Student data privacy and transparency.

2016
State of Wyoming
16LSO-0183
ENGROSSED
2.1

SENATE FILE

NO.

SF0014

Student data privacy and transparency.

Sponsored by:
Joint Education Interim Committee

A BILL

for

AN ACT relating to education; prohibiting school districts from accessing students' digital information accounts as specified; providing for criminal penalties; amending requirements of state data security plan to ensure privacy of student data collected; requiring policies for the collection, access, security and use of student data by school districts; accordingly imposing duties; and providing for an effective date.

Be It Enacted by the Legislature of the State of Wyoming:

Section 1
.

W.S. 21
‑
3
‑
132 is created to read:

21
‑
3
‑
132
.

Student digital information privacy; prohibited acts; exceptions; penalties.

(a)

No officer or employee of a school district organized within this state shall:

(i)

Require or request a student or prospective student to disclose or to provide access to a digital information account through the student's or prospective student's username, password or other means of authentication that provides access;

(ii)

Require or request a student or prospective student to access a digital information account in the presence of any officer or employee of the school district in a manner that enables the officer or employee to observe the contents of the digital information account;

(iii)

Compel a student or prospective student to add anyone to the student's or prospective student's list of contacts associated with a digital information account or require, request or cause a student or prospective student to change the privacy settings associated with a digital information account;

(iv)

Expel
, discharge, discipline, fail or refuse to admit or otherwise penalize or threaten a student or prospective student for refusing to disclose information or to take action specified in this section;

(v)

Require or request a student or prospective student to waive or limit any protection granted under this section.

(b)

Nothing in this section shall prohibit an officer or employee of a school district from:

(i)

Conducting an investigation, without requiring or requesting access to a digital information account through username, password or other means of authentication, for the purpose of ensuring compliance with applicable law or school policies against student misconduct based on the receipt of specific information about activity associated with a student's digital information account;

(ii)

Requesting or receiving written or electronic consent from a student or prospective student,
if emancipated or eighteen (18) years of age or older, or the student's or prospective student's parent or legal guardian if the student or prospective student is an unemancipated minor, to observe the contents of a digital information account, without requiring or requesting access to the account through username, password or other means of authentication;

(iii)

Viewing, accessing or utilizing information about a student or prospective student that is publicly available.

(c)

Nothing in this section shall apply to an account opened, created or provided by a school district if the student has been provided advance notice that the account may be monitored at any time by an officer or employee of the school district.

(d)

This section does not create a duty for an officer or employee of a school district to search or monitor the activity of a student's or prospective student's digital information account.

(e)

Any officer or employee of a school district violating the provisions of this section is guilty of a misdemeanor punishable by a fine of not more than
two hundred fifty
dollars ($
25
0.00) for the first violation and
one
thousand dollars ($
1
,
0
00.00) for each subsequent violation.

(f)

For purposes of this section "digital information account" means an electronic service or account used to communicate or store digital assets.

Section 2
.

W.S. 21
‑
2
‑
202(a)(xxxiv)(intro)
, (H), (J)
,
by creating new subparagraph (K)
and

by
creating
a
new paragraph (xxxvii)

and
21
‑
3
‑
110(a) by creating new paragraphs (xxxv) and (xxxvi) are amended to read:

21
‑
2
‑
202
.

Duties of the state superintendent.

(a)

In addition to any other duties assigned by law, the state superintendent shall:

(xxxiv)

With the department of enterprise technology services, establish criteria for the collection,
storage, management and reporting of department of education data
related
including, but not limited
to teacher certification, statewide education accountability and assessment and the administration of the school finance system. In carrying out this paragraph, the state superintendent and the department of enterprise technology services shall develop a data security plan that includes:

(H)

Prohibition of the sale

or trade
of student data to pri
vate entities or organizations;

and

(J)

All personally identifiable student information being reported to the department of education or the department of enterprise technology by a student's Wyoming student record identification and locator number as issued by the department of education
;
.

and

(K)

Standards and protocols to remove personally identifiable information to conduct data collection and analysis without disclosing the identity
of the student
whose data is being collected and used.

(xxxvii)

In consultation with the department of enterprise technology, the department of audit and school districts, establish and maintain guidelines for school districts for the collection, access, security and use of student data by school districts. The guidelines shall, at a minimum, be in compliance with the federal Family Educational Rights and Privacy Act and other relevant federal and state laws and include the following:

(A)

Authorization and authentication mechanisms for accessing student data;

(B)

Administrative, physical and logical security safeguards, including employee training and data encryption;

(C)

Privacy and security compliance standards;

(D)

Processes for identification of and response to data security incidents, including breach notification and mitigation procedures;

(E)

Standards for retention and destruction of student data.

21
‑
3
‑
110
.

Duties of boards of trustees.

(a)

The board of trustees in each school district shall:

(xxxv)

Adopt and enforce a policy regarding the collection, access, security and use of student data in accordance with guidelines established by the state superintendent under W.S. 21
‑
2
‑
202(a)(xxxvii)
;

(xxxvi)

At a minimum, ensure compliance with W.S. 21
‑
3
‑
132.

Section
3
.

This
act is effective July 1,
201
6
.

(END)

1
SF0014