SB 819 Summary

• Restricts student data collection by state agencies and education institutions to essential information without written parental consent, including name, address, assessment results, course grades, enrollment, and limited health/discipline records.

• Prohibits collection of psychological data, biometric records, affective computing data, predictive modeling results, and information about political affiliations, sexual behavior, religious beliefs, or firearm ownership without written consent.

• Requires public disclosure on agency websites of all personally identifiable information maintained in education databases, including data repository purpose, categories of records, expected disclosures, and access procedures.

• Restricts disclosure of student and teacher data to contractors, cloud service providers, federal agencies, and out-of-state entities with specific safeguards including encryption, annual security audits, 48-hour breach reporting for suspected breaches, and 24-hour reporting for confirmed breaches.

• Mandates destruction of student education records within five years of graduation (one year if student withdraws) and prohibits data use for commercial purposes, workforce tracking, or predictive modeling; violations subject to civil penalties up to $10,000 per violation.