AR
Arkansas Senate Bill SB500

Arkansas 2023 Regular Session

Arkansas Senate Bill SB500 Compare Versions

Only one version of the bill is available at this time.
OldNewDifferences
11 Stricken language would be deleted from and underlined language would be added to present law.
22 *TNL312* 3/27/2023 4:36:02 PM TNL312
33
44 State of Arkansas 1
55 94th General Assembly A Bill 2
66 Regular Session, 2023 SENATE BILL 500 3
77 4
88 By: Senator J. Bryant 5
99 By: Representative G. Hodges 6
1010 7
1111 For An Act To Be Entitled 8
1212 AN ACT TO CREATE THE STUDENT DATA VENDOR SECURITY 9
1313 ACT; AND FOR OTHER P URPOSES. 10
1414 11
1515 12
1616 Subtitle 13
1717 TO CREATE THE STUDENT DATA VENDOR 14
1818 SECURITY ACT. 15
1919 16
2020 17
2121 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF ARKANSAS: 18
2222 19
2323 SECTION 1. Arkansas Code Title 6, Chapter 18, is amended to add an 20
2424 additional subchapter to read as follows: 21
2525 Subchapter 25 — Student Data Vendor Security Act 22
2626 23
2727 6-18-2501. Title. 24
2828 This subchapter shall be known and may be cited as the “Student Data 25
2929 Vendor Security Act”. 26
3030 27
3131 6-18-2502. Purpose. 28
3232 The purpose of this subchapter is to increase security and transparency 29
3333 in the sharing and use of student data with and by third party vendors. 30
3434 31
3535 6-18-2503. Definitions. 32
3636 As used in this subchapter: 33
3737 (1) “Affiliate” means a legal enti ty that controls, is 34
3838 controlled by, or is under common control with another legal entity; 35
3939 (2) “Control” means: 36 SB500
4040
4141 2 3/27/2023 4:36:02 PM TNL312
4242
4343
4444 (A) Ownership of, or the power to vote, more than fifty 1
4545 percent (50%) of the outstanding voting securities of a company; or 2
4646 (B) Control in any manner over the election of a majority 3
4747 of the directors or of individuals exercising similar management functions of 4
4848 a company; 5
4949 (3) “Deidentified data” means data that cannot reasonably be 6
5050 linked to an identified or identifiable natural person ; 7
5151 (4) “Destroy” means to remove student personally identifiable 8
5252 information so that the information is permanently irretrievable in the 9
5353 normal course of business; 10
5454 (5) "Local education agency" means: 11
5555 (A) A public school district; or 12
5656 (B) An open-enrollment public charter school; 13
5757 (6) “Parent” means: 14
5858 (A) The biological or adoptive parent of a student; 15
5959 (B) A student's legal guardian; or 16
6060 (C) A person standing in loco parentis to a student; 17
6161 (7) “Public education entity” means: 18
6262 (A) The Department of Education; 19
6363 (B) A public school within a public school district; or 20
6464 (C) An open-enrollment public charter school; 21
6565 (8)(A) “School service” means a website, online service, online 22
6666 application, or mobile application that: 23
6767 (i) Is designed and marketed primarily for use in a 24
6868 preschool, elementary school, or secondary school; 25
6969 (ii) Is used at the direction of teachers or other 26
7070 employees of a local education agency; and 27
7171 (iii) Collects, maintains, or uses student 28
7272 personally identifiable information. 29
7373 (B) “School service” does not include a website, online 30
7474 service, online application, or mobile application that is designed and 31
7575 marketed for use by individuals or entities generally, even if the website, 32
7676 online service, online application, or mobile application is also marketed to 33
7777 a preschool, elementary school, or secondary school; 34
7878 (9) “School service contract provider” means an entity, other 35
7979 than a local education agency or an institution of higher education, that 36 SB500
8080
8181 3 3/27/2023 4:36:02 PM TNL312
8282
8383
8484 enters into a formal, negotiated contract with a public education entity to 1
8585 provide a school service; 2
8686 (10) “School service on -demand provider” means an entity, other 3
8787 than a public education entity or an institution of higher education, that 4
8888 provides a school service to a public education entity, subject to agreement 5
8989 by the public education entity, or an employee of the public education 6
9090 entity, to standard, nonnegotiable terms and conditions of service 7
9191 established by the entity; 8
9292 (11)(A) “Student personal ly identifiable information” means 9
9393 information that, alone or in combination, personally identifies an 10
9494 individual student or the student’s parent or family, and that is collected, 11
9595 maintained, generated, or inferred by: 12
9696 (i) A public education entity, e ither directly or 13
9797 through a school service; 14
9898 (ii) A school service contract provider; or 15
9999 (iii) A school service on -demand provider. 16
100100 (B) “Student personally identifiable information” does not 17
101101 include deidentified data; 18
102102 (12)(A) “Targeted adve rtising” means selecting and sending 19
103103 advertisements to a student based on personal data obtained or inferred over 20
104104 time from the student’s online behavior, use of applications, or student 21
105105 personally identifiable information. 22
106106 (B) “Targeted advertising” d oes not include: 23
107107 (i) Advertising to a student: 24
108108 (a) At an online location based on the 25
109109 student’s current visit to that location or in response to the student’s 26
110110 request for information or feedback; and 27
111111 (b) Without the collection and retention of a 28
112112 student’s online activities over time; 29
113113 (ii) Adaptive learning, personalized learning, or 30
114114 customized education; 31
115115 (iii) With the consent of a student or the student’s 32
116116 parent, using the student’s personally identifiable information to identify 33
117117 for the student institutions of higher education or scholarship providers 34
118118 that are seeking students who meet specific criteria; or 35
119119 (iv) Processing personal data solely for measuring 36 SB500
120120
121121 4 3/27/2023 4:36:02 PM TNL312
122122
123123
124124 or reporting advertising performance, reach, or frequency; a nd 1
125125 (13)(A) “Vendor” means a business or other organization with 2
126126 which a public education entity contracts for a product or service. 3
127127 (B) “Vendor” includes a school service contract provider 4
128128 and a school service on -demand provider. 5
129129 6
130130 6-18-2504. Local education agency — Vendor security and transparency. 7
131131 (a) Each local education agency shall ensure that all contracts that 8
132132 disclose or make available student personally identifiable information to 9
133133 vendors, including school service contract providers, sch ool service on-10
134134 demand providers, and other third parties, including without limitation 11
135135 subcontractors of contract providers, include express provisions that 12
136136 safeguard the privacy and security of student personally identifiable 13
137137 information. 14
138138 (b)(1)(A) Each local education agency shall maintain a list of the 15
139139 school service contract providers that the local education agency contracts 16
140140 with for school services that include or make available student personally 17
141141 identifiable information. 18
142142 (B) A local education agency shall: 19
143143 (i) At a minimum, update the list of school service 20
144144 contract providers required under subdivision (b)(1)(A) of this section at 21
145145 the beginning and mid -point of each school year; 22
146146 (ii) Upon the request of a parent, provide a copy of 23
147147 the list required under subdivision (b)(1)(A) of this section; and 24
148148 (iii) Maintain a copy of each contract between the 25
149149 local education agency and a school service contract provider. 26
150150 (2)(A) A local education agency shall ensure that the terms of a 27
151151 contract entered into or renewed by the local education agency with a school 28
152152 service contract provider on and after the effective date of this act, at a 29
153153 minimum, require the school service contract provider to comply with the 30
154154 requirements in § 6-18-2505 and § 6-18-2507. 31
155155 (B)(i) If a school service contract provider commits a 32
156156 material breach of a contract that involves the misuse or unauthorized 33
157157 release of student personally identifiable information, the local education 34
158158 agency shall determine whether to term inate the contract at the direction of, 35
159159 or in accordance with a policy adopted by, the governing body of the local 36 SB500
160160
161161 5 3/27/2023 4:36:02 PM TNL312
162162
163163
164164 education agency. 1
165165 (ii) At a minimum, within a reasonable time after 2
166166 the local education agency identifies the existence of a material br each of 3
167167 contract, the local education agency shall: 4
168168 (a) Investigate the nature of the material 5
169169 breach; 6
170170 (b) Provide an opportunity for the school 7
171171 service contract provider to respond concerning the alleged material breach; 8
172172 (c) Obtain the advice and direction of the 9
173173 governing body of the local education agency; and 10
174174 (d) Determine whether to terminate or continue 11
175175 the contract with the school service contract provider. 12
176176 (3) On and after the effective date of this act, a local 13
177177 education agency shall not enter into or renew a contract with a school 14
178178 service contract provider that: 15
179179 (A) Refuses to accept the terms specified in subdivision 16
180180 (b)(2) of this section; or 17
181181 (B) Has substantially failed to comply with one (1) or 18
182182 more of the requirements in § 6-18-2505 and § 6-18-2507. 19
183183 (c)(1)(A) Each local education agency shall maintain a list of the 20
184184 school service on-demand providers that the local education agency or an 21
185185 employee of the local education agency uses for school services that inc lude 22
186186 or make available student personally identifiable information. 23
187187 (B) A local education agency shall: 24
188188 (i) At a minimum, update the list of school service 25
189189 on-demand providers required under subdivision (c)(1)(A) of this section at 26
190190 the beginning and mid-point of each school year; and 27
191191 (ii) Upon the request of a parent, provide a copy of 28
192192 the list required under subdivision (c)(1)(A) of this section and, upon 29
193193 further request of the parent, assist the parent in obtaining the data 30
194194 privacy policy of the school service on -demand providers. 31
195195 (2) If a parent has evidence demonstrating that a school service 32
196196 on-demand provider with which a local education agency or an employee of a 33
197197 local education agency acting on behalf of a local education agency cont racts 34
198198 does not substantially comply with the school service on -demand provider’s 35
199199 privacy policy or does not meet the requirements in § 6 -18-2506(b) and § 6-36 SB500
200200
201201 6 3/27/2023 4:36:02 PM TNL312
202202
203203
204204 18-2507(a), the parent may notify the local education agency and provide the 1
205205 evidence for the parent ’s conclusion. 2
206206 (3)(A) If a local education agency has evidence demonstrating 3
207207 that a school service on -demand provider does not substantially comply with 4
208208 the school service on -demand provider’s privacy policy or does not meet the 5
209209 requirements in § 6-18-2506(b) and § 6-18-2507(a), the local education agency 6
210210 may cease using or refuse to use the school service on -demand provider and 7
211211 prohibit employees of the local education agency from using the school 8
212212 service on-demand provider. 9
213213 (B) The local education agency shall notify the school 10
214214 service on-demand provider that the: 11
215215 (i) Local education agency is ceasing or refusing to 12
216216 use the school service on -demand provider under subdivision (c)(3)(A) of this 13
217217 section; and 14
218218 (ii) School service on -demand provider may submit a 15
219219 written response to the local education agency. 16
220220 (C) The local education agency shall: 17
221221 (i) Notify the Department of Education if the local 18
222222 education agency ceases using a school service on -demand provider for the 19
223223 reasons described in subdivision (c)(3) of this section; and 20
224224 (ii) Provide a copy of any written response that a 21
225225 school service on-demand provider submits to the local education agency under 22
226226 subdivision (c)(3)(b)(ii) of this section. 23
227227 24
228228 6-18-2505. School service contr act provider — Data transparency. 25
229229 (a)(1) Each school service contract provider shall provide clear 26
230230 information that is understandable by a layperson explaining: 27
231231 (A) The elements of student personally identifiable 28
232232 information that the school service c ontract provider collects; 29
233233 (B) The purpose for which the school service contract 30
234234 provider collects the student personally identifiable information; and 31
235235 (C) How the school service contract provider uses and 32
236236 shares the student personally identifiable information. 33
237237 (2) The information required under subdivision (a)(1) of this 34
238238 section shall include all student personally identifiable information that 35
239239 the school service contract provider collects regardless of whether it is 36 SB500
240240
241241 7 3/27/2023 4:36:02 PM TNL312
242242
243243
244244 initially collected or ultim ately held individually or in the aggregate. 1
245245 (3) A school service contract provider shall: 2
246246 (A) Provide the information required under subdivision 3
247247 (a)(1) of this section to each public education entity that the school 4
248248 service contract provider contra cts with in a format that is easily 5
249249 accessible; and 6
250250 (B) Update the information required under subdivision 7
251251 (a)(1) of this section as necessary to maintain accuracy. 8
252252 (b) A school service contract provider shall: 9
253253 (1) Provide clear notice to each public education entity that it 10
254254 contracts with before making material changes to its privacy policy for 11
255255 school services that would result in a material reduction in the level of 12
256256 privacy and security provided for student personally identifiable 13
257257 information; and 14
258258 (2) Facilitate access to and the correction of any factually 15
259259 inaccurate student personally identifiable information by a contracting local 16
260260 education agency in response to a request for correction that the local 17
261261 education agency receives and to whic h the local education agency responds. 18
262262 (d) Upon discovering the misuse or unauthorized release of student 19
263263 personally identifiable information held by a school service contract 20
264264 provider, a subcontractor of a school service contract provider, or a 21
265265 subsequent subcontractor of a school service contract provider, the school 22
266266 service contract provider shall notify the contracting public education 23
267267 entity as soon as possible, regardless of whether the misuse or unauthorized 24
268268 release is a result of a material breach of the terms of a contract. 25
269269 26
270270 6-18-2506. School service contract provider — Use of data. 27
271271 (a)(1) A school service contract provider may collect, use, and share 28
272272 student personally identifiable information only: 29
273273 (A) For the purposes authorized in the contract between 30
274274 the school service contract provider and a public education entity; or 31
275275 (B) With the consent of the student who is the subject of 32
276276 the information or the student’s parent. 33
277277 (2) A school service contract provider shall obtain the consen t 34
278278 of a student or a student’s parent before using student personally 35
279279 identifiable information in a manner that is materially inconsistent with the 36 SB500
280280
281281 8 3/27/2023 4:36:02 PM TNL312
282282
283283
284284 contract between the school service contract provider and the public 1
285285 education entity that applies to the col lection of the student personally 2
286286 identifiable information. 3
287287 (b)(1) A school service contract provider shall not: 4
288288 (A) Sell student personally identifiable information; 5
289289 (B) Use or share student personally identifiable 6
290290 information for purposes of ta rgeted advertising to students; or 7
291291 (C) Use student personally identifiable information to 8
292292 create a personal profile of a student other than for supporting purposes 9
293293 authorized by the contracting public education entity or with the consent of 10
294294 the student or the student’s parent. 11
295295 (2) Notwithstanding anything in this subchapter to the contrary, 12
296296 selling student personally identifiable information does not include a school 13
297297 service contract provider's use, sharing, or transfer of student personally 14
298298 identifiable information: 15
299299 (A) With or to an affiliate of the school service contract 16
300300 provider; 17
301301 (B) For any purpose permitted under subdivision (a)(1) of 18
302302 this section; 19
303303 (C) With or to a third party that processes the student 20
304304 personally identifiable information on behalf of the school service contract 21
305305 provider; 22
306306 (D) For any purpose at the direction of the contracting 23
307307 public education entity or with the consent of the student or the student’s 24
308308 parent; or 25
309309 (E) In connection with the purchase, merge r, or other type 26
310310 of acquisition of a school service contract provider, or any assets of a 27
311311 school service contract provider, by another entity, so long as the successor 28
312312 entity continues to be subject to the provisions of this subchapter with 29
313313 respect to student personally identifiable information that the school 30
314314 service contract provider acquired while subject to this subchapter. 31
315315 (c) Notwithstanding subdivision (a)(2) or subsection (b) of this 32
316316 section to the contrary, a school service contract provider may use or 33
317317 disclose student personally identifiable information: 34
318318 (1)(A) To: 35
319319 (i) Ensure legal or regulatory compliance or to take 36 SB500
320320
321321 9 3/27/2023 4:36:02 PM TNL312
322322
323323
324324 precautions against liability; 1
325325 (ii) Respond to or participate in the judicial 2
326326 process; 3
327327 (iii) Protect the safety o f users or others on the 4
328328 school service contract provider’s website, online service, online 5
329329 application, or mobile application; or 6
330330 (iv) Investigate a matter related to public safety. 7
331331 (B) If a school service contract provider uses or 8
332332 discloses student personally identifiable information as permitted under 9
333333 subdivision (c)(1)(A) of this section, the school service contract provider 10
334334 shall notify the contracting public education entity as soon as possible 11
335335 after the use or disclosure of the information; and 12
336336 (2)(A) To a subcontractor only if the school service contract 13
337337 provider contractually requires the subcontractor to comply with this 14
338338 subchapter. 15
339339 (B) Subdivision (c)(2)(A) of this section shall apply to 16
340340 the ability of an initial or subsequent subc ontractor to further subcontract. 17
341341 (C)(i) If a public education entity determines that an 18
342342 initial or subsequent subcontractor has committed a material breach of 19
343343 contract that involves the misuse or unauthorized disclosure of student 20
344344 personally identifia ble information, the public education entity shall comply 21
345345 with the requirements of § 6 -18-2504. 22
346346 (ii) However, the public education entity is not 23
347347 required to consider terminating the contract if the school service contract 24
348348 provider terminates the contr act with the subcontractor as soon as possible 25
349349 after the school service contract provider knows or has reason to know of the 26
350350 initial or subsequent subcontractor’s material breach. 27
351351 (d) A student may consent to the use, sharing, or retention of the 28
352352 student’s student personally identifiable information only if the student is 29
353353 eighteen (18) years of age or older or legally emancipated for purposes of 30
354354 this section. 31
355355 32
356356 6-18-2507. School service contract provider — Data security and 33
357357 destruction. 34
358358 (a)(1) A school service contract provider shall maintain a 35
359359 comprehensive information security program that is reasonably designed to 36 SB500
360360
361361 10 3/27/2023 4:36:02 PM TNL312
362362
363363
364364 protect the security, privacy, confidentiality, and integrity of student 1
365365 personally identifiable information. 2
366366 (2) The comprehensive inf ormation security program required 3
367367 under subdivision (a)(1) of this section shall make use of appropriate 4
368368 administrative, technological, and physical safeguards. 5
369369 (b) During the term of a contract between a school service contract 6
370370 provider and a public ed ucation entity, if the contracting public education 7
371371 entity requests destruction of a student’s student personally identifiable 8
372372 information collected, generated, or inferred as a result of the contract, 9
373373 the contracting school service contract provider shall destroy the 10
374374 information as soon as practicable after the date of the request unless: 11
375375 (1) The school service contract provider obtains the consent of 12
376376 the student or the student’s parent to retain the student’s student 13
377377 personally identifiable information ; or 14
378378 (2) The student has transferred to another public education 15
379379 entity and the receiving public education entity has requested that the 16
380380 school service contract provider retain the student’s student personally 17
381381 identifiable information. 18
382382 (c)(1) Following the termination or conclusion of a contract between a 19
383383 school service contract provider and a public education entity, the school 20
384384 service contract provider shall, within the time period specified in the 21
385385 contract, destroy all student personally identifiabl e information collected, 22
386386 generated, or inferred as a result of the contract. 23
387387 (2) If the contract does not specify a period for destruction of 24
388388 student personally identifiable information, the school service contract 25
389389 provider shall destroy the information as soon as practicable after the 26
390390 information is no longer needed for the purpose of the contract between the 27
391391 school service contract provider and the public education entity. 28
392392 (3) Upon request of the public education entity, the school 29
393393 service contract provider shall notify the public education entity of the 30
394394 date upon which all of the student personally identifiable information is 31
395395 destroyed. 32
396396 33
397397 6-18-2508. Exceptions — Applicability. 34
398398 (a) Notwithstanding any provision of this subchapter to the contrary, 35
399399 this subchapter does not prohibit the use of student personally identifiable 36 SB500
400400
401401 11 3/27/2023 4:36:02 PM TNL312
402402
403403
404404 information to: 1
405405 (1) Use adaptive learning or design personalized or customized 2
406406 education; 3
407407 (2) Maintain, develop, support, improve, or diagnose a school 4
408408 service contract provider’s website, online service, online application, or 5
409409 mobile application; 6
410410 (3) Provide recommendations for school, educational, or 7
411411 employment purposes within a school service, so long as the response is not 8
412412 determined in whole or in part by payment or other consideration from a third 9
413413 party; 10
414414 (4) Respond to a student’s request for information or for 11
415415 feedback so long as the information or response is not determined in whole or 12
416416 in part by payment or other consideration from a third party; 13
417417 (5) Identify for the student, only with the written consent of 14
418418 the student or the student’s parent, institutions of higher education or 15
419419 scholarship providers that are seeking students who meet specific criteria, 16
420420 regardless of whether the identified institution s of higher education or 17
421421 scholarship providers provide consideration to the school service contract 18
422422 provider; 19
423423 (6) In accordance with the terms of a contract between the 20
424424 school service contract provider and a public education entity, produce and 21
425425 distribute, free or for consideration, student class photos and yearbooks 22
426426 only to the public education entity, students, parents, or individuals 23
427427 authorized by parents; or 24
428428 (7)(A) Provide for the student, only with the express written 25
429429 consent of the student or th e student’s parent given in response to clear and 26
430430 conspicuous notice, access to employment opportunities, educational 27
431431 scholarships or financial aid, or postsecondary education opportunities, 28
432432 regardless of whether the school service contract provider receiv es 29
433433 consideration from one or more third parties in exchange for the student 30
434434 personally identifiable information. 31
435435 (B) Subdivision (a)(7)(A) of this section applies only to 32
436436 a school service contract provider that provides nationally recognized 33
437437 assessments that postsecondary institutions of higher education use in making 34
438438 admissions decisions. 35
439439 (b) This subchapter does not: 36 SB500
440440
441441 12 3/27/2023 4:36:02 PM TNL312
442442
443443
444444 (1) Impose a duty on a provider of interactive computer service, 1
445445 as defined in 47 U.S.C. Sec. 230, as it existed on January 1, 2023, to review 2
446446 or enforce compliance with this subchapter by school service contract 3
447447 providers or school service on -demand providers; 4
448448 (2) Impede the ability of a student to download, export, or 5
449449 otherwise save or maintain his or her own student personally id entifiable 6
450450 information or documents; 7
451451 (3) Limit internet service providers from providing internet 8
452452 connectivity to local education agencies or to students and their families; 9
453453 (4) Prohibit a school service contract provider from marketing 10
454454 educational products directly to parents so long as the marketing does not 11
455455 result from the use of student personally identifiable information obtained 12
456456 by the school service contract provider as a result of providing its website, 13
457457 online service, online application, or m obile application to a public 14
458458 education entity; or 15
459459 (5) Impose a duty on a provider of an electronic store, gateway, 16
460460 marketplace, or other means of purchasing or downloading software or 17
461461 applications to review or enforce compliance with this subchapter on that 18
462462 software or those applications. 19
463463 (c) The requirements in § 6 -18-2505 and § 6-18-2507 shall apply to a 20
464464 school service contract provider that enters or renews a contract with a 21
465465 public education entity on or after the effective date of this act. 22
466466 23
467467 SECTION 2. DO NOT CODIFY. Effective date. This act shall be 24
468468 effective on and after June 1, 2024. 25
469469 26
470470 27
471471 28
472472 29
473473 30
474474 31
475475 32
476476 33
477477 34
478478 35
479479 36