HB 15-1199: Student and Teacher Data Privacy and Security Act

• Creates new data privacy protections for Colorado schools by limiting collection of student and teacher data to specific categories without written parental or employee consent, including prohibition on collecting psychological/emotional data, biometric records, and affective computing data.

• Establishes transparency requirements for education institutions and state agencies to publicly disclose what personally identifiable information they maintain, how it is used and stored, procedures for security breaches, and how to access or challenge records.

• Prohibits commercial use of education data, predictive modeling, video classroom monitoring without consent, interagency disclosure to non-education agencies, and most interstate/federal disclosures except in limited circumstances with written agreements.

• Sets strict requirements for third-party contractors handling student data, including encryption standards, annual security audits, immediate breach reporting, payment of breach costs, and ability to destroy data upon request.

• Requires schools to destroy student education records within 5 years of graduation or withdrawal (except records needed to verify graduation completion) and establishes penalties of $1,000 for first violation, $5,000 for second, and $10,000 for subsequent violations.