HB1934 Summary

• Adds new protections for student personally identifiable information (PII) in Arkansas K-12 schools and higher education institutions, requiring written consent from students or parents before disclosing PII to contractors, consultants, or third parties.

• Contractors accessing student PII must meet 13 specific requirements including direct departmental control, encryption standards based on HIPAA guidance, annual security audits, breach notification within 24-48 hours, and full financial liability for breach costs.

• Permits disclosure without consent only when entities meet all requirements and data is used for developing/validating tests, administering student aid, or improving instruction; requires public disclosure and legislative notification before such disclosures.

• Prohibits disclosure of student PII for commercial purposes including marketing, list compilation, product development, or profile creation without written consent, and limits retention of study data to 5 years after student enrollment ends.

• Authorizes the Attorney General to enforce the law and exempts the Division of Legislative Audit from restrictions on accessing records for audit purposes.