HF1507 - Student Data Privacy Act Summary

• Establishes written procedures and security safeguards for public educational agencies and institutions to protect educational data stored in technology systems, including requiring authorization for access and maintaining log-of-use records for at least one year.

• Requires annual training for administrative staff, IT directors, teachers, and other individuals with access to educational data on applicable privacy laws including FERPA and state provisions.

• Imposes restrictions on technology providers prohibiting them from selling or disseminating student data for commercial purposes, requiring data destruction within 30 days of contract expiration, and mandating security procedures and log-of-use records similar to those for educational agencies.

• Restricts access to school-issued device features including location tracking, audio/visual recording, and student interactions unless the student consents for educational purposes, there is a judicial warrant, the device is reported stolen, there is an imminent safety threat, or it is necessary to enforce acceptable-use policies.

• Requires schools to notify parents and students within 30 days of each school year about technology provider contracts, provide contract inspection opportunities, and prohibits penalizing students or parents who opt out of programs allowing technology provider access to educational data.