Bill Summary – FastDemocracy

Unofficial Draft Copy
****                                              As of: 11/23/2024, 12:21:40
69th Legislature 2025                             Drafter: Pad McCracken, ****                                   LC 0294
                                                   **** BILL NO. ****
                                                INTRODUCED BY ****
  3
  A BILL FOR AN ACT ENTITLED: “AN ACT GENERALLY REVISING LAWS RELATED TO STUDENT DATA
  PRIVACY; ESTABLISHING THE STUDENT DATA ACCESSIBILITY, TRANSPARENCY, AND
  ACCOUNTABILITY ACT; RESTRICTING ACCESS TO STUDENT DATA; REQUIRING CONFIDENTIALITY OF
  STUDENT DATA; PROVIDING EXCEPTIONS TO ACCESS OF STUDENT DATA; PROVIDING FOR
  COMPLIANCE AND REPORTING REQUIREMENTS; ALLOWING FOR THE RIGHT TO BE FORGOTTEN;
  ESTABLISHING DUTIES OF THE K-12 DATA TASK FORCE;; AMENDING SECTIONS 20-1-101, 20-7-104,
  20-7-105, 20-7-136, 20-7-137, AND 20-7-138, MCA.”
 11
  BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
 13
          NEW SECTION. Section 1.         Short title. [Sections 1 through 7] may be cited as the "Student Data
  Accessibility, Transparency, and Accountability Act".
 16
          NEW SECTION. Section 2.         Definitions. As used in [sections 1 through 7], unless the context clearly
  indicates otherwise, the following definitions apply:
          (1)      "Aggregate data" means data collected or reported at the group, cohort, or institutional level,
  from which individual student identifying information has been removed.
          (2)      "Board" means the board of public education as provided in 20-1-101.
          (3)      "Data system" means the statewide data system used by the office of public instruction as
  referred to in 20-7-104, including a data system contract with a third-party vendor.
          (4)      "Deidentified data" means a student dataset in which parent and student identifying
  information, including the state-assigned student identifier, has been removed.
          (5)      "Military student identifier" means a unique identifier for each student whose parent or guardian
  is a member of the armed forces of the United States, a reserve component of the armed forces of the United
  States, or the national guard, which will allow for the disaggregation of each category.
                                                               -1-                                                LC 294
                                                         Unofficial Draft Copy
****                                                     As of: 11/23/2024, 12:21:40
69th Legislature 2025                                    Drafter: Pad McCracken, ****                                 LC 0294
          (6)        (a) "Student data" means data collected and reported at the individual student level included in
  a student's educational record. In accordance with the provisions of the Family Educational Rights and Privacy
  Act of 1974, 20 U.S.C. 1232g, as amended, student data includes:
          (i)        state and national assessment results, including information on untested public school
  students;
          (ii)       course taking and completion, credits earned, and other transcript information;
          (iii)      course grades and grade point average;
          (iv)       date of birth, grade level, and expected graduation date;
          (v)        degree, diploma, credential attainment, and other school exit information such as general
  educational development and dropout data;
          (vi)       attendance and mobility;
          (vii)      data required to calculate the federal 4-year adjusted cohort graduation rate, including
  sufficient exit and dropout information;
          (viii)     discipline reports limited to objective information sufficient to produce the federal Title IV annual
  incident report;
          (ix)       remediation;
          (x)        special education data;
          (xi)       demographic data and program participation information, including tribal affiliation and other
  data associated with students who have been identified as having American Indian heritage; and
          (xii)      military student identifier.
          (b)        Unless included in a student's education record, "student data" may not include:
          (i)        juvenile delinquency records;
          (ii)       criminal records;
          (iii)      medical and health records;
          (iv)       student social security number; or
          (v)        student biometric information.
          (8)        "Student testing number" means the unique student identifier assigned by the state to each
  student that may not be or include the social security number of a student in whole or in part.
                                                                     -2-                                               LC 294
                                                    Unofficial Draft Copy
****                                               As of: 11/23/2024, 12:21:40
69th Legislature 2025                              Drafter: Pad McCracken, ****                                     LC 0294
  1
          NEW SECTION. Section 3.         Student data system -- access -- restrictions -- confidentiality. (1)
  Access to student data and deidentified data in the data system is restricted to:
          (a)      the superintendent of public instruction and authorized staff or contractors of the office of public
  instruction who require access to perform their assigned duties;
          (b)      district administrators, teachers, and school personnel who require access to perform their
  assigned duties;
          (c)      students and their parents or legal guardians; and
          (d)      the authorized staff of other state agencies in this state as required by law or defined by
  interagency data-sharing agreements.
          (2)      The superintendent of public instruction shall develop criteria for the approval of research and
  data requests from state and local agencies, the legislature, researchers, and the public.
          (3)      A request for access to the data system by a student or their parent or legal guardian under
  subsection (1)(c) is limited to student data for that student.
          (4)      Unless otherwise approved by the board, student data maintained by the superintendent of
  public instruction must remain confidential.
          (5)      The superintendent of public instruction may use only aggregate data in public reports or in
  response to record requests in accordance with subsection (3).
          (6)      Unless otherwise approved by the board to release student data or deidentified data in specific
  instances, the superintendent of public instruction may only use aggregate data in the release of data in
  response to research and data requests.
          (7)      Except as provided in [section 4(2)], the superintendent of public instruction may not share,
  sell, or otherwise release student data to any for-profit business, nonprofit organization, public-private
  partnership, governmental unit, or other entity unless the student's parent has provided written consent
  specifying the data to be released, the reason for the release, and the recipient to whom the data may be
  released.
 27
          NEW SECTION. Section 4.         Exceptions -- data sharing agreements. (1) The superintendent of
                                                                -3-                                                   LC 294
                                                    Unofficial Draft Copy
****                                               As of: 11/23/2024, 12:21:40
69th Legislature 2025                              Drafter: Pad McCracken, ****                                     LC 0294
  public instruction may not transfer student data to any federal, state, or local agency or other entity outside of
  this state, unless:
          (a)       a student transfers out of state or a school or school district seeks help with locating an out-of-
  state transfer;
          (b)       a student leaves the state to attend an out-of-state institution of higher education or training
  program;
          (c)       a student registers for or takes a national or multistate assessment;
          (d)       (i) a student 18 years of age or older voluntarily participates in a program for which the data
  transfer is a condition of participation;
          (ii)      a student under 18 years of age has parental consent to participate in a program for which the
  data transfer is a condition of participation;
          (e)       the office of public instruction enters a contract that governs databases, assessments, special
  education, or instructional supports with an out-of-state vendor;
          (f)       a student is classified as "migrant" for federal reporting purposes; or
          (g)       a student with a military student identifier for purposes of assisting the department of defense in
  developing policy and military child education initiatives.
          (2)       (a) The superintendent may release relevant student data to the commissioner of higher
  education and the department of labor and industry to ensure that Montana's K-12 education system meets the
  expectations of the Montana university system and the workforce needs of the state or for the administration of
  state-sponsored scholarship or training opportunities. The superintendent shall determine the necessity of
  requests from the commissioner and the department of labor and industry. To ensure student privacy, the
  superintendent may only release relevant student data after the department has provided written notice to the
  public of the request and its purpose, the request has been approved by the office of public instruction, and the
  commissioner and department have entered into a written agreement that contains a confidentiality clause.
          (b)       A written agreement under this subsection (2) must:
          (i)       be reviewed every 2 years to determine whether continued access to the student data is
  necessary and protects student privacy; and
          (ii)      require the commissioner and the office of public instruction to destroy and retain no part of
                                                                -4-                                                  LC 294
                                                     Unofficial Draft Copy
****                                              As of: 11/23/2024, 12:21:40
69th Legislature 2025                             Drafter: Pad McCracken, ****                                   LC 0294
  student-level information on completion of the research or administrative activities outlined in the agreement.
           (c)     Allowable research and administrative activities under this subsection (2) include but are not
  limited to:
           (i)     confirming student eligibility for scholarship or training opportunities;
           (ii)    notifying students or their families of scholarship or training opportunities; and
           (iii)   federally required reporting regarding career and technical education programs, services, and
  activities allowed by the Carl D. Perkins Career and Technical Education Improvement Act of 2006, as
  amended.
           (3)     (a) An agency receiving student data under subsection (2) must adhere to the same privacy
  standards established in [section 6(1)(b)].
           (b)     A request granted under subsection (2) must complete a security audit within the first year of
  the written agreement and every 2 years thereafter for the duration of the written agreement.
           (c)     On completion of the request, or on revocation of the written agreement, the agency shall
  publish the findings of the request to the public and delete any student data received by the office of public
  instruction.
           (4)     If the superintendent of public instruction offers a statewide assessment that also serves as a
  college entrance exam, a student's data may be released with the consent of the student to accredited
  postsecondary education institutions, testing agencies under contract with a state entity to provide a college
  entrance exam to students, or scholarship organizations. A scholarship organization may use information
  released under this subsection only for the purpose of scholarship opportunities.
 21
           NEW SECTION. Section 5.        Compliance -- reporting -- rulemaking. (1) The superintendent of
  public instruction shall:
           (a)     ensure routine and ongoing compliance by the office of public instruction with the Family
  Educational Rights and Privacy Act of 1974, other relevant privacy laws and policies, and the privacy and
  security policies and procedures developed under the authority of [sections 1 through 7], including the
  performance of compliance audits;
           (b)     ensure that any contracts that govern databases, assessments, or instructional supports that
                                                                -5-                                                LC 294
                                                   Unofficial Draft Copy
****                                              As of: 11/23/2024, 12:21:40
69th Legislature 2025                             Drafter: Pad McCracken, ****                                     LC 0294
          include student data or deidentified data and are outsourced to private vendors include express
  provisions that safeguard data privacy and data security and include penalties for noncompliance;
          (c)      report to the education interim committee, in accordance with 5-11-210:
          (i)      new student data proposed for inclusion in the state student data system. Any new student
  data collection proposed by the office of public instruction becomes a provisional requirement to allow districts
  and their local data system vendors the opportunity to meet the new requirement. The office of public
  instruction shall submit any new provisional student data collection to the legislature for approval to make the
  new student data a permanent requirement. Any provisional student data collection not approved by the
  legislature by the end of the next legislative session expires and is no longer required.
          (ii)     changes to existing data collections required for any reason, including changes to federal
  reporting requirements made by the U.S. department of education; and
          (iii)    the results of all privacy compliance and security audits completed in the past year.
  Notifications regarding privacy compliance and security audits may not include any information that would itself
  pose a security threat to the state or local student data systems or to the secure transmission of data between
  state and local systems by exposing vulnerabilities.
          (2)      The office of public instruction shall adopt rules to implement the provisions of [sections 1
  through 7].
 18
          NEW SECTION. Section 6.         Duties of K-12 task force regarding student data privacy. (1) The
  superintendent of public instruction shall continually work in consultation with the K-12 data task force provided
  for in 20-7-105 to:
          (a)      create, publish, and make publicly available a data inventory and dictionary or index of data
  elements with definitions of individual student data fields currently in the data system used by the office of
  public instruction, including:
          (i)      any individual student data required to be reported by state and federal education mandates;
          (ii)     any individual student data that has been proposed for inclusion in the student data system
  with a statement regarding the purpose or reason for the proposed collection; and
          (iii)    any individual student data that the office of public instruction collects or maintains with no
                                                               -6-                                                   LC 294
                                                    Unofficial Draft Copy
****                                               As of: 11/23/2024, 12:21:40
69th Legislature 2025                              Drafter: Pad McCracken, ****                                      LC 0294
  current purpose or reason;
          (b)       develop a detailed data security plan that includes:
          (i)       guidelines for authorizing access to the student data system and to individual student data,
  including guidelines for authentication of authorized access;
          (ii)      privacy compliance standards;
          (iii)     privacy and security audits;
          (iv)      breach planning, notification, and procedures; and
          (v)       data retention and disposition policies;
          (c)       develop, publish, and make publicly available policies and procedures to comply with the
  Family Educational Rights and Privacy Act of 1974 and other relevant privacy laws and policies; and
          (d)       provide annual notification to students and parents regarding their privacy rights under federal
  and state law.
          (2)       Notifications of all rights, policies, and procedures under subsections (1)(c) and (1)(d) must be
  made available to the public through written publication and on the office of public instruction's website.
 15
          NEW SECTION. Section 7.          Right to be forgotten -- verifiable request -- timeline -- rulemaking.
  (1) A student or parent is entitled to request that the superintendent of public inst