Connecticut Seal

General Assembly

Amendment

 

January Session, 2015

LCO No. 9353

   
 

*HB0701709353HDO*

Offered by:

 

REP. GENTILE, 104th Dist.

REP. ROJAS, 9th Dist.

 

To: Subst. House Bill No. 7017

File No. 686

Cal. No. 451

"AN ACT CONCERNING STUDENT DATA PRIVACY. "

In line 61, strike "and"

In line 65, strike ". " and insert "; " in lieu thereof

After line 65, insert the following:

"(9) A choice of law provision that states that the laws of the state of Connecticut shall govern the rights and duties of the contractor and the local or regional board of education, the State Board of Education or the Department of Education; and

(10) A statement that if any provision of the contract or the application of the contract is held invalid by a court of competent jurisdiction, the invalidity does not affect other provisions or applications of the contract which can be given effect without the invalid provision or application. "

Strike lines 70 and 71 in their entirety and insert "(d) Any provision of any contract that conflicts with any provision of this section shall be void. " in lieu thereof

After line 71, insert the following:

"(e) Any contract that does not include a provision required by subsection (b) of this section shall be void, provided the local or regional board of education, the State Board of Education or the Department of Education has given reasonable notice to the contractor and the contractor has failed within a reasonable time to amend the contract to include the provision required by subsection (b) of this section.

(f) Not later than five business days after executing a contract pursuant to this section, a local or regional board of education shall provide notice to any student, parent or legal guardian of a student affected by the contract. The notice shall state that the contract was executed and provide a brief description of the contract and the purpose of the contract. "

Strike section 2 it its entirety and insert the following in lieu thereof:

"Sec. 2. (NEW) (Effective January 1, 2016) (a) For the purposes of this section:

(1) "Operator" means any person who (A) operates an Internet web site, online service or mobile application with actual knowledge that such Internet web site, online service or mobile application is used for school purposes and was designed and marketed for school purposes, and (B) collects, maintains or uses student information;

(2) "School purposes" means purposes that customarily take place at the direction of a teacher or a local or regional board of education, or aid in the administration of school activities, including, but not limited to, instruction in the classroom, administrative activities and collaboration among students, school personnel or parents or legal guardians of students;

(3) "Student information" means personally identifiable information regarding a student that is (A) created or provided by a student, parent or legal guardian of a student, to the operator in the course of the student, parent or legal guardian using the operator's Internet web site, online service or mobile application for school purposes, (B) created or provided by an employee or agent of a local or regional board of education to an operator for school purposes, or (C) gathered by an operator through the operation of the operator's Internet web site, online service or mobile application and identifies a student, including, but not limited to, information in the student's records or electronic mail account, first or last name, home address, telephone number, date of birth, electronic mail address, discipline records, test results, grades, evaluations, criminal records, medical records, health records, Social Security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious affiliations, text messages, documents, student identifiers, search activity, photographs or voice recordings;

(4) "Student" means a child that is a resident of the state of Connecticut and enrolled in grades kindergarten to twelve, inclusive, in public school under the jurisdiction of a local or regional board of education;

(5) "De-identified student information" means any student information that has been altered to prevent the identification of an individual student; and

(6) "Targeted advertising" means presenting an advertisement to a student where the selection of the advertisement is based on student information or inferred from the usage of the operator's Internet web site, online service or mobile application by such student.

(b) An operator shall (1) implement and maintain reasonable security procedures and practices, in accordance with current industry standards, to protect student information from unauthorized access, destruction, use, modification or disclosure, and (2) delete a student's information if a student, parent or legal guardian of a student or the local or regional board of education requests deletion of such student information.

(c) An operator shall not knowingly:

(1) Engage in targeted advertising on the operator's Internet web site, online service or mobile application, or on any other Internet web site, online service or mobile application;

(2) Use student information to create a profile of a student, except in furtherance of school purposes;

(3) Sell student information, unless the sale is part of the purchase, merger or acquisition of an operator by a successor operator and the operator and successor operator continue to be subject to the provisions of this section regarding student information; and

(4) Disclose student information, unless the disclosure is made (A) in furtherance of school purposes of the Internet web site, online service or mobile application, provided the recipient of the student information uses such student information to improve the operability and functionality of the Internet web site, online service or mobile application and complies with subsection (b) of this section; (B) to ensure compliance with federal and state law; (C) in response to judicial process; (D) to protect the safety of users or others, or the security of the Internet web site, online service or mobile application; or (E) to an entity hired by the operator to provide services for the operator's Internet web site, online service or mobile application, provided the operator contractually (i) prohibits the entity from using student information for any purpose other than providing the contracted service to, or on behalf of, the operator, (ii) prohibits the entity from disclosing student information provided by the operator to subsequent third parties, and (iii) requires the entity to comply with subsection (b) of this section.

(d) An operator may use student information (1) to maintain, support, evaluate or diagnose the operator's Internet web site, online service or mobile application, or (2) for adaptive learning purposes or customized student learning.

(e) An operator may use de-identified student information (1) to develop or improve the operator's Internet web site, online service or mobile application, or other Internet web sites, online services or mobile applications owned by the operator, or (2) to demonstrate or market the effectiveness of the operator's Internet web site, online service or mobile application.

(f) An operator may share aggregated de-identified student information for the improvement and development of Internet web sites, online services or mobile applications for school purposes.

(g) Nothing in this section shall (1) limit the ability of a law enforcement agency to obtain student information from an operator as authorized by law or pursuant to a court order, (2) limit the ability of a student, parent or legal guardian of a student to download, transfer or otherwise save or maintain student information, (3) impose a duty upon a provider of an interactive computer service, as defined in 47 USC 230, as amended from time to time, to ensure compliance with this section by third party information content providers, as defined in 47 USC 230, as amended from time to time, (4) impose a duty upon a seller or provider of online services or mobile applications to ensure compliance with this section with regard to such online services or mobile applications, (5) limit an Internet service provider from providing a student, parent or legal guardian of a student or local or regional board of education with the ability to connect to the Internet, (6) prohibit an operator from advertising other Internet web sites, online services or mobile applications that are used for school purposes to parents or legal guardians of students provided such advertising does not result from use of student information, or (7) apply to Internet web sites, online services or mobile applications that are designed and marketed for use by individuals generally, even if the account credentials created for an operator's Internet web site, online service or mobile application may be used to access Internet web sites, online services or mobile applications that are designed and marketed for use by individuals generally. "