SB2089 - Student Online Personal Protection Act of 2019

• Creates comprehensive student data privacy protections requiring written parental consent before sharing highly sensitive student information (criminal records, health information, immigration status, etc.) with operators of educational products and services.

• Prohibits operators from selling, leasing, or renting student data; using covered information for commercial purposes unrelated to school functions; or disclosing data to third parties without school authority contracts that include specific privacy and security safeguards.

• Requires operators to notify school authorities of data breaches within 72 hours and reimburse schools for all costs related to breach investigation, remediation, credit monitoring, and legal fees resulting from operator negligence.

• Establishes school authority duties including posting contracts and data practices on websites, designating a privacy officer, maintaining security procedures, and notifying parents of breaches within 72 hours with specified information about impacts and consumer protection resources.

• Creates Student Data Protection Oversight Committee with 18 members including students, parents, educators, technology experts, and civil rights advocates to review data privacy laws and submit annual recommendations to the General Assembly; provides private right of action for violations with liquidated damages of $1,000-$5,000 per violation plus attorney fees.