Substitute House Bill 5469 - Student Data Privacy

• Requires written contracts between school boards and contractors handling student data, with mandatory provisions including data security standards, deletion procedures, compliance with FERPA, and notification procedures for breaches.

• Prohibits operators of educational websites and apps from using student data for targeted advertising, selling student information, or retaining data beyond contracted services without consent; allows limited use for adaptive learning and product improvement.

• Establishes breach notification requirements: contractors must notify school boards within 30 days for non-directory student information breaches and 60 days for other breaches; school boards must notify affected students and parents within 48 hours.

• Makes student-generated content the property of the student or parent/guardian, not the contractor or operator.

• Creates a task force to study student data privacy issues and submit recommendations by January 1, 2017, including examination of deletion requests, penalties for violations, employee training strategies, and development of compliance toolkits for school districts.