Since March, at least 10 states—Arizona, Connecticut,
Colorado, Hawaii, Kansas, New Hampshire, Tennessee, Utah, Virginia,
and West Virginia—have added laws to protect the privacy of
Arizona: On May 18,
the Arizona governor approved H.B. 2088, which requires informed consent
before children can be subjected to invasive surveys. The bill
requires schools to obtain written informed consent from parents
before administering any survey that solicits personal information
from students. The bill became effective on August 6.
Connecticut: On June
9, the Connecticut governor signed into law H.B. 5469, which requires businesses that
collect and maintain educational records to take steps to safeguard
student data and to refrain from using it for targeted advertising
purposes. The bill is specifically targeted at educational software
and services contractors, as well as website, online services, and
mobile applications operators. The bill becomes effective on
Colorado: On June
10, the Colorado governor signed H.B. 1423, which adds to the existing Colorado
laws pertaining to student data security by adopting additional
duties with which the state Board of Education, Department of
Education, school districts, boards of cooperative services, and
charter schools must comply to increase the transparency and
security of student information. The bill became effective on
Hawaii: On May 2,
the Hawaii governor signed S.B. 2607 into law, which limits the ways in
which the operator of a website, online service, online
application, or mobile application working with the Department of
Education can use student data. The bill took effect upon its
Kansas: On May 6,
Kansas enacted H.B. 2008, which creates the Student Online
Personal Protection Act. The bill prohibits an operator of an
educational online product from knowingly engaging in targeted
advertising on the operator's educational online product, using
information to create a profile about the student, selling or
renting student information to a third party, and disclosing
student information, except as provided. The law became effective
on July 1.
NewHampshire: On May 5, the New Hampshire governor
signed H.B. 1497 into law, which requires school
districts to destroy personal information of students following the
completion and verification of certain tests and gives students
taking college entrance exams the option to have all of their
personal information destroyed by the testing entity following the
completion and verification of the test. The bill became effective
on July 4.
Tennessee: On April
12, the Tennessee governor signed H.B. 1931 into law, which prohibits an operator
of an internet website, service, or application primarily used for
K–12 school purposes from engaging in targeted advertising
based on any information the operator acquired because of the
website, service, or application, using information created or
gathered by the operator's site, service, or application to
create a profile about a student except in furtherance of
K–12 school purposes, and selling or renting a student's
information. The bill became effective on July 1.
Utah: On March 23,
the Utah governor signed H.B. 358 into law, which enacts the Student
Data Privacy Act, provides for student data protection governance
at the state and local levels, enacts requirements for data
protection and maintenance by state and local education entities
and third-party contractors, provides for penalties, and enacts a
requirement for notice given to a parent or guardian before a
student is required to take a certain type of survey. The bill
became effective on May 10.
Virginia: On March
11, the Virginia governor signed H.B.
749, which makes several changes to the provisions relating to
the protection of student personal information by school service
providers, including defining targeted advertising and clarifying
that other provisions of law do not prohibit school service
providers from performing certain acts, including disclosing
student personal information to ensure legal or regulatory
compliance. The bill became effective on July 1.
WestVirginia: On March 25, the West Virginia governor
signed H.B. 4261 into law, which prohibits the West
Virginia Department of Education from transferring confidential
student information or certain redacted data to any federal, state,
or local agency or other person or entity (subject to certain
exceptions); allows the ACT or the College Board to use certain
information; requires written consent if information classified as
confidential is necessary; and requires that the consent contain a
detailed list of the confidential information required and the
purpose of its requirement. The bill became effective in June.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
The Radio Shack bankruptcy case raised a fundamental question regarding the sale of personally identifiable customer information: Can it be done? The answer is "Probably". (You expected anything else?)
On 28 July 2016, the European Court of Justice rendered a decision in a dispute between an Austrian Consumer Protection organization known as VKI and Amazon EU Sàrl, a subsidiary of Amazon registered in Luxembourg.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).