Data privacy and security continue to be a priority in education, especially among parents and students who wish to minimize risks of unintentional or malicious disclosures of student information. Our Policy Team at Education Commission of the States recently discussed how state leaders might approach issues of data privacy and how efforts to ensure student safety and measure student mental health intersect with efforts to enhance data security.
This focus has carried over into legislative activity as a majority of introduced data legislation we’ve tracked over the last two years included a focus on data privacy. In 2022, we tracked 59 introduced bills related to education data systems, and 38 of those fell into our “Student Records and Data Privacy” category.
Within the bucket of data privacy, state policymaker approaches varied. Some states made broad adjustments to data privacy policies, including adjusting definitions of student data, altering the scope of data collection or regulating interactions with third party contractors. Other legislation attempted to grant protections to students and their data when using personal or school technology. Finally, parental control appeared as a theme again this year.
The following legislative roundup provides examples of bills in each of these trending categories:
- Data privacy adjustments.
- Technology.
- Parental control.
Data Privacy Adjustments
Approaches to data use, governance and privacy fluctuate with advances in technology, growth in the types of student data collected and changes to education policy broadly. To maintain strong data security, data governance policy must be adaptable to meet these ever-changing needs. As such, state leaders considered adjustments to their data privacy structures to help improve data use and security.
Maryland H.B. 769 / S.B. 325 (enacted) expands the definitions of “covered information,” “operator,” “persistent unique identifier” and “targeted advertising” to provide increased safeguards for student data by including new types of data and data users under categories that are protected from access and sharing.
Utah S.B. 226 (enacted) requires postsecondary institutions to adopt policies to protect student data, including designating a higher education privacy officer to verify compliance with student privacy laws.
Technology
A 2021 report from the Institute of Education Sciences found that “45% of schools reported having a computer for each student” and “15% let students in all grades take school-provided computers home.” Since potentially sensitive student information is being stored on these devices, some states considered policies to protect student information by securing the technology that such information is collected, maintained or shared on.
Rhode Island H.B. 7563 / S.B. 2036 (pending) would prohibit schools or districts from accessing or using location data to track a student’s personal or school-issued device, except in limited circumstances, and would limit access to audio or video functions on a student’s device.
Parental Control
A growing conversation has started across several states about increasing parental rights in education. One subset of that conversation examines parental rights as it relates to the collection, use and sharing of student data.
New Jersey A. 3800 (pending) would require public schools and districts to obtain written parental consent before collecting biometric data or other sensitive student information.
North Carolina H.B. 1129 (pending) would codify a set of rights for parents and guardians of students, including the right to “access and review all data records,” have “access to transparent data about school and district academic performance,” and have “access to information, data and statistics as to the successes, shortcomings, or failures of each school his or her child is allowed to attend.”
State leaders continue to explore ways to maximize the use of student data collected to help evaluate learning and growth, especially in the wake of the COVID-19 pandemic. With greater investments in data systems and technology comes greater challenges for protecting student information. In 2023, we expect legislators to continue to seek a balance between growing state data systems and adapting to new and continued risks to data security and privacy.
