House File 2137 - Introduced HOUSE FILE 2137 BY SALMON A BILL FOR An Act relating to student data collection by the department 1 of education, school districts, and accredited nonpublic 2 schools. 3 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA: 4 TLSB 5705YH (3) 87 kh/rj

H.F. 2137 Section 1. NEW SECTION . 256.25 Student data collection —— 1 policies and plans. 2 1. The department shall establish data collection, data 3 privacy, and data sharing policies for data relating to 4 students collected by the department, school districts, and 5 accredited nonpublic schools. 6 2. The department shall annually conduct an inventory of and 7 categorize the data collected on students and the purposes for 8 which the data is collected, and shall report to the general 9 assembly by November 1, 2018, and by November 1 each succeeding 10 year, the department’s findings and recommendations. 11 3. The department shall create a detailed student data 12 security plan that includes privacy compliance standards, a 13 data breach plan, data retention or destruction plans, and 14 guidelines for authorizing student and parental access to 15 student data. 16 4. The department, school districts, and accredited 17 nonpublic schools shall not include any of the following in 18 student data files unless otherwise provided in this section: 19 a. Information reflecting the use of biometric or 20 psychometric data, including but not limited to information 21 gathered from a computer adaptive assessment. 22 b. Any of the following information as it relates to the 23 student or the student’s family: 24 (1) Voting status. 25 (2) Income, unless such information is required for school 26 meal programs administered in accordance with chapter 283A. 27 (3) Personality traits such as work techniques, attitude, 28 and effort. 29 (4) Political affiliations. 30 (5) Religious affiliations, except an accredited nonpublic 31 school may include such information in a student’s data files. 32 (6) Telephone numbers other than contact telephone numbers. 33 (7) Electronic mail addresses other than contact electronic 34 mail addresses. 35 -1- LSB 5705YH (3) 87 kh/rj 1/ 5

H.F. 2137 (8) Criminal or juvenile justice records. 1 c. Notwithstanding paragraph “b” , information described in 2 paragraph “b” , subparagraphs (3), (5), (6), (7), and (8) may be 3 kept in student data files by a school district or accredited 4 nonpublic school, but shall not be shared with the department 5 or any other governmental agency in this state. 6 5. a. Student data shall be kept confidential by the 7 department, a school district, or an accredited nonpublic 8 school unless otherwise ordered by a court, by the lawful 9 custodian of the data, or by another person duly authorized to 10 release such data. 11 b. Except as provided in paragraph “a” , student data shall 12 not be provided outside of the state unless necessary to 13 facilitate the timely enrollment and placement of a student who 14 is transferring to a school outside the state. 15 6. Except as prohibited in subsection 7, the department 16 shall establish and maintain a policy relating to the sharing, 17 security, and confidentiality of student data in compliance 18 with the federal Family Educational Rights and Privacy Act, 20 19 U.S.C. §1232g. 20 7. The state board and the department shall not enter 21 into an agreement with any entity that has an agreement with 22 any federal governmental agency or with a third party that 23 has an agreement with any federal governmental agency, to 24 share personally identifiable student data, or that is working 25 with any federal governmental agency to develop a strategy to 26 make available, on an ongoing basis for research, personally 27 identifiable student data that results from services provided 28 by the entity to the state. 29 8. The department shall notify the governor and the general 30 assembly annually of changes in measures to collect student 31 data or to maintain student data collections by the department 32 which are required for any reason, including changes in federal 33 reporting requirements. The department shall not implement 34 such change unless specifically authorized by a constitutional 35 -2- LSB 5705YH (3) 87 kh/rj 2/ 5

H.F. 2137 majority of each house of the general assembly and approved by 1 the governor or unless otherwise specifically authorized by 2 statute. 3 9. Except as provided in subsection 5, the department shall 4 not publish or share with any governmental agency outside of 5 the state student data except in aggregate form. 6 10. This section shall not be construed to do any of the 7 following: 8 a. Supersede any provision of section 22.7, section 256.9, 9 subsection 44, or chapter 256H. 10 b. Undermine or eliminate the right of a student’s parent 11 or guardian to review, correct, amend, add to, or delete the 12 student’s information on the department’s database, or the 13 student’s future right as an adult to review, correct, amend, 14 add to, or delete the student’s information on the department’s 15 database. 16 EXPLANATION 17 The inclusion of this explanation does not constitute agreement with 18 the explanation’s substance by the members of the general assembly. 19 This bill relates to student data collection by the 20 department of education, school districts, and accredited 21 nonpublic schools. The bill requires the department to create 22 student data-related policies and plans, and prohibits the 23 department from making changes in the measures used to collect 24 or maintain student data unless specifically authorized by the 25 general assembly and approved by the governor or by statute. 26 The bill requires the department to annually conduct an 27 inventory of and categorize the data collected on students 28 and the purposes for which the data is collected, and report 29 its findings and recommendations to the general assembly by 30 November 1, 2018, and by November 1 each succeeding year. 31 The bill prohibits, except as otherwise provided, the 32 department, school districts, and accredited nonpublic schools 33 from including in student data files certain information 34 regarding biometric and psychometric data; certain information 35 -3- LSB 5705YH (3) 87 kh/rj 3/ 5

H.F. 2137 concerning the student’s or the student’s family; and further 1 prohibits the department from publishing or sharing with any 2 governmental agency outside of the state student data except 3 in aggregate form. 4 Student data must be kept confidential unless otherwise 5 ordered by a court, by the lawful custodian of the records, or 6 by another person duly authorized to release such information. 7 Student data may be provided outside of the state if necessary 8 to facilitate the timely enrollment and placement of a student 9 who is transferring to an out-of-state school. 10 The department must establish and maintain a policy relating 11 to the sharing, security, and confidentiality of student data 12 in compliance with the federal Family Educational Rights 13 and Privacy Act, 20 U.S.C. §1232g. The state board and the 14 department are prohibited from entering into an agreement with 15 any entity that has an agreement with any federal governmental 16 agency or with a third party that has an agreement with any 17 federal governmental agency, to share personally identifiable 18 student data, or that is working with any federal governmental 19 agency to develop a strategy to make available, on an ongoing 20 basis for research, personally identifiable student data that 21 results from services provided by the entity to the state. 22 The department shall notify the governor and the general 23 assembly annually of changes to existing student data 24 collections maintained by the department. Unless specifically 25 authorized by the general assembly and approved by the governor 26 or by statute, changes that are not necessitated by changes 27 in state and federal reporting requirements shall not be 28 implemented. 29 The new provisions relating to student data shall not be 30 construed to undermine or eliminate the right of a student’s 31 parent or guardian, or the student’s future right as an adult, 32 to review, correct, amend, add to, or delete the student’s 33 information on the department’s database; or construed to 34 supersede any existing open records law provisions, provisions 35 -4- LSB 5705YH (3) 87 kh/rj 4/ 5

H.F. 2137 relating to the department’s comprehensive management 1 information system which are in compliance with state and 2 federal reporting requirements, or provisions enacting the 3 interstate compact on educational opportunity for military 4 children. 5 -5- LSB 5705YH (3) 87 kh/rj 5/ 5