Machine-extracted text of a publicly
posted document, provided for reference and search. The original document at
the link above is authoritative.
Substitute House Bill No. 5444
Public Act No. 18-125
AN ACT CONCERNING REVISIONS TO THE STUDENT DATA
PRIVACY ACT.
Be it enacted by the Senate and House of Representatives in General
Assembly convened:
Section 1. (NEW) (Effective from passage) The Commission for
Educational Technology shall develop a uniform student data privacy
terms-of-service agreement addendum that may be used in contracts
entered into pursuant to section 10-234bb of the general statutes, as
amended by this act. The provisions of such addendum shall conform
to the requirements for a contract described in said section. The
commission shall make such addendum available on its Internet web
site, or in any online registry maintained by the commission for
contractors and operators, as those terms are defined in section 10-
234aa of the general statutes, and local and regional boards of
education.
Sec. 2. Section 10-234bb of the 2018 supplement to the general
statutes is repealed and the following is substituted in lieu thereof
(Effective July 1, 2018):
(a) On and after July 1, 2018, a local or regional board of education
shall enter into a written contract with a contractor any time such local
or regional board of education shares or provides access to student
Substitute House Bill No. 5444
information, student records or student-generated content with such
contractor. Each such contract shall include, but need not be limited to,
the following:
(1) A statement that student information, student records and
student-generated content are not the property of or under the control
of a contractor;
(2) A description of the means by which the local or regional board
of education may request the deletion of any student information,
student records or student-generated content in the possession of the
contractor that is not (A) otherwise prohibited from deletion or
required to be retained under state or federal law, or (B) stored as a
copy as part of a disaster recovery storage system and that is (i)
inaccessible to the public, and (ii) unable to be used in the normal
course of business by the contractor, provided such local or regional
board of education may request the deletion of any such student
information, student records or student-generated content if such copy
has been used by the operator to repopulate accessible data following a
disaster recovery;
(3) A statement that the contractor shall not use student
information, student records and student-generated content for any
purposes other than those authorized pursuant to the contract;
(4) A description of the procedures by which a student, parent or
legal guardian of a student may review personally identifiable
information contained in student information, student records or
student-generated content and correct erroneous information, if any, in
such student record;
(5) A statement that the contractor shall take actions designed to
ensure the security and confidentiality of student information, student
records and student-generated content;
Public Act No. 18-125 2 of 13
Substitute House Bill No. 5444
(6) A description of the procedures that a contractor will follow to
notify the local or regional board of education, in accordance with the
provisions of section 10-234dd, when there has been an unauthorized
release, disclosure or acquisition of student information, student
records or student-generated content;
(7) A statement that student information, student records or
student-generated content shall not be retained or available to the
contractor upon [completion] expiration of the [contracted services
unless] contract between the contractor and a local or regional board of
education, except a student, parent or legal guardian of a student
[chooses] may choose to independently establish or maintain an
electronic account with the contractor after the expiration of such
contract for the purpose of storing student-generated content;
(8) A statement that the contractor and the local or regional board of
education shall ensure compliance with the Family Educational Rights
and Privacy Act of 1974, 20 USC 1232g, as amended from time to time;
(9) A statement that the laws of the state of Connecticut shall govern
the rights and duties of the contractor and the local or regional board
of education; and
(10) A statement that if any provision of the contract or the
application of the contract is held invalid by a court of competent
jurisdiction, the invalidity does not affect other provisions or
applications of the contract which can be given effect without the
invalid provision or application.
(b) All student-generated content shall be the property of the
student or the parent or legal guardian of the student.
(c) A contractor shall implement and maintain security procedures
and practices designed to protect student information, student records
and student-generated content from unauthorized access, destruction,
Public Act No. 18-125 3 of 13
Substitute House Bill No. 5444
use, modification or disclosure that, based on the sensitivity of the data
and the risk from unauthorized access, (1) use technologies and
methodologies that are consistent with the guidance issued pursuant
to section 13402(h)(2) of Public Law 111-5, as amended from time to
time, (2) maintain technical safeguards as it relates to the possession of
student records in a manner consistent with the provisions of 45 CFR
164.312, as amended from time to time, and (3) otherwise meet or
exceed industry standards.
(d) A contractor shall not use (1) student information, student
records or student-generated content for any purposes other than
those authorized pursuant to the contract, or (2) personally identifiable
information contained in student information, student records or
student-generated content to engage in targeted advertising.
(e) Any provision of a contract entered into between a contractor
and a local or regional board of education on or after July 1, 2018, that
conflicts with any provision of this section shall be void.
(f) Any contract entered into on and after July 1, 2018, that does not
include (1) a provision required by subsection (a) of this section, or (2)
the terms-of-service agreement addendum described in section 1 of
this act, shall be void, provided the local or regional board of
education has given reasonable notice to the contractor and the
contractor has failed within a reasonable time to amend the contract to
include the provision required by subsection (a) of this section or the
terms-of-service agreement addendum.
(g) (1) Each local and regional board of education shall maintain and
update, as necessary, an Internet web site with information relating to
all contracts entered into pursuant to this section. Not later than five
business days after executing a contract pursuant to this section, a local
or regional board of education shall [provide electronic notice to any
student and the parent or legal guardian of a student affected by the
Public Act No. 18-125 4 of 13
Substitute House Bill No. 5444
contract] post notice of such contract on the board's Internet web site.
The notice shall [(1)] include the contract and (A) state that the contract
has been executed and the date that such contract was executed, [(2)]
(B) provide a brief description of the contract and the purpose of the
contract, and [(3)] (C) state what student information, student records
or student-generated content may be collected as a result of the
contract. [The local or regional board of education shall post such
notice and the contract on the board's Internet web site.]
(2) On or before September first of each school year, the board of
education shall electronically notify students and the parents or legal
guardians of students of the address of the Internet web site described
in this subsection.
(h) A local or regional board of education and a contractor may
include in any contract executed pursuant to this section, the uniform
student data privacy terms-of-service agreement addendum, described
in section 1 of this act, to satisfy the requirements of this section.
(i) A local or regional board of education shall not be required to
enter into a contract pursuant to this section if the use of an Internet
web site, online service or mobile application operated by a consultant
or an operator is unique and necessary to implement a child's
individualized education program or plan pursuant to Section 504 of
the Rehabilitation Act of 1973, as amended from time to time, and such
Internet web site, online service or mobile application is unable to
comply with the provisions of this section, provided (1) such Internet
web site, online service or mobile application complies with the Family
Educational Rights and Privacy Act of 1974, 20 USC 1232g, as
amended from time to time, and the Health Insurance Portability and
Accountability Act of 1996, P.L. 104-191, as amended from time to
time, (2) such board of education can provide evidence that it has
made a reasonable effort to (A) enter into a contract with such
consultant or operator to use such Internet web site, online service or
Public Act No. 18-125 5 of 13
Substitute House Bill No. 5444
mobile application, and (B) find an equivalent Internet web site, online
service or mobile application operated by a consultant or an operator
that complies with the provisions of this section, (3) the consultant or
operator complies with the provisions of section 10-234cc, as amended
by this act, for such use, and (4) the parent or legal guardian of such
child, and, in the case of a child with an individualized education
program, a member of the planning and placement team, sign an
agreement that (A) acknowledges such parent or legal guardian is
aware that such Internet web site, online service or mobile application
is unable to comply with the provisions of this section, and (B)
authorizes the use of such Internet web site, online service or mobile
application. A local or regional board of education shall, upon the
request of a parent or legal guardian of a child, provide the evidence
described in subdivision (2) of this subsection to such parent or legal
guardian.
Sec. 3. Section 10-234cc of the general statutes is repealed and the
following is substituted in lieu thereof (Effective July 1, 2018):
(a) An operator shall (1) implement and maintain security
procedures and practices that meet or exceed industry standards and
that are designed to protect student information, student records and
student-generated content from unauthorized access, destruction, use,
modification or disclosure, and (2) delete any student information,
student records or student-generated content within a reasonable
amount of time if a student, parent or legal guardian of a student or
local or regional board of education who has the right to control such
student information requests the deletion of such student information,
student records or student-generated content, unless (A) state or
federal law prohibits such deletion or otherwise requires the retention
of such student information, student records or student-generated
content, or (B) a copy of such student information, student records or
student-generated content is in the possession of the operator as part
Public Act No. 18-125 6 of 13
Substitute House Bill No. 5444
of a disaster recovery storage system and is inaccessible to the public
and unable to be used in the normal course of business by the
operator, provided such student, parent or legal guardian of a student
or local or regional board of education may request the deletion of any
such student information, student records or student-generated
content described in this subparagraph if such copy is used by the
operator to repopulate accessible data following a disaster recovery.
(b) An operator shall not knowingly:
(1) Engage in (A) targeted advertising on the operator's Internet web
site, online service or mobile application, or (B) targeted advertising on
any other Internet web site, online service or mobile application if such
advertising is based on any student information, student records,
student-generated content or persistent unique identifiers that the
operator has acquired because of the use of the operator's Internet web
site, online service or mobile application for school purposes;
(2) Collect, store and use student information, student records,
student-generated content or persistent unique identifiers for purposes
other than the furtherance of school purposes;
(3) Sell, rent or trade student information, student records or
student-generated content unless the sale is part of the purchase,
merger or acquisition of an operator by a successor operator and the
operator and successor operator continue to be subject to the
provisions of this section regarding student information; or
(4) Disclose student information, student records or student-
generated content unless the disclosure is made (A) in furtherance of
school purposes of the Internet web site, online service or mobile
application, provided the recipient of the student information uses
such student information to improve the operability and functionality
of the Internet web site, online service or mobile application and
Public Act No. 18-125 7 of 13
Substitute House Bill No. 5444
complies with subsection (a) of this section; (B) to ensure compliance
with federal or state law or regulations or pursuant to a court order;
(C) in response to a judicial order; (D) to protect the safety or integrity
of users or others, or the security of the Internet web site, online service
or mobile application; (E) to an entity hired by the operator to provide
services for the operator's Internet web site, online service or mobile
application, provided the operator contractually (i) prohibits the entity
from using student information, student records or student-generated
content for any purpose other than providing the contracted service to,
or on behalf of, the operator, (ii) prohibits the entity from disclosing
student information, student records or student-generated content
provided by the operator to subsequent third parties, and (iii) requires
the entity to comply with subsection (a) of this section; or (F) for a
school purpose or other educational or employment purpose requested
by a student or the parent or legal guardian of a student, provided
such student information is not used or disclosed for any other
purpose.
(c) An operator may use student information (1) to maintain,
support, improve, evaluate or diagnose the operator's Internet web
site, online service or mobile application, (2) for adaptive learning
purposes or customized student learning, (3) to provide
recommendation engines to recommend content or services relating to
school purposes or other educational or employment purposes,
provided such recommendation is not determined in whole or in part
by payment or other consideration from a third party, or (4) to respond
to a request for information or feedback from a student, provided such
response is not determined in whole or in part by payment or other
consideration from a third party.
(d) An operator may use de-identified student information or
aggregated student information (1) to develop or improve the
operator's Internet web site, online service or mobile application, or
Public Act No. 18-125 8 of 13
Substitute House Bill No. 5444
other Internet web sites, online services or mobile applications owned
by the operator, or (2) to demonstrate or market the effectiveness of the
operator's Internet web site, online service or mobile application.
(e) An operator may share aggregated student information or de-
identified student information for the improvement and development
of Internet web sites, online services or mobile applications designed
for school purposes.
(f) Nothing in this section shall be construed to (1) limit the ability of
a law enforcement agency to obtain student information, student
records or student-generated content from an operator as authorized
by law or pursuant to a court order, (2) limit the ability of a student or
the parent or legal guardian of a student to download, export, transfer
or otherwise save or maintain student information, student records or
student-generated content, (3) impose a duty upon a provider of an
interactive computer service, as defined in 47 USC 230, as amended
from time to time, to ensure compliance with this section by third-
party information content providers, as defined in 47 USC 230, as
amended from time to time, (4) impose a duty upon a seller or
provider of an electronic store, gateway, marketplace or other means
of purchasing or downloading software applications to review or
enforce compliance with this section on such software applications, (5)
limit an Internet service provider from providing a student, parent or
legal guardian of a student or local or regional board of education with
the ability to connect to the Internet, (6) prohibit an operator from
advertising other Internet web sites, online services or mobile
applications that are used for school purposes to parents or legal
guardians of students, provided such advertising does not result from
the operator's use of student information, student records or student-
generated content, or (7) apply to Internet web sites, online services or
mobile applications that are designed and marketed for use by
individuals generally, even if the account credentials created for an
Public Act No. 18-125 9 of 13
Substitute House Bill No. 5444
operator's Internet web site, online service or mobile application may
be used to access Internet web sites, online services or mobile
applications that are designed and marketed for school purposes.
Sec. 4. Section 10-234ee of the 2018 supplement to the general
statutes is repealed and the following is substituted in lieu thereof
(Effective July 1, 2018):
The Department of Education, in consultation with the Commission
for Educational Technology, shall provide written guidance to local
and regional boards of education concerning the implementation of the
Family Educational Rights and Privacy Act of 1974, 20 USC 1232g, as
amended from time to time, and the [provisions of] laws relating to
student data privacy, set forth in sections 10-234aa to 10-234dd,
inclusive, and section 1 of this act. Such written guidance shall include,
but need not be limited to, (1) a plain language explanation of how
such student data privacy laws are to be implemented, (2) information
about the uniform student data privacy terms-of-service agreement
addendum, described in section 1 of this act, and (3) how such
addendum may be incorporated into contracts executed pursuant to
section 10-234bb, as amended by this act.
Sec. 5. Section 5 of public act 16-189, as amended by section 4 of
public act 17-200, is repealed and the following is substituted in lieu
thereof (Effective from passage):
(a) There is established a task force to study issues relating to
student data privacy. Such study shall include, but not be limited to,
an examination of (1) when a parent or guardian of a student may
reasonably or appropriately request the deletion of student
information, student records or student-generated content that is in the
possession of a contractor or operator, (2) means of providing notice to
parents and guardians of students when a student uses an Internet
web site, online service or mobile application of an operator for
Public Act No. 18-125 10 of 13
Substitute House Bill No. 5444
instructional purposes in a classroom or as part of an assignment by a
teacher, (3) reasonable penalties for violations of the provisions of
sections 10-234bb to 10-234dd, inclusive, of the general statutes, as
amended by this act, such as restricting a contractor or operator from
accessing or collecting student information, student records or student-
generated content, (4) strategies in effect in other states that ensure that
school employees, contractors and operators are trained in data
security handling, compliance and best practices, (5) the feasibility of
developing a school district-wide list of approved Internet web sites,
online services and mobile applications, (6) the use of an
administrative hearing process designed to provide legal recourse to
students and parents and guardians of students aggrieved by any
violation of sections 10-234bb to 10-234dd, inclusive, of the general
statutes, as amended by this act, (7) the feasibility of creating an
inventory of student information, student records and student-
generated content currently collected pursuant to state and federal
law, (8) the feasibility of developing a tool kit for use by local and
regional boards of education to (A) improve student data contracting
practices and compliance, including a state-wide template for use by
districts, (B) increase school employee awareness of student data
security best practices, including model training components, (C)
develop district-wide lists of approved software applications and
Internet web sites, and (D) increase the availability and accessibility of
information on student data privacy for parents and guardians of
students and educators, and (9) any other issue involving student data
security that the task force deems relevant.
(b) The task force shall consist of the following members:
(1) Two appointed by the speaker of the House of Representatives,
one of whom is an operator, [pursuant to] as defined in section 10-
234aa of the general statutes and one of whom is an expert in
information technology systems;
Public Act No. 18-125 11 of 13
Substitute House Bill No. 5444
(2) Two appointed by the president pro tempore of the Senate, one
of whom is a representative or member of the Connecticut Education
Association and one of whom is an attorney with expertise in
Connecticut school law;
(3) Two appointed by the majority leader of the House of
Representatives, one of whom is a representative of a contractor,
[pursuant to] as defined in section 10-234aa of the general statutes and
one of whom is an expert in information technology systems;
(4) Two appointed by the majority leader of the Senate, one of
whom is a representative or member of the Connecticut Parent Teacher
Association and one of whom is a representative or member of the
American Federation of Teachers;
(5) Two appointed by the minority leader of the House of
Representatives, one of whom is a student privacy advocate and one of
whom is a representative or member of the Connecticut Association of
Boards of Education;
(6) Two appointed by the minority leader of the Senate, one of
whom is a representative of the Connecticut Association of School
Administrators and one of whom is a representative or member of the
Connecticut Association of Public School Superintendents;
(7) The Attorney General, or the Attorney General's designee; [and]
(8) The Commissioner of Education, or the commissioner's designee;
[.] and
(9) The executive director of the Connecticut Association of Schools,
or the executive director's designee.
(c) All appointments to the task force shall be made not later than
thirty days after the effective date of this section. Any vacancy shall be
Public Act No. 18-125 12 of 13
Substitute House Bill No. 5444
filled by the appointing authority.
(d) The speaker of the House of Representatives and the president
pro tempore of the Senate shall select the chairpersons of the task force
from among the members of the task force. Such chairpersons shall
schedule the first meeting of the task force, which shall be held not
later than sixty days after the effective date of this section.
(e) The administrative staff of the joint standing committee of the
General Assembly having cognizance of matters relating to general
law shall serve as administrative staff of the task force.
(f) Not later than January 1, [2018] 2019, the task force shall submit a
report on its findings and recommendations to the joint standing
committee of the General Assembly having cognizance of matters
relating to general law and education, in accordance with the
provisions of section 11-4a of the general statutes. The task force shall
terminate on the date that it submits such report or January 1, [2018]
2019, whichever is later.
Sec. 6. (NEW) (Effective July 1, 2018) For the school year commencing
July 1, 2018, and each school year thereafter, each local or regional
board of education shall annually submit a report to the Commission
for Educational Technology concerning the use of Internet web sites,
online services or mobile applications without a contract pursuant to
subsection (i) of section 10-234bb of the general statutes, as amended
by this act. Such report shall indicate whether or not any such Internet
web sites, online services or mobile applications are being so used,
and, if so, a list of all such Internet web sites, online services or mobile
applications.
Approved June 7, 2018
Public Act No. 18-125 13 of 13