ID H0411

Amends Idaho Code Section 33-133 to revise definitions and provisions governing student education data, including clarifying terminology and renumbering subsections for technical corrections.

Prohibits collection of certain sensitive student data including juvenile delinquency records, medical and health records, social security numbers, biometric information, gun ownership records, sexual orientation, and religious affiliation (except for special needs students, affective computing data may be collected).

Requires state board of education to create and maintain a publicly available data inventory, develop privacy policies compliant with FERPA, establish data security standards, and submit annual reports to the legislature by January 15 detailing new data collections, federal requirement changes, and security audit results.

Restricts student data transfers outside Idaho with limited exceptions for out-of-state transfers, higher education enrollment, voluntary program participation, vendor contracts, and migrant student tracking.

Establishes civil penalties up to $50,000 per violation for vendors or school districts that violate data privacy provisions; requires school districts to adopt and post a model data governance policy on their websites or face civil liability.

Effective date: July 1, 2024, with emergency declaration.