SENATE BILL No. 658

 

 

November 9, 2017, Introduced by Senators SCHUITMAKER, JONES and O'BRIEN and referred to the Committee on Judiciary.

 

 

     A bill to amend 1976 PA 451, entitled

 

"The revised school code,"

 

by amending section 1136 (MCL 380.1136), as added by 2016 PA 367.

 

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

 

     Sec. 1136. (1) To Subject to subsection (7), to protect pupil

 

privacy, the superintendent of public instruction shall ensure that

 

the department complies with all of the following and the state

 

budget director shall ensure that CEPI complies with all of the

 

following:

 

     (a) The department or CEPI shall not sell any information that

 

is part of a pupil's education records.

 

     (b) Within 30 days after the effective date of this section,

 


the department and CEPI each shall post on its website a notice of

 

the information it collects for a pupil's education records. The

 

notice shall include at least an inventory of all pupil data

 

elements collected by the department or CEPI and a description of

 

each pupil data element.

 

     (c) At least 30 days before initiating the collection of any

 

pupil data elements in addition to those already disclosed in the

 

inventory under subdivision (b), the department or CEPI shall post

 

on its website a notice of the additional pupil data elements it is

 

proposing to collect and an explanation of the reasons for the

 

proposal.

 

     (d) The department or CEPI shall not disclose any information

 

concerning a pupil that is collected or created by the department

 

or CEPI except in accordance with a policy adopted and made

 

publicly available by the superintendent of public instruction or

 

state budget director, as applicable, that clearly states the

 

criteria for the disclosure of the information.

 

     (e) The department or CEPI shall ensure that any contract it

 

has with a vendor that allows the vendor access to education

 

records contains express provisions requiring the vendor to protect

 

the privacy of education records and provides express penalties for

 

noncompliance.

 

     (f) If the department or CEPI provides any personally

 

identifiable information concerning a pupil that is collected or

 

created by the department or CEPI as part of the pupil's education

 

records to any person other than the school district, intermediate

 

school district, public school academy, authorizing body,


preschool, or postsecondary institution in which the pupil is

 

currently or was formerly enrolled, or the pupil's parent or legal

 

guardian, then the department or CEPI shall, if the pupil is under

 

18 years of age or claimed as a dependent on a parent's or legal

 

guardian's federal income tax return, disclose to the pupil's

 

parent or legal guardian upon his or her written request all of the

 

following:

 

     (i) The specific data fields that were disclosed.

 

     (ii) The name and contact information of each person, agency,

 

or organization to which the information has been disclosed.

 

     (iii) The reason for the disclosure.

 

     (g) The department or CEPI shall disclose the information

 

under subdivision (f) within 30 days after receiving the written

 

request and without charge to the parent or legal guardian. If the

 

department or CEPI considers it necessary to make redacted copies

 

of all or part of a pupil's education records in order to protect

 

personally identifiable information of another pupil, the

 

department or CEPI shall not charge the parent or legal guardian

 

for the cost of making those copies.

 

     (2) To Subject to subsection (7), to protect pupil privacy,

 

the board of a school district or intermediate school district or

 

board of directors of a public school academy shall ensure that the

 

school district, intermediate school district, or public school

 

academy complies with all of the following, and the governing board

 

of an authorizing body shall ensure that the authorizing body

 

complies with all of the following:

 

     (a) A school district, an intermediate school district, a


public school academy, an educational management organization, or

 

an authorizing body shall not sell or otherwise provide to a for-

 

profit business entity any personally identifiable information that

 

is part of a pupil's education records. This subdivision does not

 

apply to any of the following situations:

 

     (i) For a pupil enrolled in a public school academy, if the

 

public school academy has a management agreement with an

 

educational management organization, the public school academy

 

providing the information to that educational management

 

organization.

 

     (ii) Providing the information as necessary for standardized

 

testing that measures the pupil's academic progress and

 

achievement.

 

     (iii) Providing the information as necessary to a person that

 

is providing educational or educational support services to the

 

pupil under a contract with the school district, intermediate

 

school district, public school academy, or educational management

 

organization.

 

     (b) Upon written request by a pupil's parent or legal

 

guardian, a school district, an intermediate school district, a

 

public school academy, or an authorizing body shall disclose to the

 

parent or legal guardian any personally identifiable information

 

concerning the pupil that is collected or created by the school

 

district, intermediate school district, public school academy, or

 

authorizing body as part of the pupil's education records.

 

     (c) Subject to the exemptions under subsection (3), if a

 

school district, intermediate school district, public school


academy, or authorizing body provides any information described in

 

subdivision (b) to any person, agency, or organization, then the

 

school district, intermediate school district, public school

 

academy, or authorizing body shall disclose to the pupil's parent

 

or legal guardian upon his or her written request all of the

 

following:

 

     (i) The specific information that was disclosed.

 

     (ii) The name and contact information of each person, agency,

 

or organization to which the information has been disclosed.

 

     (iii) The legitimate reason that the person, agency, or

 

organization had in obtaining the information.

 

     (d) A school district, an intermediate school district, a

 

public school academy, or an authorizing body shall disclose the

 

information under subdivisions (b) and (c) within 30 days after

 

receiving the written request and without charge to the parent or

 

legal guardian. If the school district, intermediate school

 

district, public school academy, or authorizing body considers it

 

necessary to make redacted copies of all or part of a pupil's

 

education records in order to protect personally identifiable

 

information of another pupil, the school district, intermediate

 

school district, public school academy, or authorizing body shall

 

not charge the parent or legal guardian for the cost of those

 

copies.

 

     (3) Subsection Subject to subsection (7), subsection (2)(c)

 

does not apply to any of the following situations:

 

     (a) A school district, intermediate school district, public

 

school academy, or authorizing body providing the information to


the department or CEPI.

 

     (b) A school district, intermediate school district, public

 

school academy, or authorizing body providing the information to

 

the pupil's parent or legal guardian.

 

     (c) A public school academy providing the information to its

 

authorizing body or to an educational management organization with

 

which it has a management agreement.

 

     (d) A school district or public school academy providing the

 

information to its intermediate school district or to another

 

intermediate school district providing services to the school

 

district or public school academy or its pupils pursuant to a

 

written agreement.

 

     (e) An intermediate school district providing the information

 

to a school district or public school academy in which the pupil is

 

enrolled or to a school district or public school academy for which

 

the intermediate school district is providing services pursuant to

 

a written agreement.

 

     (f) An authorizing body providing the information to a public

 

school academy in which the pupil is enrolled.

 

     (g) Providing the information to a person, agency, or

 

organization with written consent from the pupil's parent or legal

 

guardian or, if the pupil is at least age 18, the pupil.

 

     (h) Providing the information to a person, agency, or

 

organization seeking or receiving records in accordance with an

 

order, subpoena, or ex parte order issued by a court of competent

 

jurisdiction.

 

     (i) Providing the information as necessary for standardized


testing that measures the pupil's academic progress and

 

achievement.

 

     (j) A school district, intermediate school district, public

 

school academy, or authorizing body providing information that is

 

covered by the opt-out form described in subsection (6), unless the

 

pupil's parent or legal guardian or, if the pupil is at least age

 

18 or is an emancipated minor, the pupil has signed and submitted

 

the opt-out form under subsection (6)(d).

 

     (4) If Subject to subsection (7), if an educational management

 

organization receives information that is part of a pupil's

 

education records from any source as permitted under this section,

 

the educational management organization shall not sell or otherwise

 

provide the information to any other person except as provided

 

under this section.

 

     (5) In addition to ensuring compliance with subsection (1),

 

the superintendent of public instruction shall ensure that the

 

department, and the state budget director shall ensure that CEPI,

 

complies with all other applicable privacy law.

 

     (6) For Subject to subsection (7), for the purposes of this

 

section, each school district, intermediate school district, public

 

school academy, or authorizing body shall do all of the following:

 

     (a) Develop a list of uses for which the school district,

 

intermediate school district, public school academy, or authorizing

 

body commonly would disclose a pupil's directory information.

 

     (b) Develop an opt-out form that lists all of the uses or

 

instances under subdivision (a) and allows a parent or legal

 

guardian to elect not to have his or her child's directory


information disclosed for 1 or more of these uses.

 

     (c) Present the opt-out form under subdivision (b) to each

 

pupil's parent or legal guardian within the first 30 days of the

 

school year. A school district, intermediate school district,

 

public school academy, or authorizing body also shall make the form

 

available to a parent or legal guardian at other times upon

 

request.

 

     (d) If an opt-out form under subdivision (b) is signed and

 

submitted to the school district, intermediate school district,

 

public school academy, or authorizing body by a pupil's parent or

 

legal guardian, the school district, intermediate school district,

 

public school academy, or authorizing body shall not include the

 

pupil's directory information in any of the uses that have been

 

opted out of in the opt-out form.

 

     (7) The department, CEPI, a school district, an intermediate

 

school district, a public school academy, an educational management

 

organization, or an authorizing body shall not disclose the

 

confidential address of a pupil if that pupil or the pupil's parent

 

or legal guardian has obtained a participation card issued by the

 

department of state under the address confidentiality program act.

 

     (8) (7) If a pupil is at least age 18 or is an emancipated

 

minor, the pupil may act on his or her own behalf under subsection

 

(6).

 

     (9) (8) As used in this section:

 

     (a) "Authorizing body" means that term as defined in part 6a,

 

6c, or 6e or section 1311b, as applicable.

 

     (b) "CEPI" means the center for educational performance and


information created under section 94a of the state school aid act

 

of 1979, MCL 388.1694a.

 

     (c) "Confidential address" means that term as defined in the

 

address confidentiality program act.

 

     (d) (c) "Directory information" means that term as defined in

 

34 CFR 99.3.

 

     (e) (d) "Education records" means that term as defined in 34

 

CFR 99.3.

 

     (f) (e) "Educational management organization" means that term

 

as defined in section 503c, 523c, or 553c, as applicable.

 

     (g) (f) "Management agreement" means that term as defined in

 

section 503c, 523c, or 553c, as applicable.

 

     (h) (g) "Personally identifiable information" means that term

 

as defined in 34 CFR 99.3.

 

     Enacting section 1. This amendatory act takes effect 90 days

 

after the date it is enacted into law.

 

     Enacting section 2. This amendatory act does not take effect

 

unless Senate Bill No._655                                      

 

          of the 99th Legislature is enacted into law.