PROPOSED
HOUSE OF REPRESENTATIVES AMENDMENTS TO S.B. 1306
(Reference to Senate engrossed bill)
Page 1, between lines 9 and 10, insert:
"Sec. 9. Title 15, chapter 9, article 8, Arizona Revised Statutes, is amended by adding section 15-1046, to read:
15-1046. School service providers; privacy information; definitions
A. A SCHOOL SERVICE PROVIDER SHALL DO ALL OF THE FOLLOWING:
1. PROVIDE CLEAR AND EASY TO UNDERSTAND INFORMATION ABOUT THE TYPES OF STUDENT PERSONAL INFORMATION THAT THE SCHOOL SERVICE PROVIDER COLLECTS AND ABOUT HOW THE SCHOOL SERVICE PROVIDER USES AND SHARES THIS STUDENT PERSONAL INFORMATION.
2. PROVIDE PROMINENT NOTICE BEFORE MAKING MATERIAL CHANGES TO ITS PRIVACY POLICIES FOR SCHOOL SERVICES.
3. FACILITATE ACCESS TO AND CORRECTION OF STUDENT PERSONAL INFORMATION BY STUDENTS AND PARENTS OR GUARDIANS EITHER DIRECTLY OR THROUGH THE RELEVANT SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER.
4. OBTAIN CONSENT BEFORE USING STUDENT PERSONAL INFORMATION IN A MANNER THAT IS INCONSISTENT WITH THE PROVIDER'S PRIVACY POLICY FOR THE APPLICABLE SCHOOL SERVICE IN EFFECT AT THE TIME OF COLLECTION. IF THE STUDENT PERSONAL INFORMATION WAS COLLECTED DIRECTLY FROM STUDENTS, THE SCHOOL SERVICE PROVIDER SHALL OBTAIN CONSENT FROM THE STUDENT'S PARENT OR GUARDIAN OR THE STUDENT. IN ALL OTHER CASES, CONSENT MAY BE OBTAINED FROM THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER.
5. MAINTAIN A COMPREHENSIVE INFORMATION SECURITY PROGRAM THAT IS REASONABLY DESIGNED TO PROTECT THE SECURITY, PRIVACY, CONFIDENTIALITY AND INTEGRITY OF STUDENT PERSONAL INFORMATION AND THAT USES APPROPRIATE ADMINISTRATIVE, TECHNOLOGICAL AND PHYSICAL SAFEGUARDS.
6. REQUIRE ANY THIRD PARTY INVOLVED ON THE PROVIDERS' BEHALF TO ADHERE TO AND IMPLEMENT THE REQUIREMENTS OF THIS SECTION.
7. DELETE A STUDENT’S PERSONAL INFORMATION WITHIN A REaSONABLE PERIOD OF TIME IF THE RELEVANT SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER REQUESTS THE DELETION OF THE DATA UNDER THE CONTROL OF THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER UNLESS THE SCHOOL SERVICE PROVIDER HAS OBTAINED CONSENT FROM THE STUDENT’S PARENT OR GUARDIAN OR THE STUDENT TO RETAIN INFORMATION RELATED TO THAT STUDENT OR THE STUDENT HAS TRANSFERRED TO ANOTHER SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER AND THAT SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER HAS REQUESTED THAT THE SERVICE PROVIDER RETAIN INFORMATION RELATED TO THAT STUDENT.
B. IF THE SCHOOL SERVICE IS OFFERED TO A SCHOOL DISTRICT OR CHARTER SCHOOL OR A TEACHER IN A SCHOOL DISTRICT OR CHARTER SCHOOL, THE INFORMATION PRESCRIBED IN SUBSECTION A, PARAGRAPHS 1 AND 2 OF THIS SECTION MAY BE PROVIDED TO THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER.
C. A SCHOOL SERVICE PROVIDER MAY COLLECT, USE AND SHARE STUDENT PERSONAL INFORMATION ONLY FOR THE PURPOSES AUTHORIZED BY THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER, OR WITH THE CONSENT OF THE STUDENT'S PARENT OR GUARDIAN OR THE STUDENT. THIS PROHIBITION DOES NOT APPLy TO THE PURCHASE, MERGER OR OTHER TYPE OF ACQUISITION OF A SERVICE PROVIDER OR ANY ASSETS OF A SERVICE PROVIDER BY ANOTHER ENTITY PROVIDED THE SUCCESSOR ENTITY CONTINUES TO BE SUBJECT TO THE PROVISIONS OF THIS SECTION WITH RESPECT TO PREVIOUSLY ACQUIRED STUDENT PERSONAL INFORMATION TO THE EXTENT THAT THE SERVICE PROVIDER WAS REGULATED BY THIS SECTION.
D. A SCHOOL SERVICE PROVIDER MAY NOT DO ANY OF THE FOLLOWING:
1. SELL STUDENT PERSONAL INFORMATION.
2. USE OR SHARE ANY STUDENT PERSONAL INFORMATION FOR THE PURPOSE OF TARGETING ADVERTISEMENTS TO STUDENTS.
3. USE STUDENT PERSONAL INFORMATION TO CREATE A PERSONAL PROFILE OF A STUDENT OTHER THAN FOR SUPPORTING PURPOSES AUTHORIZED BY THE SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER, OR WITH THE CONSENT OF THE STUDENT'S PARENT OR GUARDIAN OR THE STUDENT. FOR THE PURPOSES OF THIS SECTION "CREATE A PERSONAL PROFILE" DOES NOT INCLUDE THE COLLECTION AND RETENTION OF ACCOUNT RECORDS OR INFORMATION THAT REMAINS UNDER THE CONTROL OF THE STUDENT, PARENT, SCHOOL OR school DISTRICT.
E. IF A SCHOOL SERVICE PROVIDER ENTERED INTO A SIGNED, WRITTEN CONTRACT WITH A SCHOOL DISTRICT, CHARTER SCHOOL OR TEACHER BEFORE THE EFFECTIVE DATE OF THIS SECTION, THE SCHOOL SERVICE PROVIDER IS NOT REQUIRED TO COMPLY WITH THIS SECTION WITH RESPECT TO THAT CONTRACT UNTIL THE NEXT RENEWAL DATE OF THE CONTRACT.
F. THIS SECTION DOES NOT PROHIBIT:
1. USING STUDENT PERSONAL INFORMATION FOR THE PURPOSES OF ADAPTIVE LEARNING, PERSONALIZED LEARNING OR CUSTOMIZED EDUCATION.
2. USING STUDENT PERSONAL INFORMATION FOR MAINTAINING, DEVELOPING, SUPPORTING, IMPROVING OR DIAGNOSING THE SCHOOL SERVICE’S SITE SERVICE OR APPLICATION.
3. PROVIDING RECOMMENDATIONS FOR SCHOOL, EDUCATIONAL, OTHER LEARNING OR EMPLOYMENT PURPOSES WITHIN A SCHOOL SERVICE’S SITE, SERVICE OR APPLICATION WITHOUT THE RESPONSE BEING DETERMINED IN WHOLE OR IN PART BY PAYMENT OR OTHER CONSIDERATION FROM A THIRD PARTY.
4. RESPONDING TO A STUDENT’S REQUEST FOR INFORMATION OR FOR FEEDBACK WITHOUT THE INFORMATION OR RESPONSE BEING DETERMINED IN WHOLE OR IN PART BY PAYMENT OR OTHER CONSIDERATION FROM A THIRD PARTY.
5. DISCLOSING STUDENT PERSONAL INFORMATION:
(a) TO ENSURE LEGAL OR REGULATORY COMPLIANCE OR PROTECT AGAINST LIABILITY.
(b) TO PROTECT THE SECURITY OR INTEGRITY OF ITS SITE, SERVICE OR APPLICATION.
(c) TO RESPOND TO OR PARTICIPATE IN JUDICIAL PROCESS.
(d) TO PROTECT THE SAFETY OF USERS OR OTHERS OR SECURITY OF THE SCHOOL SERVICE’S SITE, SERVICE OR APPLICATION.
(e) TO A SERVICE PROVIDER PROVIDED THE SCHOOL DISTRICT:
(i) CONTRACTUALLY PROHIBITS THE SERVICE PROVIDER FROM USING ANY STUDENT PERSONAL INFORMATION FOR ANY PURPOSE OTHER THAN PROVIDING THE CONTRACTED SERVICE TO, OR ON BEHALF OF, THE SCHOOL SERVICE.
(ii) PROHiBITS THE SERVICE PROVIDER FROM DISCLOSING ANY STUDENT PERSONAL INFORMATION PROVIDED BY THE SCHOOL SERVICE TO SUBSEQUENT THIRD PARTIES UNLESS THE DISCLOSURE IS EXPRESSLY PERMITTED BY SUBSECTION F, PARAGRAPHS 1, 2, 3, 4 AND 5.
(iii) REQUIRES THE SERVICE PROVIDER TO COMPLY WITH THE REQUIREMENTS OF THIS ACT.
6. THIS ACT SHALL NOT BE CONSTRUED TO IMPEDE THE ABILITY OF STUDENTS TO DOWNLOAD, EXPORT OR OTHERWISE SAVE OR MAINTAIN THEIR OWN STUDENT DATA OR DOCUMENTS.
G. FOR THE PURPOSES OF THIS SECTION:
1. "SCHOOL SERVICE" MEANS A WEBSITE, MOBILE APPLICATION OR ONLINE SERVICE THAT IS DESIGNED AND MARKETED FOR USE IN ELEMENTARY OR SECONDARY SCHOOLS, THAT IS USED AT THE DIRECTION OF TEACHERS OR OTHER SCHOOL EMPLOYEES AND THAT COLLECTS, MAINTAINS OR USES STUDENT PERSONAL INFORMATION. SCHOOL SERVICE DOES NOT INCLUDE A WEBSITE, MOBILE APPLICATION OR ONLINE SERVICE THAT IS DESIGNED AND MARKETED FOR USE BY INDIVIDUALS OR ENTITIES GENERALLY, EVEN IF THE WEBSITE, MOBILE APPLICATION OR ONLINE SERVICE IS ALSO MARKETED TO ELEMENTARY OR SECONDARY SCHOOLS.
2. "SCHOOL SERVICE PROVIDER" MEANS AN ENTITY THAT OPERATES A SCHOOL SERVICE.
3. "STUDENT" MEANS A STUDENT WHO IS ENROLLED IN A SCHOOL DISTRICT OR CHARTER SCHOOL IN THIS STATE.
4. "STUDENT PERSONAL INFORMATION" MEANS INFORMATION COLLECTED THROUGH A SCHOOL SERVICE THAT PERSONALLY IDENTIFIES AN INDIVIDUAL STUDENT OR INFORMATION COLLECTED AND MAINTAINED ABOUT AN INDIVIDUAL STUDENT AND THAT IS LINKED TO PERSONALLY IDENTIFIABLE INFORMATION.
5. "TARGETED ADVERTISING" MEANS SENDING ADVERTISEMENTS TO A STUDENT WHERE THE ADVERTISEMENT IS SELECTED BASED ON INFORMATION OBTAINED OR INFERRED FROM THAT STUDENT’S ONLINE BEHAVIOR, USAGE OF APPLICATIONS OR STUDENT PERSONAL INFORMATION. TARGETED ADVERTISING DOES NOT INCLUDE:
(a) ADVERTISING TO A STUDENT AT AN ONLINE LOCATION BASED UPON THAT STUDENT’S CURRENT VISIT TO THAT LOCATION WITHOUT THE COLLECTION AND RETENTION OF A STUDENT’S ONLINE ACTIVITiES OVER TIME.
(b) ADAPTIVE LEArning, personalized learning or customized education."
Renumber to conform
Page 16, after line 11, insert:
"Sec. 11. Short title
Section 9, as added by this act may be cited as the "Student User Privacy in Education Rights Act" or "S.U.P.E.R. Act."