Student Personal Digital Information Protection Act.

2017
STATE OF WYOMING
17LSO-0052
ENGROSSED
2.1

SENATE FILE

NO.

SF0034

Student Personal Digital Information Protection Act.

Sponsored by:
Joint Education Interim Committee

A BILL

for

AN ACT relating to public education; prohibiting internet or online service providers from using, disclosing or compiling student data as specified; providing exceptions; imposing duties; specifying applicability; providing definitions; and providing for an effective date.

Be It Enacted by the Legislature of the State of Wyoming:

Section 1
.

W.S. 21
‑
25
‑
101 through 21
‑
25
‑
106
are
created to read:

CHAPTER 25
Student personal
DIGITAL
information protection act

21
‑
25
‑
101
.

Short title.

This act shall be known and may be cited as the "Student Personal
Digital
Information Protection Act
.
"

21
‑
25
‑
102
.

Definitions.

(a)

As used in this act:

(
i
)

"Preschool through grade twelve (12) purposes" means activities that take place at the direction of an employee or agent of a public school
,
school district or
program
provider
or
that aid in the administration of
activities at the
public school
or program
including, but not limited to instruction in the classroom, administrative activities, preparing for postsecondary education or employment opportunities, collaboration between students, school personnel or parents or that are for the use and benefit of the public school
,
school district
or program
;

(ii)

"Program" includes
services
for students in preschool through grade twelve (12) which
are
primarily publicly funded including
developmental preschool,
child care and cooperative education programs;

(i
i
i)

"Operator" means any entity other than the state department of education, a school district
,
public school
or
program provider
to the extent that the entity:

(A)

Operates a website,
software,
service or application with actual knowledge the website,
software,
service or application is used for preschool through grade twelve (12) purposes and was designed and marketed for preschool through grade twelve (12) purposes; and

(B)

In operating the website,
software,
service or application for those purposes collects, maintains or uses student data in a digital or electronic format.

(i
v
)

"Student data" means any personally identifiable information of a student in preschool through grade twelve (12) who is enrolled in a Wyoming public school
or
p
rogram
that is collected and maintained at the individual student level in the state by an employee or agent of the state department of education, school district
,
public school
,
program provider

or by an operator, including but not limited to information that is:

(A)

Created or provided by a student or the student's parent or legal guardian to an employee or agent of the state department of education, school district
,
public school
,
program provider
or
to an operator in the course of the student's or the student's parent's or legal guardian's use of the operator's site,
software,
service or application for preschool through grade twelve (12) purposes;

(B)

Created or provided by an employee or agent of the school district
,
public school
or
program provider
, including to an operator in the course of the employee's or agent's use of the operator's site,
software,
service or application for preschool through grade twelve (12) purposes; or

(C)

Gathered by an operator through a site,
software,
service or application for preschool through grade twelve (12) purposes and identifies a student, including but not limited to information in the student's educational record or email, first and last name, home address, telephone number, email address or other
information that allows physical or online contact, discipline records, test results, special education data, juvenile
delinquency
records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings or geolocation information.

(v)

"Targeted advertising" means presenting advertisements to a student where the advertisement is selected based on information obtained or inferred from the student's online behavior, usage of applications or student data. "Targeted advertising" does not include advertisements presented to a student where the advertisement is selected based upon the student's current visit to or single search query on a site,
software,
service or application;

(v
i
)

"This act" means W.S. 21
‑
25
‑
101 through 21
‑
25
‑
106.

21
‑
25
‑
103
.

Acts by operators; prohibitions.

(a)

An operator shall not knowingly engage in any of the following activities without
verifiable
written or electronic consent from the student, if emancipated or eighteen (18) years of age or older, or the student's parent or legal guardian, if the student is an
unemancipated
minor:

(
i
)

Use
or gather for future use
student data to engage in behaviorally targeted advertising on the operator's site,
software,
service or application or target advertising on any other site,
software,
service or application when the targeting of the advertising is based upon information, including student data, state
‑
assigned student identifiers or other persistent unique identifiers, that the operator has acquired because of the use of the operator's site,
software,
service or application;

(ii)

Use information, including state
‑
assigned student identifiers or other persistent unique identifiers, created or gathered by the operator's site,
software,
service or application to amass a profile about a student
except in furtherance of preschool through grade twelve (12) purposes. For purposes of this paragraph, "amass a profile" does not include the collection and retention of account information that remains under the control of the student, parent, public school
,
school district
or
program provider
;

(iii)

Sell or trade student data. This prohibition does not apply to the purchase, merger or other type of acquisition of an operator by another entity, provided the operator or successor entity continues to be subject to the provisions of this act with respect to previously acquired student data; or

(iv)

Except as provided in W.S. 21
‑
25
‑
104(
a), disclose student data.

21
‑
25
‑
104
.

Acts by operators; exceptions.

(a)

An operator may
use or
disclose student data without explicit consent required under this act if the
use or
disclosure is made:

(
i
)

In furtherance of the preschool through grade twelve (12) purposes of the operator's site,
software,
service or application, provided that the
operator shall
:

(A)

Prohibit the recipient of the student data from
further disclos
ing
the student data except to allow or improve the operability and functionality within that student's classroom
,
public school
or program
; and

(B)

Require the recipient of the student data to
comply with the requirements of this act and not use the student data in violation of this act.

(ii)

To comply with federal or state law that requires the operator to disclose the student data and the operator complies with applicable requirements of federal and state law in protecting and disclosing that data;

(iii)

To respond to or participate in judicial process;

(iv)

To protect the safety, security and integrity of the operator's site,
software,
service or application and any other users of the site,
software,
service or application;

(v)

To a service provider, provided that the operator shall:

(A)

Prohibit the service provider from using any student data for any purpose other than providing the contracted service to, or on behalf of, the operator;

(B)

Require the service provider to impose the same restrictions in this paragraph on its own service providers; and

(C)

Require the service provider to implement and maintain reasonable security procedures and practices as provided in W.S. 21
‑
25
‑
105.

(vi)

For an educational, public health or employment purpose requested by the student, if emancipated or eighteen (18) years of age or older, or the student's
parent or legal guardian, if the student is an
unemancipated
minor, provided that the student data is not otherwise used or further disclosed by the operator for any purpose;

(vii)

For legitimate research purposes:

(A)

Required by federal or state law and subject to the restrictions under applicable federal and state law; or

(B)

Allowed by federal or state law and under the direction of the state department of education, school district
,
public school
or
program provider
.

(viii)

To a state agency, school district
,
public school
or
program provider

for preschool through grade twelve (12)

purposes, as permitted by federal or state law.

(b)

Nothing in this act prohibits an operator from using student data under the following circumstances:

(
i
)

For maintaining, delivering, developing, supporting, evaluating, improving or diagnosing the operator's site,
software,
service or application;

(ii)

For adaptive learning or customized student learning purposes;

(
iii
)

For recommending additional content or services related to an educational, learning or employment opportunity to students within a public school
service's

or program
service's

site,
software,
service or application, provided that the recommendation is not determined in whole or in part by payment or other consideration from a third party;

(
i
v)

To respond to a student's search query or request for information or feedback, provided that the response is not determined in whole or in part by payment or other consideration from a third party;

(v)

To ensure legal or regulatory compliance or by retaining student data for legal or regulatory compliance
; or
(vi)

To identify for the student institutions of higher education or scholarship providers that are seeking students who meet specific criteria, regardless of whether the identified institutions of higher education or scholarship providers provide payment or other consideration to the operator.

21
‑
25
‑
105
.

Duties of operators.

(a)

An operator shall:

(
i
)

Implement and maintain reasonable security procedures and
privacy
practices appropriate to the nature of the student data to protect the data from unauthorized access, destruction, use, modification or disclosure; and

(ii)

Certify the deletion of
student data within a reasonable time not to exceed
ninety (90)
days if the school district
, p
ublic school
or program provider
having control of the data requests deletion.

21
‑
25
‑
106
.

Applicability; limitations of duties.

(a)

This act shall not be construed to limit the authority of a law enforcement agency to obtain any content or student data from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction.

(b)

This act shall not apply to internet websites, online services, online applications or mobile applications used, designed and marketed for purposes other than preschool through grade twelve (12) purposes.

(c)

This act shall not be construed to limit internet service providers from providing internet connectivity to school districts, public schools
, program providers
or students and their families.

(d)

This act shall not be construed to prohibit an operator from marketing educational products directly to a student's parent so long as the marketing did not result from the use of student data obtained without parental consent by the operator through the provision of services covered under this act.

(e)

This act shall not be construed to impose a duty upon a provider of an electronic store, gateway, marketplace or other means of purchasing or downloading software or applications to review or enforce compliance of this act on those applications or software.

(f)

This act shall not be construed to impose a duty upon a provider of an interactive computer service, as defined in section 230 of title 47 of the United States Code, to review or enforce compliance with this act by third
‑
party content providers.

(g)

This act shall not be construed to impede the ability of a student or a student's parent or legal guardian to download, transfer or otherwise save or maintain the student's or the student's parent's or legal guardian's own student data or documents.

(h)

Nothing in this act shall prevent the state department of education, a school district
, a program provider
or an employee or agent
thereof

from recommending, directly or by a product or service, any educational materials, online content, services or other products to a
student or the student's family if the department
,
school district
or program provider
determines that the products will benefit the student and the department, district
, program provider
or employee or agent
thereof
does not receive compensation for developing, enabling or communicating the recommendations.

Section 2
.

This act is effective July 1, 2017
.

(END)

1
SF0034