II 114th CONGRESS 1st Session S. 1341 IN THE SENATE OF THE UNITED STATES May 14, 2015 Mr. Vitter introduced the following bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions A BILL To amend section 444 of the General Education Provisions Act in order to improve the privacy protections available to students and their parents, and for other purposes.

1. Short title This Act may be cited as the Student Privacy Protection Act . 2. Defining student data (a) Definition Section 444(a) of the General Education Provisions Act (commonly referred to as the Family Educational Rights and Privacy Act ) ( 20 U.S.C. 1232g ) is amended— (1) by striking paragraph (4) and inserting the following: (4) (A) For the purposes of this section, the term student data means information about a student collected and maintained by an educational agency or institution, by a person or third party collecting or maintaining such information through the active intervention, facilitation, or authorization of such agency or institution, or by a person or third party acting for such agency or institution. (B) The term student data does not include— (i) records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto which are in the sole possession of the maker thereof and which are not accessible or revealed to any other person except a substitute; (ii) records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement; (iii) in the case of persons who are employed by an educational agency or institution but who are not in attendance at such agency or institution, records made and maintained in the normal course of business which relate exclusively to such person in that person's capacity as an employee and are not available for use for any other purpose; or (iv) records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student's choice. ; and (2) in paragraph (5)(A), by striking includes the following and inserting consists of only the following . (b) Conforming amendments Section 444 of such Act ( 20 U.S.C. 1232g ), as amended by subsection (a), is further amended— (1) in subsection (a)— (A) in paragraph (1)— (i) in subparagraph (A), by striking educational records and inserting student data ; and (ii) in subparagraph (C)(ii), by striking placed in the education records and inserting obtained ; and (B) in paragraph (2)— (i) by striking the records each place the term appears and inserting the data ; and (ii) by striking such records each place the term appears and inserting such data ; (2) in subsection (b)— (A) in paragraph (1)— (i) in subparagraph (B), by striking the record each place the term appears and inserting the data ; (ii) in subparagraph (E), by striking whose records each place the term appears and inserting whose student data ; and (iii) in subparagraph (L), by striking such records and inserting such data ; (B) in paragraph (2)(A), by striking records each place the term appears and inserting student data ; and (C) in paragraph (4)(A), by striking such records and inserting such data ; (3) in subsection (j)(1)(B), by striking such records and inserting such student data ; (4) by striking education records each place the term appears and inserting student data ; and (5) by striking education record each place the term appears and inserting student data . 3. Release of personally identifiable information Section 444 of the General Education Provisions Act (commonly referred to as the Family Educational Rights and Privacy Act ) ( 20 U.S.C. 1232g ), as amended by section 2, is further amended— (1) in subsection (b)— (A) in paragraph (1)— (i) in subparagraph (A), by striking other school officials, including teachers and inserting employees and other school officials, including teachers, under the direct control of ; (ii) in subparagraph (C), by striking authorized representatives of each place the term appears and inserting authorized representatives under the direct control of ; (iii) by striking subparagraph (F); and (iv) by redesignating subparagraphs (G) through (K) as subparagraphs (F) through (J), respectively; (B) in paragraph (2)— (i) in the matter preceding subparagraph (A), by striking any personally identifiable information through directory information, and inserting any student data, including personally identifiable information (other than directory information) that is not first aggregated, anonymized, and de-identified ; (ii) by striking subparagraph (A) and inserting the following: (A) the educational agency or institution meets the requirements of paragraph (8) with respect to the student data, including providing notice and obtaining parental consent; or ; and (iii) in subparagraph (B), by striking (1)(J) and inserting (1)(I) ; (C) in paragraph (3)— (i) by striking authorized representatives of and inserting authorized representatives under the direct control of ; (ii) by inserting administered by State or local public educational agencies or institutions after Federally-supported education programs ; and (iii) by inserting before the period at the end the following: : Provided further , That notice is provided, and consent is obtained, from the parents consistent with paragraph (8) ; (D) in paragraph (4)(B)— (i) by inserting and consistent with the requirements of paragraph (8) after student ; (ii) by inserting or paragraph (8) after paragraph (2)(A) ; and (iii) by inserting (as in effect on the day before the date of enactment of the Student Privacy Protection Act ) after paragraph (1)(F) ; (E) in paragraph (5)— (i) by inserting administered by a State or local public educational agency or institution after supported education program ; and (ii) by striking the proviso and inserting both provisos ; and (F) by adding at the end the following: (7) No appending data (A) In general No funds provided to the Department or under any applicable program may be provided to any educational agency or institution that appends any student data with personally identifiable information obtained from Federal or State agencies through data matches. (B) Federal prohibition Notwithstanding any other provision of law, the Secretary shall not append any student data of a student with personally identifiable information obtained from Federal or State agencies through data matches. (8) Limitations on third party use Notwithstanding paragraph (1) or any other provision of this section (not including paragraph (6)), no funds provided to the Department or under any applicable program may be provided to an educational agency (including a State educational agency) or institution that allows any third party (including any contractor or other person acting under direct control of the agency or institution) to access student data of students, including personally identifiable information and directory information, unless— (A) the agency or institution receives consent from the parents of the student for the student data to be made available to the third party; (B) prior to receiving the consent described in subparagraph (A), the agency or institution provides the parents with notice, not less than 30 days before the records would be provided to such outside party if consent is obtained, that informs the parent— (i) of the student data that would be accessed; (ii) that the student data will only be made available if the parent consents; (iii) that the parent have the ability, under subsection (a), to access the student data of their students held by the agency or institution or outside party, and a description of the process to make corrections for inaccurate data; and (iv) that the agency or institution and the outside party are liable for any violation of this section and that the remedies described in subsection (k) are available; (C) the agency or institution, and the third party, have in place methods sufficient to ensure that a reasonable person could not use any of the data provided to determine the identity of the student, by itself or when combined with other publicly available information; (D) the agency or institution requires that all student data remain the property of the agency or institution and that any student data, including data made available through the Internet or data hosted by a third party service provider, is destroyed when the individual is no longer a student served by the agency or institution; and (E) the third party agrees, as a condition of receiving such access, to be liable for any violation of this section, including civil liability under subsection (k). (9) No tracking of students (A) In general No funds provided to the Department or to an applicable program may be used to track children or for career tracking. (B) Only aggregate data in longitudinal data systems Student data shall not be used for or from State longitudinal data programs, including prekindergarten through grade 20 ( P–20 ) workforce programs, unless the student data is first aggregated, anonymized, and de-identified. (C) Definitions In this paragraph: (i) Track The term track shall mean to collect and maintain records of a student’s activities through the student's educational career, beginning in preschool and including postsecondary education, and the student’s entrance into, and progression through, the workforce or the military. (ii) Career tracking The term career tracking shall mean any effort to obligate an elementary school or secondary school student to involuntarily select a career, career interest, employment goals, or related job training via any curriculum, instruction, employment-related activity, survey, test, assessment, or data collection. (10) Rules of construction (A) Applicability to Federal Government Nothing in this section shall be construed to allow the Secretary, the Attorney General, or the head of any other Federal agency to provide any outside party access to student data, or personally identifiable information in student data, that has not first been aggregated, anonymized, and de-identified. (B) No data collection Nothing in this section shall be construed to authorize the collection, storage, sharing, or use, in any manner, of student data, including personally identifiable information of students, for the development or improvement of products or services, unless the student data has first been aggregated, anonymized, and de-identified. (C) No national database Nothing in this section shall be construed to authorize the collection, storage, sharing, or use, in any manner, of student data, including personally identifiable information, to support or inform a national or interstate database of student data or the linking of State longitudinal databases, unless the student data has been aggregated, anonymized, and de-identified. . 4. Requiring parental consent to release records of other students Section 444(a) of the General Education Provisions Act ( 20 U.S.C. 1232g(a) ), as amended by section 2, is further amended— (1) in paragraph (1)— (A) in subparagraph (A), by striking ‘‘students who are or have been in attendance at a school of such agency or at such institution, as the case may be,’’ and inserting students for whom the agency or institution maintains student data ; and (B) in subparagraph (B), by inserting , or for whom the agency or institution maintains student data before that is subject ; (2) in paragraph (2), by striking who are or have been in attendance at a school of such agency or at such institution and inserting for whom the agency or institution maintains student data ; (3) in paragraph (5)(B), by striking attending the institution or agency and inserting for whom the agency or institution maintains student data ; and (4) in paragraph (6), by striking , but does not include a person who has not been in attendance at such agency or institution . 5. Remedies Section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g ), as amended by sections 2, 3, and 4, is further amended by adding at the end the following: (k) Civil liability (1) In general (A) Agencies, institutions, and contractors As a condition of receiving any funds provided to the Department or under any applicable program, an educational agency or institution, and any third party that collects, maintains, or otherwise obtains access to student data through such agency or institution, that fails to comply with any requirement imposed under this section with respect to any individual shall be liable to that person in the amount determined under paragraph (2). (B) Federal government liability Any Federal agency that fails to comply with any requirement imposed under this section with respect to any individual shall be liable to that person in the amount determined under paragraph (2). (2) Amount of award (A) Individual action In an individual action, the sum awarded for liability under paragraph (1) is equal to— (i) in the case of a first violation, an amount of not less than $1,000; (ii) in the case of a second violation by the same person involving the student data and privacy of the same student, an amount of not less than than $5,000; and (iii) in the case of a third or any subsequent violation by the same person involving the student data and privacy of the same student, an amount of not less than $10,000. (B) Individual violation For purposes of this subsection, each violation of this section that involves different student data of an individual, or a different student, shall be considered a separate violation. (3) Costs and attorney fees In the case of any successful action to enforce liability under paragraph (1), the defendant shall be liable for the costs of the action and reasonable attorney fees as determined by the court. . 6. Prohibition on psychological testing Section 445 of the General Education Provisions Act ( 20 U.S.C. 1232h ) is amended— (1) by redesignating subsections (d) through (f) as subsections (f) through (h), respectively; (2) by inserting after subsection (c) the following: (d) Prohibition on psychological testing (1) Definitions In this section: (A) Affective computing The term affective computing means systems and devices that can or attempt to recognize, interpret, process, or simulate aspects of human feelings or emotions. (B) Interpersonal resources or interpersonal skills The term interpersonal resources or interpersonal skills means non-cognitive emotional and psychological characteristics and attributes and skills used to manage relationships and interactions between or among individuals. (C) Intrapersonal resources or intrapersonal skills The term intrapersonal resources or intrapersonal skills means non-cognitive emotional and psychological characteristics and attributes used to manage emotions and attitudes within an individual. (D) Predictive modeling The term predictive modeling means the use of educational data-mining methods to make predictions about future behaviors or performance. (E) Process The term process or processing means to use, access, manipulate, scan, modify, transform, disclose, store, transmit, transfer, retain, aggregate, or dispose of student or teacher data. (F) Psychological resources The term psychological resources means non-cognitive, emotional characteristics, attributes, and skills, including mindsets, learning strategies, and effortful control, used by an individual to address or manage various life situations. (2) In general Notwithstanding any other provision of law, no funds provided to the Department or Federal funds provided under any applicable program shall be spent to support any survey or academic assessment allowing any of the following types of data collection via assessments or any other means, including digitally: (A) Any data collected via affective computing, including analysis of facial expressions, EEG brain wave patterns, skin conductance, galvanic skin response, heart-rate variability, pulse, blood volume, posture, and eye-tracking. (B) Any data (including any resulting from national or State assessments) that measure psychological resources, mindsets, learning strategies, effortful control, attributes, dispositions, social skills, attitudes, intrapersonal resources, or any other type of social, emotional, or psychological parameter. (C) Any data collected through predictive modeling to be used to detect behaviors, beliefs, or value systems, or for predicting or forecasting student outcomes. (D) Any type of psychological data, including assessment of non-cognitive skills or attributes, psychological resources, mindsets, learning strategies, effortful control, attitudes, dispositions, social skills, or other interpersonal or intrapersonal resources collected via any national or State student assessment. (3) Special rule Paragraph (2) shall not apply to an applicable program carried out or funded under the Individuals with Disabilities Education Act if the data collection is required under such Act. (4) No national assessment using psychological data No funds provided to the Department or to an applicable program may be used to pilot test, field test, implement, administer, or distribute in any way any federally sponsored national assessment collecting any psychological data or any federally sponsored research on social-emotional data in education. (e) Video monitoring and computer surveillance protections (1) Protections for video monitoring (A) Elementary schools and secondary schools No funds provided to the Department or under any applicable program shall be made available to any public elementary school or secondary school served by an educational agency receiving funds under any eligible program that conducts video monitoring of classrooms in the school, for any purpose, including for teacher evaluation, without the approval of the local educational agency after a public hearing and the written consent of the teacher and the parents of all students in the classroom. (B) Other agencies and institutions No funds provided to the Department or under any applicable program shall be made available to any educational agency or institution not covered under subparagraph (A) that conducts video monitoring of classrooms in a school or institution, for any purpose, including for teacher evaluation, without a public hearing and the written consent of the teacher, and of the parents of all students in the classroom. (2) Protections for computer camera surveillance (A) Elementary schools and secondary schools No funds provided to the Department under any applicable program shall be made available to any public elementary school or secondary school that supplies, through the school to a teacher or student, a computing device on which remote camera surveillance software has been installed, without first obtaining the approval of the local educational agency after a public hearing. Any such elementary school or secondary school that provides computing devices to teachers or students shall adopt a policy prohibiting the use of remote camera surveillance software on a school supplied computing device without the written consent of the teacher and the parent of each affected student. (B) Other agencies and institutions No funds under any applicable program shall be made available to any educational agency or institution not covered under subparagraph (A) that supplies, through the school to a student or teacher, a computing device on which remote camera surveillance software has been installed without first providing a public hearing and adopting a policy prohibiting the use of remote camera surveillance software on an institution-supplied computing device without the written consent of the teacher and the parent of each affected student. (3) Permission and consent For the purposes of this subsection, whenever a student has attained eighteen years of age, or is attending an institution of postsecondary education, the permission or consent required of and the rights accorded to the parents of the student shall thereafter only be required of and accorded to the student. (4) Definitions In this subsection, the term educational agency or institution has the meaning given the term in section 444. . 7. Prohibition on collecting certain private information Section 445 of the General Education Provisions Act ( 20 U.S.C. 1232h ) is amended— (1) by striking subsection (b) and inserting the following: (b) Neither the Secretary nor any educational agency or institution receiving assistance under any applicable program shall administer any student survey, assessment, analysis, evaluation, or similar instrument that solicits information about the student or the student’s family concerning the following: (1) Political affiliations or beliefs. (2) Mental or psychological problems, psychological resources, mindsets, learning strategies, effortful control, attributes, dispositions, social skills, attitudes, or intrapersonal resources (as defined in subsection (d)(1)). (3) Sexual behavior or attitudes. (4) Illegal, antisocial, self-incriminating, or demeaning behavior. (5) Critical appraisals of another individual with whom a student has a close relationship. (6) Legally recognized privileged or analogous relationships, such as those with a lawyer, physician, or member of the clergy. (7) Religious practices, affiliations, or beliefs. (8) Personal or family gun ownership. (9) Income or other income-related information except that required by law to determine eligibility to participate in or receive financial assistance under a program. ; and (2) in subsection(c)(1)— (A) by striking subparagraph (B); (B) by redesignating subparagraphs (C) through (F) as subparagraphs (B) through (E), respectively; and (C) in subparagraph (E)(i), as redesignated by subparagraph (B), by striking subparagraph (E) and inserting subparagraph (D) . 8. Severability If any provision of this Act or an amendment made by this Act, or the application of the provision to any person or circumstance, is held to be unconstitutional, the remainder of this Act and the amendments made by this Act, and the application of the provisions of this Act and the amendments made by this Act to any other person or circumstance, shall not be affected thereby.