HB 1828 Summary

• Creates new protections for student personally identifiable information (PII) by amending Arkansas Code Title 6, Chapter 18 (K-12 education) and Chapter 60 (higher education) with identical requirements for both sectors.

• Prohibits disclosure of student PII to contractors, consultants, or outsourced service providers without written consent of the student or parent/guardian (for students under 18) unless the contractor meets 13 specific requirements including direct control, encryption standards, annual security audits, and breach notification within 48 hours for suspected breaches and 24 hours for actual breaches.

• Requires departments and school districts to publicly disclose on their websites and notify legislative leadership within 48 hours of any contract involving student PII disclosure, including data repository location, data use purpose, entity policies, and student access procedures.

• Prohibits disclosure of student PII for commercial purposes (marketing, list compilation, product development, or profile creation) without written consent; allows limited disclosure without consent only for predictive testing, student aid, or instruction improvement if contractor requirements are met.

• Authorizes the Attorney General to enforce the law and exempts the Division of Legislative Audit from these restrictions; restricts data retention for research to 5 years post-enrollment.