On Thursday, Oct. 24, new requirements regarding student data privacy are set to go into effect. These changes are the result of Senate Bill (SB) 29, which was passed by the General Assembly this past July. SB 29 places significant new requirements on school districts as it relates to entering into contracts with technology providers and tracking and monitoring the online activities of students. Of particular immediate note for districts, some of the changes require immediate action on the part of school districts upon the bill’s effective date.
This blog post focuses on SB 29’s changes in two main categories. First, the bill requires districts to ensure that contracts with technology providers “ensure appropriate security safeguards for educational records” and contain specific terms that (1) restrict the unauthorized access of that data by the provider’s employees or contractors and (2) require that the technology provider's employees or contractors may be authorized to access educational records only as necessary to fulfill the official duties of the employee or contractor. Starting August 1, 2025, districts will also be required to issue to all parents and students a notice containing a list “of any curriculum, testing, or assessment technology provider contract affecting a student's educational records.” The notice must also inform parents and students about their rights to inspect and review these contracts.
The other major category of changes concerns the district’s ability to access and monitor information about students’ activities on “school-issued devices,” a term broadly defined to include any “hardware, software, devices, and accounts that a school district, acting independently or with a technology provider, provides to an individual student for that student's dedicated personal use.” Districts will now be restricted from accessing or monitoring much of this information except in the circumstances outlined in the law. These exceptions include when:
(1) The activity is limited to a noncommercial educational purpose for instruction, technical support, or exam-proctoring by school district employees, student teachers, staff contracted by a district, a vendor, or the department of education, and notice is provided in advance;
(2) The activity is permitted under a judicial warrant;
(3) The school district or technology provider is notified or becomes aware that the device is missing or stolen;
(4) The activity is necessary to prevent or respond to a threat to life or safety, and the access is limited to that purpose;
(5) The activity is necessary to comply with federal or state law;
(6) The activity is necessary to participate in federal or state funding programs.
While the exceptions appear to allow the district some flexibility to access this information in some cases, the notice requirements attached to these requirements are also significant. The first of these notice—the general monitoring notice—is required to be sent once per year when districts elect “to generally monitor a school-issued device” for one of the permissible purposes listed above. For this school year, this notice is required to be sent by the bill’s effective date: Oct. 24.
In addition to this general notice, the district will be required to issue “trigger notices” in certain circumstances. The new law requires that “[i]n the event that [the district accesses information under one of the exceptions listed above], the school district shall, within seventy-two hours of the access, notify the student's parent and provide a written description of the triggering circumstance, including which features of the device were accessed and a description of the threat, if any.” This notice is not required when the notice itself would pose a threat to life or safety, but must instead be given within seventy-two hours after that threat has ceased. The trigger notice requirement also goes into effect on Oct. 24.
OSBA strongly recommends that members work with legal counsel as they work to comply with the new requirements. This post contains only some of the new requirements, and districts should also review the full text of the legislation linked above. The notice requirements in particular are likely to create new administrative burdens, and districts will want to be prepared to comply. Members with general questions about the new requirements may contact OSBA’s division of legal services at 855-672-2529.