This past week, the Ohio General Assembly passed House Bill (HB) 432, a bill containing key changes to the student data privacy provisions enacted earlier this year in Senate Bill (SB) 29. SB 29, which went into effect in October, imposed significant new requirements on school districts related to student data privacy, including provisions related to contracts with technology providers and restrictions on districts’ ability to monitor students’ activities on school-issued devices. We discussed SB 29 in an earlier Legal Ledger blog post, which you can find here.
SB 29 caused concern among districts because of the difficulty of complying with some of its more burdensome requirements. HB 432 goes a long way in alleviating many of those concerns. Perhaps the most pressing concern districts had with SB 29 was the requirement codified at Ohio Revised Code (RC) 3319.327 that districts send out written “trigger notices” within 72 hours of accessing certain information about a student’s data privacy (see earlier blog post for more detail). HB 432 relieves some of the administrative burden of complying with this requirement by significantly limiting the situations in which districts are required to issue the notices.
Upon the bill’s effective date, districts will only be required to issue the notices in certain scenarios, such as when there is a judicial warrant or subpoena or when the device is missing and/or stolen, and only when the district has decided to take responsive action. Notice will also be required when the district is accessing data in response to a threat to life or safety and is taking responsive action, such as disciplining the student, except if the notice itself will create an additional safety risk.
HB 432 also made changes to certain definitions in the new law. The bill’s definition of “educational records” now aligns with the definition used in the federal Family Educational Rights and Privacy Act (FERPA). In addition, the definition of “student” in the relevant statutory provisions now only includes currently enrolled students in grades K-12. The new bill also makes changes to the law’s provisions around technology contracts by clarifying that certain public entities such as county boards of developmental disabilities, educational service centers (ESCs), information technology centers (ITCs) and other districts that enter into a service contract with a school district that includes issuing school-issued devices to students are not included in the definition of “technology provider” that triggers that section’s notice provisions. Contracts with these entities are required, however, to indicate which party is responsible for providing required parental notices.
HB 432 contains an emergency clause, which means that it will go into immediate effect when signed by the governor. This is not meant to serve as an exhaustive list of the changes made by the legislation. OSBA encourages members to continue to work with legal counsel to ensure compliance with the law.