Online Service Providers Must Now Protect Student Information

SB 1177 will add Business and Professions Code section 22584, requiring operators of educational internet websites, online services, online applications, and mobile applications to refrain from practices that compromise the security of student information or impinge on student privacy. As of January 1, 2016, online vendors that provide services to K-12 students, whether in the classroom or at home, are prohibited from advertising to students and using, selling or disclosing information gathered from students, with limited exceptions. Additionally, technology vendors must implement and maintain reasonable security measures to protect student data. This bill also empowers schools and school districts with the right to demand that technology vendors delete their copies of student data.

Limitations on Gathering and Using Information from Social Media

AB 1442 limits the types of information an educational agency may collect from social media sources regarding students. The bill adds Education Code section 49073.6, which will apply to school districts, county offices of education and charter schools as of January 1, 2015. Under this statute, educational agencies that consider establishing a program to collect information from social media sources regarding students must first notify student and parents of the proposal, and give the public an opportunity to comment on the proposal at a regularly scheduled meeting of the educational agency's governing board. The notice and comment period is a prerequisite to the educational agency's ability to collect and use student information gathered from any social media source.

Once the program is established, the educational agency may only collect information that is directly related to school or pupil safety. Like traditional student records, students and parents are entitled to access the information educational agencies gather from social media, and have the right to challenge the veracity of the information. However, unlike other student records, the information gathered from social media sources must be destroyed within one year of the student turning 18, or from the student's departure from the educational agency, whichever occurs first. The statute also provides protections against third party use of the information gathered where the district contracts with a third party to gather such information. Contracts with third parties will likely need to incorporate certain of these statutory requirements.

Over the years, Lozano Smith has been on the forefront in advising school districts on legal issues related to the use of technology, including protecting student and employee information. Preparing students for the 21st century is sometimes hindered by 20th century laws, making it all the more important to give thought to how new technology can be used. Many of the new laws discussed above have at last begun to give express legal authority in support of best practices that we have recommended and our clients have implemented in recent years. The new laws may prove particularly helpful when dealing with larger internet, software and cloud computing providers, who have sometimes resisted these types of specific protections.

Our Technology and Innovation practice area has years of experience in reviewing and drafting technology-related contracts, advising on social media issues, developing email retention and electronic communications policies, and providing counsel to school districts and municipalities on a wide array of emerging technology matters. If you have any questions regarding such matters, please contact one of our eight offices located statewide. You can also visit our website, follow us on Facebook or Twitter, or download our Client News Brief App.