House File 48 - Introduced HOUSE FILE 48 BY SALMON A BILL FOR An Act relating to student data collection by the department 1 of education, school districts, and accredited nonpublic 2 schools. 3 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA: 4 TLSB 1114YH (7) 87 kh/rj

H.F. 48 Section 1. NEW SECTION . 256.25 Student data collection —— 1 policies and plans. 2 1. The department shall establish data collection, data 3 privacy, and data sharing policies for data relating to 4 students collected by the department, school districts, and 5 accredited nonpublic schools. 6 2. The department shall annually conduct an inventory of and 7 categorize the data collected on students and the purposes for 8 which the data is collected, and shall report to the general 9 assembly by November 1, 2017, and by November 1 each succeeding 10 year, the department’s findings and recommendations. 11 3. The department shall create a detailed student data 12 security plan that includes privacy compliance standards, a 13 data breach plan, data retention or destruction plans, and 14 guidelines for authorizing student and parental access to 15 student data. 16 4. The department, school districts, and accredited 17 nonpublic schools shall not include any of the following in 18 student data files: 19 a. Information regarding biometrics, psychometrics, or 20 health. 21 b. Any of the following information as it relates to the 22 student or the student’s family: 23 (1) Voting status. 24 (2) Income. 25 (3) Personality traits such as work techniques, attitude, 26 and effort. 27 (4) Political affiliations. 28 (5) Religious affiliations. 29 (6) Telephone numbers other than contact telephone numbers. 30 (7) Electronic mail addresses other than contact electronic 31 mail addresses. 32 (8) Criminal or juvenile justice records. 33 5. a. Student data shall be kept confidential by the 34 department, a school district, or an accredited nonpublic 35 -1- LSB 1114YH (7) 87 kh/rj 1/ 5

H.F. 48 school unless otherwise ordered by a court, by the lawful 1 custodian of the data, or by another person duly authorized to 2 release such data. 3 b. Except as provided in paragraph “a” , student data shall 4 not be provided outside of the state unless necessary to 5 facilitate the timely enrollment and placement of a student who 6 is transferring to a school outside the state. 7 6. Except as prohibited in subsection 7, the department 8 shall establish and maintain a policy relating to the sharing, 9 security, and confidentiality of student data in compliance 10 with the federal Family Educational Rights and Privacy Act, 20 11 U.S.C. §1232g. 12 7. The state board and the department shall not enter 13 into an agreement with any entity that has an agreement with 14 any federal governmental agency or with a third party that 15 has an agreement with any federal governmental agency, to 16 share personally identifiable student data, or that is working 17 with any federal governmental agency to develop a strategy to 18 make available, on an ongoing basis for research, personally 19 identifiable student data that results from services provided 20 by the entity to the state. 21 8. The department shall notify the governor and the general 22 assembly annually of changes in measures to collect student 23 data or to maintain student data collections by the department 24 which are required for any reason, including changes in federal 25 reporting requirements. The department shall not implement 26 such change unless specifically authorized by a constitutional 27 majority of each house of the general assembly and approved by 28 the governor or unless otherwise specifically authorized by 29 statute. 30 9. Except as provided in subsection 5, the department shall 31 not publish, or share with state agencies inside or outside the 32 state, student data except in aggregate form. 33 10. This section shall not be construed to do any of the 34 following: 35 -2- LSB 1114YH (7) 87 kh/rj 2/ 5

H.F. 48 a. Supersede any provision of section 22.7, section 256.9, 1 subsection 44, or chapter 256H. 2 b. Undermine or eliminate the right of a student’s parent 3 or guardian to review, correct, amend, add to, or delete the 4 student’s information on the department’s database, or the 5 student’s future right as an adult to review, correct, amend, 6 add to, or delete the student’s information on the department’s 7 database. 8 EXPLANATION 9 The inclusion of this explanation does not constitute agreement with 10 the explanation’s substance by the members of the general assembly. 11 This bill relates to student data collection by the 12 department of education, school districts, and accredited 13 nonpublic schools. The bill requires the department to create 14 student data-related policies and plans, and prohibits the 15 department from making changes in the measures used to collect 16 or maintain student data unless specifically authorized by the 17 general assembly and approved by the governor or by statute. 18 The bill requires the department to establish policies 19 for student data collection, and to annually conduct an 20 inventory of and categorize the data collected on students 21 and the purposes for which the data is collected, and report 22 its findings and recommendations to the general assembly by 23 November 1, 2017, and by November 1 each succeeding year. 24 The department must also create a detailed student 25 data security plan, a data breach plan, data retention or 26 destruction plans, and guidelines for authorizing student and 27 parental access to student data. 28 The bill prohibits the department, school districts, and 29 accredited nonpublic schools from including in student data 30 files certain information regarding biometrics, psychometrics, 31 and health; certain information concerning the student’s or the 32 student’s family; and further prohibits the department from 33 publishing student data, and from sharing student data with 34 state agencies inside or outside the state, except in aggregate 35 -3- LSB 1114YH (7) 87 kh/rj 3/ 5

H.F. 48 form. 1 Student data must be kept confidential unless otherwise 2 ordered by a court, by the lawful custodian of the records, or 3 by another person duly authorized to release such information. 4 The bill allows student data to be provided outside of the 5 state if necessary to facilitate the timely enrollment and 6 placement of a student who is transferring to an out-of-state 7 school. Similar provisions are currently provided for in 8 Code chapters 22 and 256H, and Code sections 279.9A, 280.19A, 9 280.25, 280.29, and 299A.11. 10 The department must establish and maintain a policy relating 11 to the sharing, security, and confidentiality of student data 12 in compliance with the federal Family Educational Rights 13 and Privacy Act, 20 U.S.C. §1232g. The state board and the 14 department are prohibited from entering into an agreement with 15 any entity that has an agreement with any federal governmental 16 agency or with a third party that has an agreement with any 17 federal governmental agency, to share personally identifiable 18 student data, or that is working with any federal governmental 19 agency to develop a strategy to make available, on an ongoing 20 basis for research, personally identifiable student data that 21 results from services provided by the entity to the state. 22 The department shall notify the governor and the general 23 assembly annually of changes to existing student data 24 collections maintained by the department. Unless specifically 25 authorized by the general assembly and approved by the governor 26 or by statute, changes that are not necessitated by changes 27 in state and federal reporting requirements shall not be 28 implemented. 29 The new provisions relating to student data shall not be 30 construed to undermine or eliminate the right of a student’s 31 parent or guardian to review, correct, amend, add to, or delete 32 the student’s information on the department’s database, or the 33 student’s future right as an adult to review, correct, amend, 34 add to, or delete the student’s information on the department’s 35 -4- LSB 1114YH (7) 87 kh/rj 4/ 5

H.F. 48 database; or construed to supersede any existing open records 1 law provisions, provisions relating to the department’s 2 comprehensive management information system which are in 3 compliance with state and federal reporting requirements, or 4 provisions enacting the interstate compact on educational 5 opportunity for military children. 6 -5- LSB 1114YH (7) 87 kh/rj 5/ 5