational agency or institution, and any third party that collects, maintains, or otherwise obtains access to student data through such agency or institution, that fails to comply with any requirement imposed under this section with respect to any individual shall be liable to that person in the amount determined under paragraph (2). (B) Federal government liability Any Federal agency that fails to comply with any requirement imposed under this section with respect to any individual shall be liable to that person in the amount determined under paragraph (2). (2) Amount of award (A) Individual action In an individual action, the sum awarded for liability under paragraph (1) is equal to— (i) in the case of a first violation, an amount of not less than $1,000; (ii) in the case of a second violation by the same person involving the student data and privacy of the same student, an amount of not less than than $5,000; and (iii) in the case of a third or any subsequent violation by the same person involving the student data and privacy of the same student, an amount of not less than $10,000. (B) Individual violation For purposes of this subsection, each violation of this section that involves different student data of an individual, or a different student, shall be considered a separate violation. (3) Costs and attorney fees In the case of any successful action to enforce liability under paragraph (1), the defendant shall be liable for the costs of the action and reasonable attorney fees as determined by the court. . 6. Prohibition on psychological testing Section 445 of the General Education Provisions Act ( 20 U.S.C. 1232h (1) by redesignating subsections (d) through (f) as subsections (f) through (h), respectively; (2) by inserting after subsection (c) the following: (d) Prohibition on psychological testing (1) Definitions In this section: (A) Affective computing The term affective computing (B) Interpersonal resources or interpersonal skills The term interpersonal resources interpersonal skills (C) Intrapersonal resources or intrapersonal skills The term intrapersonal resources intrapersonal skills (D) Predictive modeling The term predictive modeling (E) Process The term process processing (F) Psychological resources The term psychological resources (2) In general Notwithstanding any other provision of law, no funds provided to the Department or Federal funds provided under any applicable program shall be spent to support any survey or academic assessment allowing any of the following types of data collection via assessments or any other means, including digitally: (A) Any data collected via affective computing, including analysis of facial expressions, EEG brain wave patterns, skin conductance, galvanic skin response, heart-rate variability, pulse, blood volume, posture, and eye-tracking. (B) Any data (including any resulting from national or State assessments) that measure psychological resources, mindsets, learning strategies, effortful control, attributes, dispositions, social skills, attitudes, intrapersonal resources, or any other type of social, emotional, or psychological parameter. (C) Any data collected through predictive modeling to be used to detect behaviors, beliefs, or value systems, or for predicting or forecasting student outcomes. (D) Any type of psychological data, including assessment of non-cognitive skills or attributes, psychological resources, mindsets, learning strategies, effortful control, attitudes, dispositions, social skills, or other interpersonal or intrapersonal resources collected via any national or State student assessment. (3) Special rule Paragraph (2) shall not apply to an applicable program carried out or funded under the Individuals with Disabilities Education Act if the data collection is required under such Act. (4) No national assessment using psychological data No funds provided to the Department or to an applicable program may be used to pilot test, field test, implement, administer, or distribute in any way any federally sponsored national assessment collecting any psychological data or any federally sponsored research on social-emotional data in education. (e) Video monitoring and computer surveillance protections (1) Protections for video monitoring (A) Elementary schools and secondary schools No funds provided to the Department or under any applicable program shall be made available to any public elementary school or secondary school served by an educational agency receiving funds under any eligible program that conducts video monitoring of classrooms in the school, for any purpose, including for teacher evaluation, without the approval of the local educational agency after a public hearing and the written consent of the teacher and the parents of all students in the classroom. (B) Other agencies and institutions No funds provided to the Department or under any applicable program shall be made available to any educational agency or institution not covered under subparagraph (A) that conducts video monitoring of classrooms in a school or institution, for any purpose, including for teacher evaluation, without a public hearing and the written consent of the teacher, and of the parents of all students in the classroom. (2) Protections for computer camera surveillance (A) Elementary schools and secondary schools No funds provided to the Department under any applicable program shall be made available to any public elementary school or secondary school that supplies, through the school to a teacher or student, a computing device on which remote camera surveillance software has been installed, without first obtaining the approval of the local educational agency after a public hearing. Any such elementary school or secondary school that provides computing devices to teachers or students shall adopt a policy prohibiting the use of remote camera surveillance software on a school supplied computing device without the written consent of the teacher and the parent of each affected student. (B) Other agencies and institutions No funds under any applicable program shall be made available to any educational agency or institution not covered under subparagraph (A) that supplies, through the school to a student or teacher, a computing device on which remote camera surveillance software has been installed without first providing a public hearing and adopting a policy prohibiting the use of remote camera surveillance software on an institution-supplied computing device without the written consent of the teacher and the parent of each affected student. (3) Permission and consent For the purposes of this subsection, whenever a student has attained eighteen years of age, or is attending an institution of postsecondary education, the permission or consent required of and the rights accorded to the parents of the student shall thereafter only be required of and accorded to the student. (4) Definitions In this subsection, the term educational agency or institution . 7. Prohibition on collecting certain private information Section 445 of the General Education Provisions Act ( 20 U.S.C. 1232h (1) by striking subsection (b) and inserting the following: (b) Neither the Secretary nor any educational agency or institution receiving assistance under any applicable program shall administer any student survey, assessment, analysis, evaluation, or similar instrument that solicits information about the student or the student’s family concerning the following: (1) Political affiliations or beliefs. (2) Mental or psychological problems, psychological resources, mindsets, learning strategies, effortful control, attributes, dispositions, social skills, attitudes, or intrapersonal resources (as defined in subsection (d)(1)). (3) Sexual behavior or attitudes. (4) Illegal, antisocial, self-incriminating, or demeaning behavior. (5) Critical appraisals of another individual with whom a student has a close relationship. (6) Legally recognized privileged or analogous relationships, such as those with a lawyer, physician, or member of the clergy. (7) Religious practices, affiliations, or beliefs. (8) Personal or family gun ownership. (9) Income or other income-related information except that required by law to determine eligibility to participate in or receive financial assistance under a program. ; and (2) in subsection(c)(1)— (A) by striking subparagraph (B); (B) by redesignating subparagraphs (C) through (F) as subparagraphs (B) through (E), respectively; and (C) in subparagraph (E)(i), as redesignated by subparagraph (B), by striking subparagraph (E) subparagraph (D) 8. Severability If any provision of this Act or an amendment made by this Act, or the application of the provision to any person or circumstance, is held to be unconstitutional, the remainder of this Act and the amendments made by this Act, and the application of the provisions of this Act and the amendments made by this Act to any other person or circumstance, shall not be affected thereby.

Summary: Student Privacy Protection Act Amends the Family Educational Rights and Privacy Act of 1974 (FERPA) to prohibit funding of educational agencies or institutions that allow third parties to access student data, unless: the agency or institution, prior to receiving parental consent, notifies parents of the data that would be accessed, that the data will be made available to the third party only if the parent consents, that the parent has the ability to access and correct inaccurate data, and that the agency or institution and the outside party are liable for violations; the agency or institution can ensure that the data cannot be used to determine the student's identity; the student data remains the property of the agency or institution and is destroyed when the individual is no longer served by the agency or institution; and the third party agrees to be liable for FERPA violations. Extends FERPA rights to parents of any students for whom the agency or institution maintains student data, including home-schooled students who do not attend such agency or institution. Removes an exception that allows educational agencies or institutions to permit the release of student educational records without parental consent to organizations studying predictive tests, student aid programs, and instruction. Requires parental consent before authorized representatives under the direct control of the Comptroller General, the Department of Education (ED), or state educational authorities may access records for: (1) audits and evaluations of federally supported education programs administered by state or local public education agencies or institutions, or (2) enforcement of federal legal requirements. Prohibits ED or fund-receiving educational agencies or institutions from appending student data with personally identifiable information obtained from federal or state agencies through data matches. Bars funds from being used to: (1) track a student's educational and career progression activities, or (2) obligate an elementary or secondary school student to involuntarily select a career or related job training. Requires aggregation, anonymization, and de-identification of student data permitted to be released or collected under various exceptions. Makes federal agencies and fund-receiving educational agencies, institutions, and third parties that fail to comply with FERPA civilly liable for a monetary award to affected persons. Prohibits psychological testing or predictive modeling of behaviors, beliefs, or value systems. Bars video monitoring or computer camera surveillance without a public hearing and consent of teachers and parents. Prohibits surveys soliciting specified information about students or their families, including information on political affiliation, religious practices, or gun ownership.