SF 2844 Bill Summary

• Establishes comprehensive data privacy protections for student information stored in school information systems, including restrictions on collection, use, sharing, and retention of personally identifiable student information.

• Requires student information system (SIS) providers to implement security measures, establish data breach notification procedures (within 30 days), and permanently delete all student data within 90 days of contract termination unless otherwise agreed.

• Mandates "opt-in agreements" signed by parents or students that specifically identify what student data can be accessed and for what educational purposes, with prohibitions on general data access authority and student profiling.

• Requires schools to delete all student data within one year of graduation, withdrawal, or expulsion, except for names, Social Security numbers, transcripts, and records subject to ongoing legal proceedings or required by law.

• Provides enforcement through private right of action for damages including actual damages, mental pain and suffering, and attorney fees; school employees violating provisions subject to disciplinary proceedings.