Florida 2023 Regular Session

Florida House Bill H0699 Compare Versions

OldNewDifferences
11
22
3-CS/HB 699 2023
3+HB 699 2023
44
55
66
77 CODING: Words stricken are deletions; words underlined are additions.
8-hb0699-01-c1
8+hb0699-00
99 Page 1 of 10
1010 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
1111
1212
1313
1414 A bill to be entitled 1
1515 An act relating to student online personal information 2
1616 protection; providing a short title; creating s. 3
1717 1006.1494, F.S.; defining terms; prohibiting operators 4
1818 from knowingly engaging in specified activities 5
1919 relating to students' covered information; providing 6
2020 an exception; specifying the duties of an operator; 7
2121 providing circumstances under which an operator may 8
2222 disclose students' covered information; providing 9
23-construction; providing for enforcement under the 10
24-Florida Deceptive and Unfair Trade Practices Act; 11
25-providing that the Department of Legal Affairs is the 12
26-sole entity authorized to bring specified actions; 13
27-authorizing the State Board of Education to adopt 14
28-rules; providing an effective date. 15
29- 16
30-Be It Enacted by the Legislature of the State of Florida: 17
31- 18
32- Section 1. This act may be cited as the "Student Online 19
33-Personal Information Protection Act." 20
34- Section 2. Section 1006.1494, Florida Statutes, is creat ed 21
35-to read: 22
36- 1006.1494 Student online personal information protection. 23
37- (1) As used in this section, the term: 24
38- (a) "Covered information" means personal identifying 25
23+construction; providing an effective date. 10
24+ 11
25+Be It Enacted by the Legislature of the State of Florida: 12
26+ 13
27+ Section 1. This act may be cited as the "Student Online 14
28+Personal Information Protection Act." 15
29+ Section 2. Section 1006.1494, Florida Statutes, is created 16
30+to read: 17
31+ 1006.1494 Student online personal information protection. — 18
32+ (1) As used in this section, the term: 19
33+ (a) "Covered information" means personal identifying 20
34+information or material of a student, or information linked to 21
35+personal identifying information or material of a student, in 22
36+any media or format that is not publicly available and is any of 23
37+the following: 24
38+ 1. Created by or provided to an operator by the student, 25
3939
40-CS/HB 699 2023
40+HB 699 2023
4141
4242
4343
4444 CODING: Words stricken are deletions; words underlined are additions.
45-hb0699-01-c1
45+hb0699-00
4646 Page 2 of 10
4747 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
4848
4949
5050
51-information or material of a student, or information linked to 26
52-personal identifying inf ormation or material of a student, in 27
53-any media or format that is not publicly available and is any of 28
54-the following: 29
55- 1. Created by or provided to an operator by the student, 30
56-or the student's parent or legal guardian, in the course of the 31
57-student's, parent's, or legal guardian's use of the operator's 32
58-site, service, or application for K 12 school purposes. 33
59- 2. Created by or provided to an operator by an employee or 34
60-agent of a K-12 school or school district for K -12 school 35
61-purposes. 36
62- 3. Gathered by an ope rator through the operation of its 37
63-site, service, or application for K -12 school purposes and 38
64-personally identifies a student, including, but not limited to, 39
65-information in the student's educational record or electronic 40
66-mail, first and last name, home addr ess, telephone number, 41
67-electronic mail address, or other information that allows 42
68-physical or online contact, discipline records, test results, 43
69-special education data, juvenile dependency records, grades, 44
70-evaluations, criminal records, medical records, heal th records, 45
71-social security number, biometric information, disabilities, 46
72-socioeconomic information, food purchases, political 47
73-affiliations, religious information, text messages, documents, 48
74-student identifiers, search activity, photos, voice recordings, 49
75-or geolocation information. 50
51+or the student's parent or legal guardian, in the course of the 26
52+student's, parent's, or legal guardian's use of the operator's 27
53+site, service, or application for K –12 school purposes. 28
54+ 2. Created by or provided to an operator by an employee or 29
55+agent of a K-12 school or school district for K -12 school 30
56+purposes. 31
57+ 3. Gathered by an operator through the operation of its 32
58+site, service, or application for K -12 school purposes and 33
59+personally identifies a student, including, but not limited to, 34
60+information in the student's educational record or electronic 35
61+mail, first and last name, h ome address, telephone number, 36
62+electronic mail address, or other information that allows 37
63+physical or online contact, discipline records, test results, 38
64+special education data, juvenile dependency records, grades, 39
65+evaluations, criminal records, medical recor ds, health records, 40
66+social security number, biometric information, disabilities, 41
67+socioeconomic information, food purchases, political 42
68+affiliations, religious information, text messages, documents, 43
69+student identifiers, search activity, photos, voice recordi ngs, 44
70+or geolocation information. 45
71+ (b) "Interactive computer service" means any information 46
72+service, system, or access software provider that provides or 47
73+enables computer access by multiple users to a computer server, 48
74+including a service or system that pro vides access to the 49
75+Internet and such systems operated or services offered by 50
7676
77-CS/HB 699 2023
77+HB 699 2023
7878
7979
8080
8181 CODING: Words stricken are deletions; words underlined are additions.
82-hb0699-01-c1
82+hb0699-00
8383 Page 3 of 10
8484 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
8585
8686
8787
88- (b) "Interactive computer service" means any information 51
89-service, system, or access software provider that provides or 52
90-enables computer access by multiple users to a computer server, 53
91-including a service or system that provides ac cess to the 54
92-Internet and such systems operated or services offered by 55
93-libraries or educational institutions. 56
94- (c) "K-12 school" has the same meaning as described in s. 57
95-1000.04(2). 58
96- (d) "K–12 school purposes" means purposes directed by or 59
97-that customarily take place at the direction of a K -12 school, 60
98-teacher, or school district or that aid in the administration of 61
99-school activities, including, but not limited to, instruction in 62
100-the classroom or at home, administrative activities, and 63
101-collaboration between students, school personnel, or parents, or 64
102-that are otherwise for the use and benefit of the school. 65
103- (e) "Operator" means, to the extent that it is operating 66
104-in this capacity, the operator of an Internet website, online 67
105-service, online application, or mo bile application with actual 68
106-knowledge that the site, service, or application is used 69
107-primarily for K–12 school purposes, or the site, service, or 70
108-application was designed and marketed for K –12 school purposes. 71
109- (f) "School district" has the same meaning as in s. 72
110-595.402. 73
111- (g) "Targeted advertising" means presenting advertisements 74
112-to a student which are selected on the basis of information 75
88+libraries or educational institutions. 51
89+ (c) "K-12 school" has the same meaning as described in s. 52
90+1000.04(2). 53
91+ (d) "K–12 school purposes" means purposes directed by or 54
92+that customarily take place at the direction of a K -12 school, 55
93+teacher, or school district or that aid in the administration of 56
94+school activities, including, but not limited to, instruction in 57
95+the classroom or at home, administrative activities, and 58
96+collaboration between students, school personnel, or parents, or 59
97+that are otherwise for the use and benefit of the school. 60
98+ (e) "Operator" means, to the extent that it is operating 61
99+in this capacity, the operator of an Internet website, online 62
100+service, online applicatio n, or mobile application with actual 63
101+knowledge that the site, service, or application is used 64
102+primarily for K–12 school purposes and was designed and marketed 65
103+for K–12 school purposes. 66
104+ (f) "School district" has the same meaning as in s. 67
105+595.402. 68
106+ (g) "Targeted advertising" means presenting advertisements 69
107+to a student which are selected on the basis of information 70
108+obtained or inferred over time from that student's online 71
109+behavior, usage of applications, or covered information. The 72
110+term does not include advertising to a student at an online 73
111+location based upon the student's current visit to that 74
112+location, or advertising presented in response to a student's 75
113113
114-CS/HB 699 2023
114+HB 699 2023
115115
116116
117117
118118 CODING: Words stricken are deletions; words underlined are additions.
119-hb0699-01-c1
119+hb0699-00
120120 Page 4 of 10
121121 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
122122
123123
124124
125-obtained or inferred over time from that student's online 76
126-behavior, usage of applications, or covered information. Th e 77
127-term does not include advertising to a student at an online 78
128-location based upon the student's current visit to that 79
129-location, or advertising presented in response to a student's 80
130-request for information or feedback, if the student's online 81
131-activities or requests are not retained over time for the 82
132-purpose of targeting subsequent advertisements to that student. 83
133- (2) An operator may not knowingly do any of the following: 84
134- (a) Engage in targeted advertising on the operator's site, 85
135-service, or application, or targeted advertising on any other 86
136-site, service, or application if the targeting of the 87
137-advertising is based on any information, including covered 88
138-information and persistent unique identifiers, which the 89
139-operator has acquired because of the use of that op erator's 90
140-site, service, or application for K -12 school purposes. 91
141- (b) Use covered information, including persistent unique 92
142-identifiers, created or gathered by the operator's site, 93
143-service, or application to amass a profile of a student, except 94
144-in furtherance of K–12 school purposes. The term "amass a 95
145-profile" does not include the collection and retention of 96
146-account information that remains under the control of the 97
147-student or the student's parent or guardian or K -12 school. 98
148- (c) Share, sell, or rent a stud ent's information, 99
149-including covered information. This paragraph does not apply to 100
125+request for information or feedback, if the student's online 76
126+activities or requests are not ret ained over time for the 77
127+purpose of targeting subsequent advertisements to that student. 78
128+ (2) An operator may not knowingly do any of the following: 79
129+ (a) Engage in targeted advertising on the operator's site, 80
130+service, or application, or target advertising on any other 81
131+site, service, or application if the targeting of the 82
132+advertising is based on any information, including covered 83
133+information and persistent unique identifiers, which the 84
134+operator has acquired because of the use of that operator's 85
135+site, service, or application for K -12 school purposes. 86
136+ (b) Use information, including persistent unique 87
137+identifiers, created or gathered by the operator's site, 88
138+service, or application to amass a profile of a student, except 89
139+in furtherance of K–12 school purposes. The term "amass a 90
140+profile" does not include the collection and retention of 91
141+account information that remains under the control of the 92
142+student or the student's parent or guardian or K -12 school. 93
143+ (c) Share, sell, or rent a student's information, 94
144+including covered information. This paragraph does not apply to 95
145+the purchase, merger, or other acquisition of an operator by 96
146+another entity, if the operator or successor entity complies 97
147+with this section regarding previously acquired student 98
148+information, or to a nat ional assessment provider if the 99
149+provider obtains the express written consent of the parent or 100
150150
151-CS/HB 699 2023
151+HB 699 2023
152152
153153
154154
155155 CODING: Words stricken are deletions; words underlined are additions.
156-hb0699-01-c1
156+hb0699-00
157157 Page 5 of 10
158158 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
159159
160160
161161
162-the purchase, merger, or other acquisition of an operator by a 101
163-third party, if the third party complies with this section 102
164-regarding previously acquired student information, or to a 103
165-national assessment provider if the provider obtains the express 104
166-written consent of the parent or student, given in response to 105
167-clear and conspicuous notice, solely to provide access to 106
168-employment, educational scholarships or financial aid, or 107
169-postsecondary educational opportunities. 108
170- (d) Except as otherwise provided in subsection (4), 109
171-disclose covered information, unless the disclosure is made for 110
172-any of the following purposes: 111
173- 1. In furtherance of the K –12 school purpose of the site, 112
174-service, or application, if the recipient of the covered 113
175-information disclosed under this subparagraph does not further 114
176-disclose the information. 115
177- 2. Disclosure as required by state or federal law. 116
178- 3. To comply with the order of a court or quasi -judicial 117
179-entity. 118
180- 4. To protect the safety or integrity of users of the site 119
181-or others or the security of the site, service, or application. 120
182- 5. For a school, educational, or employment purpose 121
183-requested by the student or the student's parent or guardian, 122
184-provided that the information is not used or further disclosed 123
185-for any other purpose. 124
186- 6. To a third party, if the operator contractually 125
162+student, given in response to clear and conspicuous notice, 101
163+solely to provide access to employment, educational scholarships 102
164+or financial aid, or postsecondary e ducational opportunities. 103
165+ (d) Except as otherwise provided in subsection (4), 104
166+disclose covered information, unless the disclosure is made for 105
167+any of the following purposes: 106
168+ 1. In furtherance of the K –12 school purpose of the site, 107
169+service, or applicati on, if the recipient of the covered 108
170+information disclosed under this subparagraph does not further 109
171+disclose the information, unless such disclosure is made to 110
172+allow or improve operability and functionality of the operator's 111
173+site, service, or application. 112
174+ 2. To ensure legal and regulatory compliance or protect 113
175+against liability. 114
176+ 3. To respond to or participate in the judicial process. 115
177+ 4. To protect the safety or integrity of users of the site 116
178+or others or the security of the site, service, or applicati on. 117
179+ 5. For a school, educational, or employment purpose 118
180+requested by the student or the student's parent or guardian, 119
181+provided that the information is not used or further disclosed 120
182+for any other purpose. 121
183+ 6. To a third party, if the operator contractual ly 122
184+prohibits the third party from using any covered information for 123
185+any purpose other than providing the contracted service to or on 124
186+behalf of the operator, prohibits the third party from 125
187187
188-CS/HB 699 2023
188+HB 699 2023
189189
190190
191191
192192 CODING: Words stricken are deletions; words underlined are additions.
193-hb0699-01-c1
193+hb0699-00
194194 Page 6 of 10
195195 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
196196
197197
198198
199-prohibits the third party from using any covered information for 126
200-any purpose other than providing the contracted service to or on 127
201-behalf of the operator, prohibits the third party from 128
202-disclosing any covered information provided by the operator with 129
203-subsequent third parties, and requires the third party to 130
204-implement and maintain reasonable security procedures and 131
205-practices. An operator may not disclose covered information 132
206-relating to any contracted services provided in paragraph (a), 133
207-paragraph (b), or paragraph (c). 134
208- (3) An operator shall do all of the following: 135
209- (a) Collect no more covered information than is reasonably 136
210-necessary to operate an Internet website, online service, online 137
211-application, or mobile application with actual knowledge that 138
212-the site, service, or application is used primarily for K –12 139
213-school purposes, or the site, service, or application was 140
214-designed and marketed for K–12 school purposes. 141
215- (b) Implement and maintain reasonable security procedures 142
216-and practices appropriate to the nature of the covered 143
217-information which are designed to protect it from unauthorized 144
218-access, destruction, use, modification, or disclosur e. 145
219- (c) Unless a parent or guardian expressly consents to the 146
220-operator retaining a student's covered information, delete the 147
221-covered information at the conclusion of the course or 148
222-corresponding program and no later than 90 days after a student 149
223-is no longer enrolled in a school within the district. 150
199+disclosing any covered information provided by the operator with 126
200+subsequent third parties, and requires the third party to 127
201+implement and maintain reasonable security procedures and 128
202+practices. 129
203+ (e) This subsection does not prohibit an operator's use of 130
204+information for maintaining, developing, supporting, improving, 131
205+or diagnosing the operator's site, service, or application. 132
206+ (3) An operator shall do all of the following: 133
207+ (a) Collect no more covered information than is reasonably 134
208+necessary to operate an Internet website, online service, online 135
209+application, or mobile appli cation with actual knowledge that 136
210+the site, service, or application is used primarily for K –12 137
211+school purposes and was designed and marketed for K –12 school 138
212+purposes. 139
213+ (b) Implement and maintain reasonable security procedures 140
214+and practices appropriate to the nature of the covered 141
215+information which are designed to protect it from unauthorized 142
216+access, destruction, use, modification, or disclosure. 143
217+ (c) Within a reasonable timeframe, delete a student's 144
218+covered information if the K -12 school or school distric t 145
219+requests deletion of covered information under the control of 146
220+the K-12 school or school district, unless a student or a parent 147
221+or guardian consents to the maintenance of the covered 148
222+information. 149
223+ (4) An operator may use or disclose covered information o f 150
224224
225-CS/HB 699 2023
225+HB 699 2023
226226
227227
228228
229229 CODING: Words stricken are deletions; words underlined are additions.
230-hb0699-01-c1
230+hb0699-00
231231 Page 7 of 10
232232 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
233233
234234
235235
236- (4) An operator may use or disclose covered information of 151
237-a student under any of the following circumstances: 152
238- (a) If federal or state law requires the operator to 153
239-disclose the information, and the operator c omplies with federal 154
240-or state law, as applicable, in protecting and disclosing that 155
241-information. 156
242- (b) If the covered information is disclosed to a state 157
243-educational agency or the student's local educational agency for 158
244-K-12 school purposes, as allowed unde r state or federal law. 159
245- (c) If the covered information is disclosed to a state or 160
246-local educational agency, including K -12 schools and school 161
247-districts, for K–12 school purposes, as allowed under state or 162
248-federal law. 163
249- (5) This section does not prohibit an operator from doing 164
250-any of the following: 165
251- (a) Using covered information to improve educational 166
252-products, if that information is not associated with an 167
253-identified student within the operator's site, service, or 168
254-application, or other sites, services, o r applications owned by 169
255-the operator. 170
256- (b) Using covered information that is not associated with 171
257-an identified student to demonstrate the effectiveness of the 172
258-operator's products or services, including use in their 173
259-marketing. 174
260- (c) Sharing covered informa tion that is not associated 175
236+a student under any of the following circumstances: 151
237+ (a) If federal or state law requires the operator to 152
238+disclose the information, and the operator complies with federal 153
239+or state law, as applicable, in protecting and disclosing that 154
240+information. 155
241+ (b) If covered information is not used for advertising or 156
242+to amass a profile of the student for purposes other than K -12 157
243+school purposes, legitimate research purposes, as required by 158
244+state or federal law and subject to restrictions imposed 159
245+thereunder; or as al lowed by state or federal law and in 160
246+furtherance of K–12 school purposes or postsecondary educational 161
247+purposes. 162
248+ (c) If the covered information is disclosed to a state or 163
249+local educational agency, including K -12 schools and school 164
250+districts, for K–12 school purposes, as allowed under state or 165
251+federal law. 166
252+ (5) This section does not prohibit an operator from doing 167
253+any of the following: 168
254+ (a) Using covered information to improve educational 169
255+products, if that information is not associated with an 170
256+identified student within the operator's site, service, or 171
257+application, or other sites, services, or applications owned by 172
258+the operator. 173
259+ (b) Using covered information that is not associated with 174
260+an identified student to demonstrate the effectiveness of the 175
261261
262-CS/HB 699 2023
262+HB 699 2023
263263
264264
265265
266266 CODING: Words stricken are deletions; words underlined are additions.
267-hb0699-01-c1
267+hb0699-00
268268 Page 8 of 10
269269 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
270270
271271
272272
273-with an identified student for the development and improvement 176
274-of educational sites, services, or applications. 177
275- (d) Using recommendation engines to recommend to a student 178
276-any of the following: 179
277- 1. Additional content relating to an educational, an 180
278-employment, or any other learning opportunity purpose within an 181
279-online site, service, or application, if the recommendation is 182
280-not determined in whole or in part by payment or other 183
281-consideration from a third party. 184
282- 2. Additional services relating to an educational, an 185
283-employment, or any other learning opportunity purpose within an 186
284-online site, service, or application, if the recommendation is 187
285-not determined in whole or in part by payment or other 188
286-consideration from a third party. 189
287- (e) Responding to a student's request for information or 190
288-feedback without the information or response being determined in 191
289-whole or in part by payment or other consideration from a third 192
290-party. 193
291- (6) This section does not do any of the following: 194
292- (a) Limit the authority of a law enforcement agency to 195
293-obtain any content or information from an operator as authorized 196
294-by law or under a court order. 197
295- (b) Limit the ability of an operator to use student data, 198
296-including covered information, for adaptive learn ing or 199
297-customized student learning purposes. 200
273+operator's products or services, including use in their 176
274+marketing. 177
275+ (c) Sharing covered information that is not associated 178
276+with an identified student for the development and improvement 179
277+of educational sites, services, or applications. 180
278+ (d) Using recommendation e ngines to recommend to a student 181
279+any of the following: 182
280+ 1. Additional content relating to an educational, an 183
281+employment, or any other learning opportunity purpose within an 184
282+online site, service, or application, if the recommendation is 185
283+not determined in whole or in part by payment or other 186
284+consideration from a third party. 187
285+ 2. Additional services relating to an educational, an 188
286+employment, or any other learning opportunity purpose within an 189
287+online site, service, or application, if the recommendation is 190
288+not determined in whole or in part by payment or other 191
289+consideration from a third party. 192
290+ (e) Responding to a student's request for information or 193
291+feedback without the information or response being determined in 194
292+whole or in part by payment or other consideration from a third 195
293+party. 196
294+ (6) This section does not do any of the following: 197
295+ (a) Limit the authority of a law enforcement agency to 198
296+obtain any content or information from an operator as authorized 199
297+by law or under a court order. 200
298298
299-CS/HB 699 2023
299+HB 699 2023
300300
301301
302302
303303 CODING: Words stricken are deletions; words underlined are additions.
304-hb0699-01-c1
304+hb0699-00
305305 Page 9 of 10
306306 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
307307
308308
309309
310- (c) Apply to general audience Internet websites, general 201
311-audience online services, general audience online applications, 202
312-or general audience mobile applications, even if login 203
313-credentials created for an operat or's site, service, or 204
314-application may be used to access those general audience sites, 205
315-services, or applications. 206
316- (d) Limit service providers from providing Internet 207
317-connectivity to schools or students and their families. 208
318- (e) Prohibit an operator of an Internet website, online 209
319-service, online application, or mobile application from 210
320-marketing educational products directly to parents, if such 211
321-marketing did not result from the use of covered information 212
322-obtained by the operator through the provision of ser vices 213
323-covered under this section. 214
324- (f) Impose a duty upon a provider of an electronic store, 215
325-gateway, marketplace, or other means of purchasing or 216
326-downloading software or applications to review or enforce 217
327-compliance with this section on such software or a pplications. 218
328- (g) Impose a duty upon a provider of an interactive 219
329-computer service to review or enforce compliance with this 220
330-section by third-party content providers. 221
331- (h) Prohibit students from downloading, exporting, 222
332-transferring, saving, or maintainin g their own student data or 223
333-documents. 224
334- (7) Any violation of this section is a deceptive and 225
310+ (b) Limit the ability of an operator to use student data, 201
311+including covered information, for adaptive learning or 202
312+customized student learning purposes. 203
313+ (c) Apply to general audience Internet websites, general 204
314+audience online servic es, general audience online applications, 205
315+or general audience mobile applications, even if login 206
316+credentials created for an operator's site, service, or 207
317+application may be used to access those general audience sites, 208
318+services, or applications. 209
319+ (d) Limit service providers from providing Internet 210
320+connectivity to schools or students and their families. 211
321+ (e) Prohibit an operator of an Internet website, online 212
322+service, online application, or mobile application from 213
323+marketing educational products directly to p arents, if such 214
324+marketing did not result from the use of covered information 215
325+obtained by the operator through the provision of services 216
326+covered under this section. 217
327+ (f) Impose a duty upon a provider of an electronic store, 218
328+gateway, marketplace, or other m eans of purchasing or 219
329+downloading software or applications to review or enforce 220
330+compliance with this section on such software or applications. 221
331+ (g) Impose a duty upon a provider of an interactive 222
332+computer service to review or enforce compliance with this 223
333+section by third-party content providers. 224
334+ (h) Prohibit students from downloading, exporting, 225
335335
336-CS/HB 699 2023
336+HB 699 2023
337337
338338
339339
340340 CODING: Words stricken are deletions; words underlined are additions.
341-hb0699-01-c1
341+hb0699-00
342342 Page 10 of 10
343343 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
344344
345345
346346
347-unfair trade practice and constitutes a violation of the Florida 226
348-Deceptive and Unfair Trade Practices Act, part II of chapter 227
349-501. Notwithstanding the provisions of part II of chapter 501, 228
350-the Department of Legal Affairs is the sole entity authorized to 229
351-bring an enforcement action against an entity that violates this 230
352-section. 231
353- 232
354-The State Board of Education may adopt rules to implement this 233
355-section. 234
356- Section 3. This act shall take effect July 1, 2023. 235
347+transferring, saving, or maintaining their own student data or 226
348+documents. 227
349+ Section 3. This act shall take effect July 1, 2023. 228