SB2018 - Student Data Privacy Act

• Requires school districts to enter into written contracts with any contractor or operator that accesses student information, records, or student-generated content beginning October 1, 2017.

• Contracts must include provisions protecting student data ownership, limiting use to authorized purposes, establishing security procedures, prohibiting targeted advertising, and detailing breach notification procedures.

• Prohibits operators from selling or trading student data, engaging in targeted advertising based on student information, or collecting data for purposes other than school-authorized uses.

• Requires contractors to notify school boards within 30 days of breaches involving student information and within 60 days for directory information or student records; school boards must notify affected students and parents within 48 hours of receiving notice.

• Establishes a task force to study student data privacy issues including deletion procedures, notification methods, penalties for violations, and best practices for data security, with a report due to the General Assembly by January 1, 2018.