EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
[Brackets] indicate matter deleted from existing law.
*hb0769*
HOUSE BILL 769
F1 2lr1023
HB 1062/21 – W&M CF SB 325
By: Delegates D. Jones and Kaiser
Introduced and read first time: February 3, 2022
Assigned to: Ways and Means
A BILL ENTITLED
AN ACT concerning 1
Student Data Privacy – Protections, Digital Tools, and Student Data Privacy 2
Council 3
FOR the purpose of altering certain definitions to provide increased protections for certain 4
student data; requiring each county board of education to provide a list of digital 5
tools to the State Department of Education on or before a certain date each year; 6
requiring the Department to publish information on digital tools provided by each 7
county board on or before a certain date each year; establishing the Student Data 8
Privacy Council; and generally relating to student data privacy in the State. 9
BY repealing and reenacting, with amendments, 10
Article – Education 11
Section 4–131(a) 12
Annotated Code of Maryland 13
(2018 Replacement Volume and 2021 Supplement) 14
BY adding to 15
Article – Education 16
Section 4–131(p) 17
Annotated Code of Maryland 18
(2018 Replacement Volume and 2021 Supplement) 19
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 20
That the Laws of Maryland read as follows: 21
Article – Education 22
4–131. 23
(a) (1) In this section the following words have the meanings indicated. 24
2 HOUSE BILL 769
(2) (i) “Covered information” means information or material that[: 1
1. Personally identifies an individual student in this State or 2
that is linked to information or material that personally identifies an individual student in 3
this State; and 4
2. Is gathered by an operator through the operation of a site, 5
a service, or an application], ALONE OR IN COMBINAT ION WITH OTHE R INFORMATION 6
OR MATERIAL, IS LINKED OR COULD B E LINKED TO A STUDEN T IN A MANNER THAT 7
WOULD ALLOW AN EMPLO YEE OR A STUDENT OF THE STUDE NT’S SCHOOL TO 8
IDENTIFY THE STUDENT WITH REASONABLE CERT AINTY. 9
(ii) “Covered information” includes a student’s: 10
1. Educational [and disciplinary record] RECORDS AS 11
DEFINED IN § 7–1303 OF THIS ARTICLE ; 12
2. First and last name; 13
3. Home address and geolocation information; 14
4. Telephone number; 15
5. Electronic mail address or other information that allows 16
physical or online contact; 17
6. Test results, grades, and student evaluations; 18
7. Special education [data] INFORMATION ; 19
8. Criminal records; 20
9. Medical records and health records; 21
10. Social Security number; 22
11. Biometric information; 23
12. Socioeconomic information; 24
13. Food purchases; 25
14. Political and religious affiliations; 26
15. Text messages; 27
HOUSE BILL 769 3
16. Student identifiers; 1
17. Search activity; 2
18. Photos; [and] 3
19. Voice recordings; 4
20. DISCIPLINARY INFORMAT ION; 5
21. ONLINE BEHAVIOR OR US AGE OF APPLICATIONS 6
WHEN LINKED OR LINKA BLE TO A SPECIFIC ST UDENT; 7
22. PERSISTENT UNIQUE IDE NTIFIERS; AND 8
23. CONFIDENTIAL INFORMAT ION AS DEFINED BY TH E 9
DEPARTMENT OF INFORMATION TECHNOLOGY. 10
(3) (I) “Operator” means [a person] AN INDIVIDUAL OR AN ENTITY 11
who ENGAGES WITH INSTITU TIONS UNDER THE SCHO OL OFFICIAL EXCEPTIO N OF 12
THE FEDERAL FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT AND is operating in 13
accordance with a contract or an agreement with a public school or local school system in 14
the State to provide an Internet website, an online service, an online application, or a 15
mobile application that: 16
1. PROCESSES COVERED INF ORMATION; AND 17
[(i)] 2. A. Is used [primarily] for a PreK–12 school purpose; 18
OR 19
[(ii)] B. Is issued at the direction of a public school, a teacher, or 20
any other employee of a public school, local school system, or the Department[; and 21
(iii) Was designed and marketed primarily for a PreK–12 school 22
purpose]. 23
(II) “OPERATOR” INCLUDES A DIVISION OF A PARENT ENTITY I F 24
THE DIVISION: 25
1. SERVES EDUCATION CLIE NTS; AND 26
2. DOES NOT SHARE COVERE D INFORMATION WITH T HE 27
PARENT ENTITY . 28
(4) (I) “Persistent unique identifier” means [a unique reference number 29 4 HOUSE BILL 769
used as an identifier in computer software that is stored across different usage sessions] 1
AN IDENTIFIER THAT C AN BE USED TO IDENTI FY, RECOGNIZE, TRACK, SINGLE OUT, 2
OR MAKE REFERENCES A BOUT A STUDENT ENROL LED IN PREKINDERGART EN 3
THROUGH G RADE 12, THE PARENT OR GUARDI AN OF THE STUDENT , AND ANY OTHER 4
STUDENT OF WHOM THE PARENT OR GUARDIAN H AS CUSTODY. 5
(II) “PERSISTENT UNIQUE IDE NTIFIER” INCLUDES: 6
1. COOKIE IDENTIFIERS ; 7
2. CUSTOMER NUMBERS ; 8
3. DEVICE IDENTIFIERS ; 9
4. HASHED E–MAIL ADDRESSES ; 10
5. HASHED PHONE NUMBERS ; 11
6. IDENTIFIERS GENERATED THROUGH PROBABILISTI C 12
METHODS; 13
7. MOBILE AD IDENTIFIERS ; 14
8. UNIQUE PSEUDONYMS ; AND 15
9. USER ALIASES. 16
(5) (i) “PreK–12 school purpose” means an activity that: 17
1. Takes place at the direction of a public school, a teacher, 18
an administrator, or a local school system; or 19
2. Aids in the administration of public school activities. 20
(ii) “PreK–12 school purpose” includes: 21
1. Instruction in the classroom; 22
2. Home instruction; 23
3. Administrative activities; 24
4. Collaboration among students, public school employees, 25
and parents; 26
5. Maintaining, developing, supporting, improving, or 27 HOUSE BILL 769 5
diagnosing the operator’s site, service, or application; and 1
6. An activity that is for the use and benefit of the public 2
school. 3
(6) (i) “Targeted advertising” means presenting advertisements to an 4
individual student that are selected based on information obtained or inferred from the 5
student’s [online behavior, usage of applications, or] covered information. 6
(ii) “Targeted advertising” does not include advertisements 7
presented to an individual student at an online location: 8
1. Based on the student’s current visit to the online location 9
[without] IF THERE IS NO collection or retention of the student’s [online activities] 10
COVERED INFORMATION over time; or 11
2. In response to a single search query [without] IF THERE 12
IS NO collection or retention of the student’s [online activities] COVERED INFORMATION 13
over time. 14
(P) (1) ON OR BEFORE JULY 1, 2022, AND EACH JULY 1 THEREAFTER , 15
EACH COUNTY BOARD SH ALL SUBMIT TO THE DEPARTMENT A LIST OF THE 16
FOLLOWING DIGITAL TO OLS WITH RESPECT TO THE IMMEDIATELY PREC EDING 17
SCHOOL YEAR : 18
(I) APPROVED DIGITAL TOOLS; 19
(II) DIGITAL TOOLS KNOWN T O BE USED BY EDUCATO RS; AND 20
(III) DIGITAL TOOLS NOT AUT HORIZED BY THE COUNT Y BOARD. 21
(2) ON OR BEFORE SEPTEMBER 1, 2022, AND EACH SEPTEMBER 1 22
THEREAFTER , THE DEPARTMENT SHALL PUBL ISH AN ONLINE DATABA SE OF THE 23
DIGITAL TOOLS REPORT ED BY EACH COUNTY BO ARD IN ACCORDANCE WI TH 24
PARAGRAPH (1) OF THIS SUBSECTION . 25
SECTION 2. AND BE IT FURTHER ENACTED, That: 26
(a) In this section, “Council” means the Student Data Privacy Council. 27
(b) There is a Student Data Privacy Council. 28
(c) The Council consists of the following members: 29
(1) one member of the Senate of Maryland, appointed by the President of 30
the Senate; 31 6 HOUSE BILL 769
(2) one member of the House of Delegates, appointed by the Speaker of the 1
House; 2
(3) the State Superintendent of Schools, or the Superintendent’s designee; 3
(4) the Secretary of Information Technology, or the Secretary’s designee; 4
(5) the Executive Director of the Public School Superintendents’ 5
Association of Maryland, or the Executive Director’s designee; 6
(6) the Executive Director of the Maryland Association of Boards of 7
Education, or the Executive Director’s designee; 8
(7) the President of the Maryland Association of Boards of Education, or 9
the President’s designee; 10
(8) the President of the Maryland State Education Association, or the 11
President’s designee; 12
(9) the President of the Maryland PTA, or the President’s designee; and 13
(10) the following members appointed by the Chair of the Council: 14
(i) one School Data Privacy Officer, or the Officer’s designee; 15
(ii) one School Information Technology Officer, or the Officer’s 16
designee; 17
(iii) one representative of a company, trade association, or group who 18
has professional experience in the area of student data privacy or online educational 19
technology services; 20
(iv) one member of the academic community who studies K –12 21
student data privacy; 22
(v) one advocate for student data privacy who does not have a 23
professional relationship with a provider of online educational technology services; 24
(vi) one attorney who is knowledgeable in the laws and regulations 25
that pertain to local school systems; 26
(vii) one school–based administrator from a public school in the State; 27
and 28
(viii) one teacher from a public school in the State. 29
HOUSE BILL 769 7
(d) The State Superintendent of Schools or the Superintendent’s designee shall 1
chair the Council and is responsible for the administration of the Council. 2
(e) The State Department of Education shall provide staff for the Council. 3
(f) A member of the Council: 4
(1) may not receive compensation as a member of the Council; but 5
(2) is entitled to reimbursement for expenses under the Standard State 6
Travel Regulations, as provided in the State budget. 7
(g) The Council shall: 8
(1) study the development and implementation of the Student Data 9
Privacy Act of 2015 to evaluate the impact of the Act on: 10
(i) the protection of covered information from unauthorized access, 11
destruction, use, modification, or disclosure; 12
(ii) the implementation and maintenance of reasonable security 13
procedures and practices to protect covered information under the Act; and 14
(iii) the implementation and maintenance of reasonable privacy 15
controls to protect covered information under the Act; 16
(2) review and analyze similar laws and best practices in other states; 17
(3) review and analyze developments in technologies as they may relate to 18
student data privacy; and 19
(4) make recommendations regarding: 20
(i) statutory and regulatory changes to the Student Data Privacy 21
Act based on the findings of the Council; and 22
(ii) repealing the termination date of this Act to allow the Council to 23
continue its evaluation of student data privacy in the State on a permanent basis. 24
(h) On or before December 1, 2025, the Student Data Privacy Council shall report 25
to the Governor and, in accordance with § 2–1257 of the State Government Article, the 26
General Assembly on: 27
(1) the implementation of § 4–131(p) of the Education Article, as enacted 28
by Section 1 of this Act; and 29
(2) best practices for student data privacy protection for parents and 30 8 HOUSE BILL 769
guardians of students in the State, including: 1
(i) the actions that should occur if an operator engages in an activity 2
prohibited under § 4–131 of the Education Article; 3
(ii) the type of investigation that should be done if an operator is 4
suspected of engaging in an activity prohibited under § 4–131 of the Education Article; 5
(iii) the best remedies available to students and parents in case of an 6
operator engaging in an activity prohibited under § 4–131 of the Education Article; and 7
(iv) any statutory or regulatory changes necessary to best effectuate 8
items (i) through (iii) of this item. 9
SECTION 3. AND BE IT FURTHER ENACTED, That this Act shall take effect June 10
1, 2022. Section 2 of this Act shall remain effective for a period of 6 years and 4 months 11
and, at the end of September 30, 2028, Section 2 of this Act, with no further action required 12
by the General Assembly, shall be abrogated and of no further force and effect. 13