SB-0033, As Passed Senate, November 4, 2015

SUBSTITUTE FOR

SENATE BILL NO. 33

     A bill to amend 1976 PA 451, entitled

"The revised school code,"

(MCL 380.1 to 380.1852) by adding section 1136.

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

     Sec. 1136. (1) To protect pupil privacy, the state board shall

ensure that the department complies with all of the following and

the state budget director shall ensure that CEPI complies with all

of the following:

     (a) The department or CEPI shall not sell any information that

is part of a pupil's education records.

     (b) Within 30 days after the effective date of this section,

the department and CEPI each shall post on its website a notice of

the information it collects for a pupil's education records. The

notice shall include at least an inventory of all pupil data

elements collected by the department or CEPI and a description of

each pupil data element.

     (c) At least 30 days before initiating the collection of any

pupil data elements in addition to those already disclosed in the

inventory under subdivision (b), the department or CEPI shall post

on its website a notice of the additional pupil data elements it is

proposing to collect and an explanation of the reasons for the

proposal.

     (d) The department or CEPI shall not disclose any information

concerning a pupil that is collected or created by the department

or CEPI except in accordance with a policy adopted and made

publicly available by the state board or state budget director, as

applicable, that clearly states the criteria for the disclosure of

the information.

     (e) The department or CEPI shall ensure that any contract it

has with a vendor that allows the vendor access to education

records contains express provisions requiring the vendor to protect

the privacy of education records and provides express penalties for

noncompliance.

     (f) If the department or CEPI provides any personally

identifiable information concerning a pupil that is collected or

created by the department or CEPI as part of the pupil's education

records to any person other than the school district, intermediate

school district, public school academy, authorizing body,

preschool, or postsecondary institution in which the pupil is

currently or was formerly enrolled, or the pupil's parent or legal

guardian, then the department or CEPI shall, if the pupil is under

18 years of age or claimed as a dependent on a parent's or legal

guardian's federal income tax return, disclose to the pupil's

parent or legal guardian upon his or her written request all of the

following:

     (i) The specific data fields that were disclosed.

     (ii) The name and contact information of each person, agency,

or organization to which the information has been disclosed.

     (iii) The reason for the disclosure.

     (g) The department or CEPI shall disclose the information

under subdivision (f) within 30 days after receiving the written

request and without charge to the parent or legal guardian. If the

department or CEPI considers it necessary to make redacted copies

of all or part of a pupil's education records in order to protect

personally identifiable information of another pupil, the

department or CEPI shall not charge the parent or legal guardian

for the cost of making those copies.

     (2) To protect pupil privacy, the board of a school district

or intermediate school district or board of directors of a public

school academy shall ensure that the school district, intermediate

school district, or public school academy complies with all of the

following, and the governing board of an authorizing body shall

ensure that the authorizing body complies with all of the

following:

     (a) A school district, an intermediate school district, a

public school academy, an educational management organization, or

an authorizing body shall not sell or otherwise provide to a for-

profit business entity any personally identifiable information that

is part of a pupil's education records. This subdivision does not

apply to any of the following situations:

     (i) For a pupil enrolled in a public school academy, if the

public school academy has a management agreement with an

educational management organization, the public school academy

providing the information to that educational management

organization.

     (ii) Providing the information as necessary for standardized

testing that measures the pupil's academic progress and

achievement.

     (iii) Providing the information as necessary to an individual or

entity that is providing educational or educational support

services to the pupil under a contract with the school district,

intermediate school district, public school academy, or educational

management organization.

     (b) Upon written request by a pupil's parent or legal

guardian, a school district, an intermediate school district, a

public school academy, or an authorizing body shall disclose to the

parent or legal guardian any personally identifiable information

concerning the pupil that is collected or created by the school

district, intermediate school district, public school academy, or

authorizing body as part of the pupil's education records.

     (c) Subject to the exemptions under subsection (3), if a

school district, intermediate school district, public school

academy, or authorizing body provides any information described in

subdivision (b) to any person, agency, or organization, then the

school district, intermediate school district, public school

academy, or authorizing body shall disclose to the pupil's parent

or legal guardian upon his or her written request all of the

following:

     (i) The specific information that was disclosed.

     (ii) The name and contact information of each person, agency,

or organization to which the information has been disclosed.

     (iii) The legitimate reason that the person, agency, or

organization had in obtaining the information.

     (d) A school district, an intermediate school district, a

public school academy, or an authorizing body shall disclose the

information under subdivisions (b) and (c) within 30 days after

receiving the written request and without charge to the parent or

legal guardian. If the school district, intermediate school

district, public school academy, or authorizing body considers it

necessary to make redacted copies of all or part of a pupil's

education records in order to protect personally identifiable

information of another pupil, the school district, intermediate

school district, public school academy, or authorizing body shall

not charge the parent or legal guardian for the cost of those

copies.

     (3) Subsection (2)(c) does not apply to any of the following

situations:

     (a) A school district, intermediate school district, public

school academy, or authorizing body providing the information to

the department or CEPI.

     (b) A school district, intermediate school district, public

school academy, or authorizing body providing the information to

the pupil's parent or legal guardian.

     (c) A public school academy providing the information to its

authorizing body or to an educational management organization with

which it has a management agreement.

     (d) A school district providing the information to its

intermediate school district.

     (e) An intermediate school district providing the information

to a school district in which the pupil is enrolled.

     (f) An authorizing body providing the information to a public

school academy in which the pupil is enrolled.

     (g) Providing the information to a person, agency, or

organization with written consent from the pupil's parent or legal

guardian or, if the pupil is at least age 18, the pupil.

     (h) Providing the information to a person, agency, or

organization seeking or receiving records in accordance with an

order, subpoena, or ex parte order issued by a court of competent

jurisdiction.

     (i) Providing the information as necessary for standardized

testing that measures the pupil's academic progress and

achievement.

     (4) If an educational management organization receives

information that is part of a pupil's education records from any

source as permitted under this section, the educational management

organization shall not sell or otherwise provide the information to

any other person except as provided under this section.

     (5) In addition to ensuring compliance with subsection (1),

the state board shall ensure that the department, and the state

budget director shall ensure that CEPI, complies with all other

applicable privacy law.

     (6) As used in this section:

     (a) "Authorizing body" means that term as defined in part 6a,

6c, or 6e or section 1311b, as applicable.

     (b) "CEPI" means the center for educational performance and

information created under section 94a of the state school aid act

of 1979, MCL 388.1694a.

     (c) "Education records" means that term as defined in 34 CFR

99.3.

     (d) "Educational management organization" means that term as

defined in section 503c, 523c, or 553c, as applicable.

     (e) "Management agreement" means that term as defined in

section 503c, 523c, or 553c, as applicable.

     (f) "Personally identifiable information" means that term as

defined in 34 CFR 99.3.

     Enacting section 1. This amendatory act takes effect 90 days

after the date it is enacted into law.