SENATE BILL 833

F5 By: Senator Young Introduced and read first time: January 31, 2014 Assigned to: Education, Health, and Environmental Affairs A BILL ENTITLED 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 AN ACT concerning Educational Agencies and Institutions Education Records Disclosure of Personally Identifiable Information FOR the purpose of authorizing certain educational agencies or institutions to designate a person as an authorized representative to conduct a certain audit, evaluation, or compliance or enforcement activity only if the person is under the direct control of the educational agency or institution; prohibiting a certain educational agency or institution from disclosing personally identifiable information from education records to a contractor, a consultant, or any other person without certain written consent except under certain conditions; authorizing a certain educational agency or institution to disclose personally identifiable information from education records without consent to a person that meets certain requirements and is conducting a certain study; prohibiting a certain educational agency or institution from disclosing personally identifiable information from education records to a person for a certain commercial use or the provision of certain services; prohibiting a certain educational agency or institution from maintaining personally identifiable information from education records without certain written consent except in certain circumstances; prohibiting an educational agency or institution from retaining personally identifiable information on a former student for longer than a certain time period; requiring the State Department of Education, the Maryland Higher Education Commission, each county board of education, and each local school system to disclose certain information on the entitys Web site and to report the information annually to the General Assembly; prohibiting a certain educational agency or institution from appending certain information to education records without certain consent; establishing a penalty for a violation of this Act; providing for the construction of this Act; defining certain terms; and generally relating to the disclosure of personally identifiable information contained in education records by educational agencies and institutions. BY repealing and reenacting, without amendments,
EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.

4lr1651

*sb0833*

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

Article Education Section 1101(a), (d), (f), and (i) Annotated Code of Maryland (2008 Replacement Volume and 2013 Supplement) BY adding to Article Education Section 26401 through 26404 to be under the new subtitle Subtitle 4. Disclosure of Personally Identifiable Information Annotated Code of Maryland (2008 Replacement Volume and 2013 Supplement) SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, That the Laws of Maryland read as follows: Article Education 1101. (a) In this article, unless the context requires otherwise, the following words have the meanings indicated. (d) County board means the board of education of a county and includes the Baltimore City Board of School Commissioners. (f) (i) Department means the State Department of Education. Person includes:

(1) An individual, receiver, trustee, guardian, executor, administrator, fiduciary, or representative of any kind and any partnership, firm, association, public or private corporation, or other entity; and (2) The State, any county, municipal corporation, or other political subdivision of this State, and any of their agencies or units.

SUBTITLE 4. DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION. 26401. (A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS INDICATED. (1) ANY WAY THAT: (B) EDUCATION RECORDS MEANS INFORMATION RECORDED IN

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

(I)

DIRECTLY RELATES TO A STUDENT; AND

OR

(II) IS MAINTAINED BY AN EDUCATIONAL AGENCY INSTITUTION OR BY A PERSON ACTING FOR THE AGENCY OR INSTITUTION.

(2) EDUCATION RECORDS INCLUDES RECORDS RELATING TO AN INDIVIDUAL IN ATTENDANCE AT AN EDUCATIONAL AGENCY OR INSTITUTION WHO IS EMPLOYED AS A RESULT OF THE INDIVIDUALS STATUS AS A STUDENT. (3) EDUCATION RECORDS DOES NOT INCLUDE: (I)

RECORDS THAT ARE KEPT IN THE SOLE POSSESSION OF THE MAKER, USED ONLY AS A PERSONAL MEMORY AID, AND ARE NOT
ACCESSIBLE OR REVEALED TO ANY PERSON OTHER THAN A TEMPORARY SUBSTITUTE FOR THE MAKER OF THE RECORD;

(II) RECORDS OF A LAW ENFORCEMENT EDUCATIONAL AGENCY OR INSTITUTION;

UNIT

OF AN

(III) EXCEPT AS PROVIDED IN PARAGRAPH (2) OF THIS

SUBSECTION, RECORDS RELATING TO AN INDIVIDUAL WHO IS EMPLOYED BY AN EDUCATIONAL AGENCY OR INSTITUTION THAT:

1.
COURSE OF BUSINESS;

ARE MADE AND MAINTAINED IN THE NORMAL

2. RELATE SOLELY TO THE INDIVIDUAL IN THE INDIVIDUALS CAPACITY AS AN EMPLOYEE; AND 3.

PURPOSE;

ARE NOT AVAILABLE FOR USE FOR ANY OTHER

(IV) RECORDS ON A STUDENT WHO IS AT LEAST 18 YEARS OLD OR ATTENDING AN INSTITUTION OF POSTSECONDARY EDUCATION THAT ARE: 1. MADE
OR MAINTAINED BY A PHYSICIAN, PSYCHIATRIST, PSYCHOLOGIST, OR OTHER RECOGNIZED PROFESSIONAL OR PARAPROFESSIONAL ACTING IN A PROFESSIONAL OR PARAPROFESSIONAL CAPACITY;

2.

MADE,

MAINTAINED,

OR

USED

ONLY

IN

CONNECTION WITH TREATMENT OF THE STUDENT; AND

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

3. DISCLOSED ONLY TO INDIVIDUALS WHO ARE PROVIDING TREATMENT OTHER THAN REMEDIAL EDUCATIONAL ACTIVITIES OR ACTIVITIES THAT ARE PART OF THE PROGRAM OF INSTRUCTION; (V) RECORDS CREATED OR RECEIVED BY AN EDUCATIONAL AGENCY OR INSTITUTION AFTER AN INDIVIDUAL IS NO LONGER A STUDENT IN ATTENDANCE AND THAT ARE NOT DIRECTLY RELATED TO THE INDIVIDUALS ATTENDANCE AS A STUDENT; AND (VI) GRADES ON PEERGRADED PAPERS GRADES ARE COLLECTED AND RECORDED BY A TEACHER. (C) (1)
BEFORE THE

EDUCATIONAL AGENCY OR INSTITUTION INCLUDES: (I) (II) THE DEPARTMENT; THE MARYLAND HIGHER EDUCATION COMMISSION;

(III) A COUNTY BOARD; (IV) A LOCAL SCHOOL SYSTEM; AND

(V) A PUBLIC OR PRIVATE PRIMARY SCHOOL, SECONDARY SCHOOL, OR INSTITUTION OF POSTSECONDARY EDUCATION. (2) EDUCATIONAL AGENCY OR INSTITUTION DOES NOT INCLUDE THE MARYLAND LONGITUDINAL DATA SYSTEM ESTABLISHED UNDER TITLE 24, SUBTITLE 7 OF THIS ARTICLE. (D) ELIGIBLE STUDENT MEANS A STUDENT WHO IS AT LEAST 18 YEARS OLD OR ATTENDING AN INSTITUTION OF POSTSECONDARY EDUCATION.
IDENTIFIABLE INFORMATION INFORMATION RELATED TO AN INDIVIDUAL STUDENT.
Comment [NB1]: The comingling of local/state education agencies with institutions creates drafting wrinkles later in the text, where restrictions need to be applied to former but not latter. Can be handled through specific exclusion, but I would have preferred separate definitions. Formatted: Strikethrough Formatted: Strikethrough Comment [NB2]: Excluding the State Longitudinal Data System from the definition would significantly weaken privacy protections of Sect. 26403 (P.9 Line 6 ff.) Not a deal-breaker in terms of coherence of the amendment, but a MJOR issue worth having a policy discussion about. Formatted: Strikethrough

(E)

(1) (2)

PERSONALLY

MEANS

PERSONALLY IDENTIFIABLE INFORMATION INCLUDES: (I) (II) THE NAME OF A STUDENT; THE NAME OF A PARENT OR ANY OTHER FAMILY

MEMBER;

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

(III) THE POSTAL ADDRESS OF A STUDENT OR A FAMILY

MEMBER;

(IV) A PERSONAL IDENTIFIER, INCLUDING A SOCIAL SECURITY NUMBER, STUDENT IDENTIFICATION NUMBER, OR BIOMETRIC RECORD; (V) AN INDIRECT IDENTIFIER, INCLUDING DATE OF BIRTH, PLACE OF BIRTH, OR MOTHERS MAIDEN NAME; (VI)
COMBINATION:

OTHER 1.

INFORMATION

THAT

ALONE

OR

IN

IS LINKED OR LINKABLE TO AN INDIVIDUAL WOULD ALLOW A REASONABLE INDIVIDUAL IN

STUDENT; AND

2.

THE SCHOOL COMMUNITY, WHO DOES NOT HAVE PERSONAL KNOWLEDGE OF THE RELEVANT CIRCUMSTANCES, TO IDENTIFY A STUDENT WITH REASONABLE CERTAINTY; AND

(VII) INFORMATION REQUESTED BY AN INDIVIDUAL WHO THE EDUCATIONAL AGENCY OR INSTITUTION REASONABLY BELIEVES KNOWS THE IDENTITY OF THE STUDENT TO WHOM THE EDUCATION RECORDS RELATE. 26402. (A) AN EDUCATIONAL AGENCY OR INSTITUTION MAY DESIGNATE A
PERSON AS AN AUTHORIZED REPRESENTATIVE TO CONDUCT AN AUDIT, AN EVALUATION, OR A COMPLIANCE OR ENFORCEMENT ACTIVITY THAT REQUIRES, OR IS USED AS THE BASIS FOR GRANTING ACCESS TO PERSONALLY IDENTIFIABLE INFORMATION ONLY IF THE PERSON IS UNDER THE DIRECT CONTROL OF THE EDUCATIONAL AGENCY OR INSTITUTION.

(B) AN EDUCATIONAL AGENCY OR INSTITUTION MAY NOT DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION FROM EDUCATION RECORDS TO A CONTRACTOR, A CONSULTANT, OR ANY OTHER PERSON WITHOUT THE WRITTEN
CONSENT OF A PARENT, A GUARDIAN, OR AN ELIGIBLE STUDENT UNLESS THE CONTRACTOR, CONSULTANT, OR OTHER PERSON:

(1) PERFORMS AN INSTITUTIONAL SERVICE OR FUNCTION OTHERWISE PERFORMED BY AN EMPLOYEE OF THE EDUCATIONAL AGENCY OR INSTITUTION;

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

(2) IS UNDER THE DIRECT CONTROL OF THE EDUCATIONAL AGENCY OR INSTITUTION FOR THE PURPOSE OF THE USE OR MAINTENANCE OF EDUCATION RECORDS; (3)
INDIVIDUALS RECORDS;

LIMITS INTERNAL ACCESS TO EDUCATION RECORDS TO WHO HAVE LEGITIMATE EDUCATIONAL INTERESTS IN THE

(4) DOES NOT USE THE EDUCATION RECORDS FOR ANY PURPOSE THAT IS NOT EXPLICITLY AUTHORIZED BY CONTRACT; (5) DOES NOT DISCLOSE INFORMATION TO ANY OTHER PERSON:
ANY PERSONALLY IDENTIFIABLE

(I) WITHOUT THE PRIOR WRITTEN CONSENT OF A PARENT, A GUARDIAN, OR AN ELIGIBLE STUDENT; OR (II) UNLESS THE DISCLOSURE IS REQUIRED BY LAW OR COURT ORDER AND THE PERSON GIVES NOTICE TO THE PROVIDER OF THE INFORMATION NOT LATER THAN THE TIME THE INFORMATION IS DISCLOSED IF NOTICE IS NOT EXPRESSLY PROHIBITED BY LAW OR COURT ORDER; (6) MAINTAINS REASONABLE ADMINISTRATIVE, TECHNICAL, AND
PHYSICAL SAFEGUARDS TO PROTECT THE SECURITY, CONFIDENTIALITY, AND INTEGRITY OF PERSONALLY IDENTIFIABLE INFORMATION IN THE CUSTODY OF THE CONTRACTOR, CONSULTANT, OR OTHER PERSON;

(7) PROTECTS DATA FROM UNAUTHORIZED DISCLOSURE BY USING A TECHNOLOGY OR METHODOLOGY SPECIFIED IN THE GUIDANCE ISSUED BY THE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES UNDER 13402(H)(2) OF THE FEDERAL AMERICAN RECOVERY AND REINVESTMENT ACT TO RENDER THE DATA UNUSABLE, UNREADABLE, OR INDECIPHERABLE TO UNAUTHORIZED INDIVIDUALS; (8) HAS SUFFICIENT ADMINISTRATIVE AND TECHNICAL PROCEDURES TO MONITOR CONTINUOUSLY THE SECURITY OF PERSONALLY IDENTIFIABLE INFORMATION IN THE CUSTODY OF THE CONTRACTOR, CONSULTANT, OR OTHER PERSON; (9) CONDUCTS A SECURITY AUDIT ANNUALLY AND PROVIDES THE RESULTS OF THE AUDIT TO EACH EDUCATIONAL AGENCY OR INSTITUTION THAT PROVIDED EDUCATION RECORDS;

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

(10) PROVIDES A BREACH REMEDIATION PLAN TO THE EDUCATIONAL AGENCY OR INSTITUTION PRIOR TO THE INITIAL RECEIPT OF EDUCATION RECORDS; (11) REPORTS ALL SUSPECTED SECURITY BREACHES TO THE EDUCATIONAL AGENCY OR INSTITUTION THAT PROVIDED EDUCATION RECORDS AS SOON AS POSSIBLE BUT NOT LATER THAN 48 HOURS AFTER A SUSPECTED BREACH WAS KNOWN OR WOULD HAVE BEEN KNOWN BY EXERCISING REASONABLE DILIGENCE; (12) REPORTS ALL ACTUAL SECURITY BREACHES TO THE EDUCATIONAL AGENCY OR INSTITUTION THAT PROVIDED EDUCATION RECORDS AS SOON AS POSSIBLE BUT NOT LATER THAN 24 HOURS AFTER AN ACTUAL BREACH WAS KNOWN OR WOULD HAVE BEEN KNOWN BY EXERCISING REASONABLE DILIGENCE; (13) IF A SECURITY BREACH OR AN UNAUTHORIZED DISCLOSURE
OF PERSONALLY IDENTIFIABLE INFORMATION OCCURS, PAYS ALL COSTS AND LIABILITIES INCURRED BY THE EDUCATIONAL AGENCY OR INSTITUTION RELATED TO THE BREACH OR DISCLOSURE, INCLUDING THE COSTS OF:

(I)
DISCLOSURE;

RESPONDING TO INQUIRIES ABOUT THE BREACH OR

(II) NOTIFYING INDIVIDUALS POTENTIALLY AFFECTED BY THE BREACH OR DISCLOSURE; (III) MITIGATING THE
DISCLOSURE; AND EFFECTS OF THE BREACH OR

(IV) INVESTIGATING THE CAUSE OR CONSEQUENCES OF THE BREACH OR DISCLOSURE; AND (14) DESTROYS OR RETURNS TO THE EDUCATIONAL AGENCY OR INSTITUTION ALL PERSONALLY IDENTIFIABLE INFORMATION IN THE CUSTODY OF THE CONTRACTOR, CONSULTANT, OR OTHER PERSON ON REQUEST AND AT THE TERMINATION OF THE CONTRACT. (C) AN EDUCATIONAL AGENCY OR INSTITUTION MAY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION FROM EDUCATION RECORDS WITHOUT THE CONSENT OF A PARENT, A GUARDIAN, OR AN ELIGIBLE STUDENT
TO A PERSON THAT:

SENATE BILL 833

1 2 3 4 5 6 7 8

(1)
SECTION; AND

MEETS THE REQUIREMENTS UNDER SUBSECTION (B) OF THIS

(2) IS CONDUCTING A STUDY EDUCATIONAL AGENCY OR INSTITUTION TO: (I)

TEST;

FOR OR ON

BEHALF

OF AN

DEVELOP, VALIDATE, OR ADMINISTER A PREDICTIVE ADMINISTER A STUDENT AID PROGRAM; OR

(II)

(III) IMPROVE INSTRUCTION.

Comment [NB3]: This section articulates the specific public disclosures that must be made before schools, districts, or the state can share personally identifiable information with contractors/researchers without their consent, as allowed under (B) & (C). Intent is to allow for pragmatic, reasonable use of contractors but prevent sloppy privacy/security practices by ensuring reasonable transparency. If schools can't answer these basic questions, they havent thought the contract through.a

(D) PRIOR TO ANY NON-CONSENSUAL DISCLOSURES AUTHORIZED BY SUBSECTIONS (B) OR (C) OF THIS SECTION, EDUCATIONAL AGENCIES OR INSTITUTIONS SHALL PUBLICLY AND CONSPICUOUSLY DISCLOSE ON THEIR WEB SITES AND THROUGH ELECTRONIC NOTIFICATION TO THE CHAIRS OF THE ASSEMBLY AND SENATE EDUCATION COMMITTEES THE EXISTENCE AND CHARACTER OF ANY CONTRACTS OR AGREEMENTS PURSUANT TO WHICH THEY INTEND TO DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION FROM EDUCATION RECORDS TO A CONTRACTOR, OUTSOURCING ENTITY, OR THIRD PARTY CONDUCTING A STUDY. SUCH DISCLOSURE AND NOTIFICATION SHALL INCLUDE: (1) THE NAME AND LOCATION OF THE DATA REPOSITORY WHERE ANY PERSONALLY IDENTIFIABLE INFORMATION WOULD BE MAINTAINED BY A CONTRACTOR, OUTSOURCING ENTITY OR THIRD PARTY; (2) THE PRINCIPAL PURPOSE OR PURPOSES FOR WHICH THE INFORMATION IS INTENDED TO BE USED; (3) THE CATEGORIES OF INDIVIDUALS WHOSE RECORDS WOULD BE DISCLOSED TO THE CONTRACTOR, OUTSOURCING ENTITY, OR THIRD PARTY; (4) THE CATEGORIES OF RECORDS MAINTAINED BY THE CONTRACTOR, OUTSOURCING ENTITY, OR THIRD PARTY; (5) EXPECTED USES OF THE RECORDS DISCLOSED TO THE CONTRACTOR, OUTSOURCING ENTITY, OR THIRD PARTY; (6) THE POLICIES AND PRACTICES OF THE CONTRACTOR, OUTSOURCING ENTITY, OR THIRD PARTY REGARDING STORAGE, RETRIEVABILITY, ACCESS CONTROLS, RETENTION, AND DISPOSAL OF THE RECORDS; (7) THE TITLE AND BUSINESS ADDRESS OF THE DEPARTMENT, DISTRICT BOARD OF EDUCATION, OR INSTITUTIONAL OFFICIAL WHO IS RESPONSIBLE FOR THE CONTRACT OR AGREEMENT, AND THE NAME AND BUSINESS ADDRESS OF THE CONTRACTOR, OUTSOURCING ENTITY, OR THIRD PARTY DIRECTLY RESPONSIBLE FOR EDUCATION RECORDS MAINTAINED PURSUANT TO SAID CONTRACT OR AGREEMENT; (8) THE PROCEDURES WHEREBY ELIGIBLE STUDENTS OR PARENTS CAN BE NOTIFIED AT THEIR REQUEST HOW TO GAIN ACCESS TO ANY RECORD PERTAINING TO THEM OR THEIR CHILDREN MAINTAINED BY THE CONTRACTOR, OUTSOURCING ENTITY, OR THIRD PARTY, AND HOW THEY CAN CONTEST ITS CONTENT; AND (9) THE CATEGORIES OF SOURCES OF RECORDS IN THE DATA REPOSITORY CONTAINING EDUCATION RECORDS;

9 10

(ED) (1)

SUBJECT TO PARAGRAPH (2) OF THIS SUBSECTION, AN

Comment [NB4]: Conforming change Formatted: Strikethrough Comment [NB5]: Addresses current gap between FERPA and COPPA and prevents collection of PII by outside entities without parental consent

EDUCATIONAL AGENCY OR INSTITUTION MAY NOT FACILITATE, ARRANGE, CONTRACT FOR, OR AUTHORIZE A THIRD-PARTY TO COLLECT PERSONALLY IDENTIFIABLE INFORMATION OF ITS STUDENTS, OR DISCLOSE PERSONALLY 11 IDENTIFIABLE INFORMATION FROM EDUCATION RECORDS WITHOUT WRITTEN 12 CONSENT TO A PERSON FOR:

13

(I)

A COMMERCIAL USE, INCLUDING:

SENATE BILL 833

14 15 16 17 18 19 20 21 22 23 24 25 26

1. 2. 3. 4.
PROFILES; OR

MARKETING A PRODUCT OR SERVICE; COMPILING A LIST FOR SALE OR RENTAL; DEVELOPING A PRODUCT OR SERVICE; OR CREATING INDIVIDUAL, HOUSEHOLD, OR GROUP

(II)

THE PROVISION OF ANY SERVICES OTHER THAN

CONTRACTING, STUDIES, AUDITS, OR EVALUATIONS THAT COMPLY WITH THE PROVISIONS SET FORTH IN SUBSECTION (B) OR (C) OF THIS SECTION.

(2) THE WRITTEN CONSENT REQUIRED UNDER PARAGRAPH OF THIS SUBSECTION SHALL:

(1)

(I) BE SIGNED BY A PARENT, A GUARDIAN, OR AN ELIGIBLE STUDENT WITHIN 6 MONTHS BEFORE THE DISCLOSURE; (II) BE DATED;

10

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

(III) IDENTIFY THE RECIPIENT AND THE PURPOSE OF THE

DISCLOSURE; AND

(IV) STATE THAT THE INFORMATION WILL BE USED ONLY FOR THE IDENTIFIED PURPOSE AND NOT DISCLOSED FOR ANY OTHER PURPOSE. 26403. (A) SUBJECT TO SUBSECTION (B) OF THIS SECTION, AN EDUCATIONAL
Comment [NB6]: Subsection (B) should only apply studies: schools, county boards, and the state have perfectly legitimate and important reasons why they need to maintain a subset of records permanently. The way this language is drafted, wed be unable to figure out who is a high school or college graduate in Maryland, since their graduation records would have to be purged. THIS IS A HUGE PROBLEM AND HAS TO BE FIXED! Formatted: Strikethrough

AGENCY OR INSTITUTION MAY NOT DIRECTLY OR THROUGH A CONTRACT WITH ANOTHER PERSON MAINTAIN PERSONALLY IDENTIFIABLE INFORMATION FROM EDUCATION RECORDS WITHOUT THE WRITTEN CONSENT OF A PARENT, A GUARDIAN, OR AN INFORMATION IS: ELIGIBLE STUDENT UNLESS MAINTENANCE OF THE

(1)

EXPLICITLY MANDATED IN FEDERAL OR STATE LAW;

(2) (I) ADMINISTRATIVELY REQUIRED FOR THE PROPER PERFORMANCE OF THE LEGAL DUTIES OF THE EDUCATIONAL AGENCY OR INSTITUTION; AND (II)
SERVICES; OR

Comment [NB7]: Institutionsthe original custodians of education recordsshould certainly be excluded from this limitation. THEY COULDNT FUNCTION OTHERWISE! Formatted: Strikethrough

RELEVANT TO AND NECESSARY FOR DELIVERY OF

(3)
STUDENTS.,

DESIGNED TO SUPPORT A STUDY OF STUDENTS OR FORMER

PROVIDED THAT IT DOES

20

Comment [NB8]: Subsection (B) should only apply to PII collected for studies, not to all PII lawfully held by education agencies. Again, some records must, as a matter of common-sense, be maintained permanently. Formatted: Strikethrough

(B) AN EDUCATIONAL AGENCY OR INSTITUTION MAY NOT RETAIN SUCH 21 PERSONALLY IDENTIFIABLE INFORMATION ON A FORMER STUDENT FOR A 22 PERIOD LONGER THAN 5 YEARS FROM THE DATE OF LATEST ENROLLMENT IN 23 ANY EDUCATIONAL INSTITUTION IN THE STATE.
24 25 26 27 28 29 30 31

Formatted: Strikethrough

(BC) (1) THE DEPARTMENT, THE MARYLAND HIGHER EDUCATION COMMISSION, EACH COUNTY BOARD, AND EACH LOCAL SCHOOL SYSTEM SHALL
DISCLOSE THE EXISTENCE AND CHARACTER OF ANY PERSONALLY IDENTIFIABLE INFORMATION FROM EDUCATION RECORDS THAT THE AGENCY MAINTAINS, DIRECTLY OR THROUGH CONTRACTS WITH OTHER PERSONS, BY PUBLICATION ON THE WEB SITE OF THE AGENCY, INCLUDING:

Comment [NB9]: Conforming change Formatted: Strikethrough

(I) THE NAME AND LOCATION OF EACH DATA REPOSITORY WHERE INFORMATION IS MAINTAINED;

SENATE BILL 833

11

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

THE LEGAL AUTHORITY FOR THE ESTABLISHMENT AND EXISTENCE OF THE DATA REPOSITORY; (III) THE INTENDED PRINCIPAL USE OF OR PURPOSE FOR MAINTAINING THE INFORMATION; (IV) THE CATEGORIES INFORMATION IS MAINTAINED; (V) THE INFORMATION MAINTAINED; (VI)
CATEGORIES OF OF INDIVIDUALS WHOSE

(II)

EDUCATION

RECORDS

AND

EACH EXPECTED DISCLOSURE OF THE EDUCATION RECORDS CONTAINED IN THE DATA REPOSITORY, INCLUDING THE CATEGORIES OF RECIPIENTS AND THE PURPOSE OF THE DISCLOSURE;
REGARDING STORAGE, RETRIEVAL, DISPOSAL OF EDUCATION RECORDS;

(VII) THE POLICIES AND PRACTICES OF THE AGENCY ACCESS CONTROL, RETENTION, AND

(VIII) THE TITLE AND BUSINESS ADDRESS OF THE AGENCY OFFICIAL RESPONSIBLE FOR THE DATA REPOSITORY; (IX) THE TITLE AND BUSINESS ADDRESS OF ANY CONTRACTOR OR OTHER PERSON MAINTAINING THE DATA REPOSITORY FOR OR ON BEHALF OF THE AGENCY; (X) THE PROCEDURES THE AGENCY WILL USE TO NOTIFY A
PARENT, A GUARDIAN, OR AN ELIGIBLE STUDENT IF REQUESTED AND THE DATA REPOSITORY CONTAINS INFORMATION PERTAINING TO THE INDIVIDUAL OR A CHILD OF THE PARENT OR GUARDIAN;

(XI) THE PROCEDURES THE AGENCY WILL USE TO NOTIFY A PARENT, A GUARDIAN, OR AN ELIGIBLE STUDENT, IF REQUESTED, REGARDING HOW TO GAIN ACCESS TO OR CONTEST THE CONTENTS OF EDUCATION RECORDS CONTAINED IN THE DATA REPOSITORY PERTAINING TO THE INDIVIDUAL OR A CHILD OF THE PARENT OR GUARDIAN; AND (XII) THE CATEGORIES OF SOURCES RECORDS AND INFORMATION IN THE DATA REPOSITORY.
OF EDUCATION

(2) THE DEPARTMENT, THE MARYLAND HIGHER EDUCATION COMMISSION, EACH COUNTY BOARD, AND EACH LOCAL SCHOOL SYSTEM SHALL

12

SENATE BILL 833

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

(1) OF THIS SUBSECTION TO THE GENERAL ASSEMBLY IN ACCORDANCE WITH 21246 OF THE STATE GOVERNMENT ARTICLE.
REPORT ANNUALLY THE INFORMATION REQUIRED UNDER PARAGRAPH

(CD) AN EDUCATIONAL AGENCY OR INSTITUTION MAY NOT APPEND

PERSONALLY IDENTIFIABLE INFORMATION OBTAINED FROM FEDERAL OR STATE AGENCIES THROUGH A DATA MATCH TO EDUCATION RECORDS WITHOUT THE WRITTEN CONSENT OF A PARENT, A GUARDIAN, OR AN ELIGIBLE STUDENT UNLESS THE MATCH IS:

Comment [NB10]: Conforming change Formatted: Strikethrough

(1) (2)

EXPLICITLY MANDATED IN FEDERAL OR STATE LAW; OR (I) ADMINISTRATIVELY

REQUIRED FOR THE PROPER PERFORMANCE OF THE LEGAL DUTIES OF THE EDUCATIONAL AGENCY OR INSTITUTION; AND

(II)
SERVICES.

RELEVANT TO AND NECESSARY FOR DELIVERY OF

26404. (A) EXCEPT FOR AN EDUCATIONAL AGENCY OR INSTITUTION, A PERSON THAT VIOLATES ANY PROVISION OF THIS SUBTITLE IS SUBJECT TO A CIVIL PENALTY NOT TO EXCEED: (1) (2)
STUDENT; AND

$1,000 FOR THE FIRST VIOLATION; $5,000 FOR THE SECOND VIOLATION INVOLVING THE SAME $10,000 FOR ANY SUBSEQUENT VIOLATION INVOLVING THE

(3)
SAME STUDENT.

(B) EACH VIOLATION INVOLVING A DIFFERENT INDIVIDUAL EDUCATION RECORD OR STUDENT SHALL BE CONSIDERED A SEPARATE VIOLATION UNDER THIS SUBTITLE. (C) THE PROVISIONS OF THIS SUBTITLE MAY NOT BE CONSTRUED TO:
OF ACTION AGAINST AN

(1) CREATE A PRIVATE RIGHT EDUCATIONAL AGENCY OR INSTITUTION; OR

SENATE BILL 833

13

1 2 3 4 5 6 7

(2)

LIMIT AN ADMINISTRATIVE USE OF EDUCATION RECORDS

THAT IS OTHERWISE REQUIRED BY LAW AND CONDUCTED BY A PERSON ACTING SOLELY IN THE PERSONS CAPACITY AS AN EMPLOYEE OF A COUNTY BOARD, A LOCAL SCHOOL SYSTEM, A STATE AGENCY, A POLITICAL SUBDIVISION OF THE STATE, A COURT, OR THE FEDERAL GOVERNMENT.

SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect July 1, 2014.