PRINTER'S NO. 1315
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No.
342
Session of
2024
INTRODUCED BY CAPPELLETTI, KANE, FONTANA, PENNYCUICK, COSTA,
SCHWANK, DILLON, KEARNEY, BREWSTER AND COLLETT,
JANUARY 8, 2024
REFERRED TO EDUCATION, JANUARY 8, 2024
AN ACT
Amending the act of March 10, 1949 (P.L.30, No.14), entitled "An
act relating to the public school system, including certain
provisions applicable as well to private and parochial
schools; amending, revising, consolidating and changing the
laws relating thereto," providing for school safety practices
and for student online personal data safety practices;
imposing penalties; making an appropriation; and making
editorial changes.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Article XIII-C of the act of March 10, 1949
(P.L.30, No.14), known as the Public School Code of 1949, is
amended by adding a subarticle heading to read:
SUBARTICLE A
SCHOOL SAFETY PRACTICES
Section 2. Sections 1301-C introductory paragraph, 1310-C,
1311-C(a), 1312-C and 1315-C introductory paragraph of the act
are amended to read:
Section 1301-C. Definitions.
The following words and phrases when used in this [article]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
subarticle shall have the meanings given to them in this section
unless the context clearly indicates otherwise:
* * *
Section 1310-C. Employee status.
When acting within the scope of this [article] subarticle,
school police officers shall, at all times, be employees of the
school entity or nonpublic school and shall be entitled to all
of the rights and benefits accruing from that employment.
Section 1311-C. Independent contractors and third-party
vendors.
(a) General rule.--Notwithstanding section 1310-C, a school
entity or nonpublic school may contract with an independent
contractor or third-party vendor to provide school police
officer or school security guard services under this [article]
subarticle.
* * *
Section 1312-C. Construction.
Nothing in this [article] subarticle shall be construed to
preclude a school entity or nonpublic school from employing
other security personnel as the school entity or nonpublic
school deems necessary.
Section 1315-C. Duties of commission.
The commission shall have the following duties under this
[article] subarticle:
* * *
Section 3. Article XIII-C of the act is amended by adding a
subarticle to read:
SUBARTICLE B
STUDENT ONLINE PERSONAL DATA SAFETY PRACTICES
Section 1321-C. Purpose.
20240SB0342PN1315 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
The purpose of this subarticle is to strengthen privacy
protections for students using education services technology by
prohibiting educational technology providers operating in an
educational entity from:
(1) Selling student data.
(2) Using information collected to advertise to students
and families.
(3) Creating student profiles to be used for
noneducation purposes.
Section 1322-C. Definitions.
The following words and phrases when used in this subarticle
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Access software provider." A provider of software,
including client or server software, or enabling tools that do
any of the following:
(1) Filter, screen, allow or disallow content.
(2) Pick, choose, analyze or digest content.
(3) Transmit, receive, display, forward, cache, search,
subset, organize, reorganize or translate content.
"Attorney General." The Attorney General of the
Commonwealth.
"Biometric identifier." A measurable biological or
behavioral characteristic that can be used for automated
recognition of an individual. The following apply:
(1) The term shall include any of the following:
(i) A retina or iris scan.
(ii) A fingerprint.
(iii) A human biological sample.
(iv) A scan of the hand.
20240SB0342PN1315 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(v) A voice print.
(vi) Facial geometry.
(2) The term shall not include any of the following:
(i) A physical description, including height,
weight, hair color or eye color.
(ii) A writing sample.
(iii) A written signature.
(iv) Demographic data.
"Breach of Personal Information Notification Act." The act
of December 22, 2005 (P.L.474, No.94), known as the Breach of
Personal Information Notification Act.
"Chief data security officer." An individual, who may be a
current employee of the department, designated to do the
following:
(1) Assist educational entities with the development of
implementation of policies around data security and data use.
(2) Review all educational entity reports, policies,
plans or any revisions to reports, policies or plans, that
are required by this subarticle to be submitted to the
department or to the chief data security officer.
(3) Conduct outreach to educational entities, provide
notice of guidelines or department development or revision of
models required under this subarticle.
(4) Provide student data related information, material,
model language or resources requested by an educational
entity.
(5) Review contracts submitted by educational entities
and advise educational entities of any noncompliance issues
an educational entity may experience under this subarticle.
(6) Compile each educational entity's report of
20240SB0342PN1315 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
compromise of student data submitted as required under
section 1324-C(c), the data contained in the compromise
report and the provider contracted with when the compromise
occurred. The chief data security officer shall:
(i) Upon receipt of an occurrence of compromise from
an educational entity, notify the secretary of the
compromise. The report shall include the date of the
occurrence of a compromise of student data and identify
the providers upon receipt of the report of the provider
by the educational entity of the steps taken by the
provider to cure the deficiency in the data system that
facilitated the compromise, the chief data security
officer shall review and submit the report to the
secretary.
(ii) Enter into a searchable database the
educational entity and the provider involved in each
compromise. The entry shall include the date of the
compromise and the date of the provider's resolution of
the compromise. The chief data security officer shall
assign a risk level to the situation of compromise. A
provider shall be deemed a high risk when the severity,
frequency, level of compromise or any other factors the
chief data security officer deems relevant indicates the
provider offers services with a potential for exposure of
student data.
(iii) Monitor the compromise for the purpose of
determining the risk level of the compromise and updating
the provider's record of risk in the searchable database,
as appropriate.
(7) Maintain a list of providers, contact information
20240SB0342PN1315 - 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
and the services a provider offers to each educational
entity. The list shall include the risk level assessed to the
provider if the provider is recorded in the database created
in paragraph (6)(ii).
(8) Perform any other duty the department deems
necessary for a chief data security officer to perform in
furthering the protection of student data.
"Children's Online Privacy Protection Act." The Children's
Online Privacy Protection Act (Public Law 105-277, Div. C, Title
XIII).
"Department." The Department of Education of the
Commonwealth.
"Educational entity." A school district, charter school,
cyber charter school, private school, private residential
rehabilitative institution, nonpublic school, intermediate unit
or area career and technical school operating within this
Commonwealth.
"Educational record." Student data or other student
information created and maintained by an educational entity or a
third party.
"Family Educational Rights and Privacy Act." The Family
Educational Rights and Privacy Act of 1974 (Public Law 90-247,
20 U.S.C. § 1232g).
"IEP." An Individualized Education Plan under the
Individuals with Disabilities Education Act.
"Individuals with Disabilities Education Act." The
Individuals with Disabilities Education Act (Public Law 91-230,
20 U.S.C. § 1400 et seq.).
"Information service." The offering of a capability for
generating, acquiring, storing, transforming, processing,
20240SB0342PN1315 - 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
retrieving, utilizing or making available information via
telecommunications. The term includes electronic publishing, but
does not include any use of a capability for the management,
control or operation of a telecommunications system or the
management of a telecommunications service.
"Interactive computer service." An information service,
system or access software that provides or enables computer
access by multiple users to a computer server, including a
service or system that provides access to the Internet and the
systems operated or services offered by libraries or educational
institutions.
"Interested parties." A third-party vendor, provider,
nonprofit advocacy organization, the Office of Attorney General
or any other organization or entity that the department deems
necessary.
"K-12 school purposes." A purpose that customarily takes
place at the direction of the K-12 school, teacher or
educational entity or aids in the administration of school
activities, including instruction in the classroom or at home,
administrative activities and collaboration between students,
school personnel or parents or guardians or that is for the use
and benefit of the school.
"Online service." Online service, including cloud computing
services, provided by an entity subject to this subarticle.
"Privacy of Social Security Numbers Law." The act of June
29, 2006 (P.L.281, No.60), referred to as the Privacy of Social
Security Numbers Law.
"Protection of Pupil Rights Amendment." 20 U.S.C. § 1232h
(relating to protection of pupil rights).
"Provider." Any of the following which enter into a written
20240SB0342PN1315 - 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
or oral contract with an education entity to provide related
goods or services for the current school year:
(1) A third-party vendor, contractor, subcontractor,
corporation, partnership, business trust, foundation, limited
liability company, corporation or partnership, incorporated
or unincorporated association, organization or any other
legal entity.
(2) A government entity, other than the Commonwealth.
(3) A natural person.
"Secretary." The Secretary of Education of the Commonwealth.
"Section 504 plan." A plan prescribed by the Rehabilitation
Act of 1973 (Public Law 93-112, 29 U.S.C. § 701 et seq.).
"Student data." Personally identifiable information or
material regarding a student that is descriptive of the student
and collected and maintained at the individual student level,
notwithstanding the physical, electronic or other media format,
including any of the following:
(1) The following information regarding the student:
(i) Name.
(ii) Date and location of birth.
(iii) Social Security number.
(iv) Gender.
(v) Race.
(vi) Ethnicity.
(vii) Tribal affiliation.
(viii) Sexual identity or orientation.
(ix) Migrant status.
(x) English language learner status.
(xi) Disability status.
(xii) Mother's maiden name.
20240SB0342PN1315 - 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(xiii) Contact information, including telephone
numbers, email addresses, physical addresses, home
address, geolocation information and other distinct
contact identifiers.
(xiv) Text messages, photos, voice recordings or
documents.
(xv) Search identifiers or search activities.
(xvi) Disabilities.
(xvii) Special education records or an applicable
mandate under the Individuals with Disabilities Education
Act.
(xviii) An IEP, Section 504 plan or other written
education plan, including special education evaluation
data for the program or plan.
(xix) A student's identification number.
(xx) State or local assessment results or the reason
for an exception from taking a State or local assessment.
(xxi) Courses taken and completed, credits earned or
other transcript information.
(xxii) Course grades, grade point average,
evaluations or another indicator of academic achievement.
(xxiii) Cohort graduation rate or related
information.
(xxiv) Degree, diploma, credential attainment or
other school exit information.
(xxv) Attendance and mobility.
(xxvi) Dropout data.
(xxvii) An immunization record or the reason for an
exception from receiving an immunization.
(xxviii) Remediation efforts.
20240SB0342PN1315 - 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(xxix) Cumulative disciplinary records.
(xxx) Juvenile delinquency records.
(xxxi) Criminal records.
(xxxii) Medical or health records created or
maintained by an educational entity, including test
results.
(xxxiii) Political affiliation, voter registration
information or voting history.
(xxxiv) Income or other socioeconomic information,
except as required by law or if an educational entity
determines income information is required to apply for,
administer, research or evaluate programs to assist
students from low-income families.
(xxxv) Religious information or beliefs.
(xxxvi) A biometric identifier or other biometric
information.
(xxxvii) Food purchases.
(xxxviii) Geolocation data.
(xxxix) Any other information that either on its own
or collectively could reasonably be used to identify a
specific student.
(2) The following information regarding family members,
including parents and legal guardians, of the student:
(i) Name of family members.
(ii) Contact information for family members,
including telephone numbers, email addresses, physical
addresses and other distinct contact identifiers.
(iii) Education status, an educational record or
student data of a family member who is a student.
(3) The following data required or captured by a
20240SB0342PN1315 - 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
provider during any of the following uses of a provider's
Internet website, service or application for K-12 purposes:
(i) The student or the student's parent or legal
guardian.
(ii) An employee or agent of the K-12 educational
entity.
(iii) The department.
(iv) A county department of education.
(v) An intermediate unit.
(4) Data, information or material that is gathered by a
provider through the operation of a site, service or
application used primarily for K-12 school purposes and that
is descriptive of a student or otherwise identifies a
student, including student data under paragraphs (1) and (2).
"Targeted marketing." Advertising to a student or a
student's parent or legal guardian that is selected based on
information obtained or inferred from the student's online or
offline behavior, usage of applications or student data. The
term does not include:
(1) Advertising to a student at an online location based
on the student's current visit to the location or single
search query without collection and retention of the
student's online activities over time.
(2) Use of the student's personally identifiable student
data to identify for the student institutions of higher
education or scholarship providers that are seeking students
who meet specific criteria, if a written data authorization
by the student or the student's parent or legal guardian, if
the student is under 18 years of age, permits the disclosure
of use.
20240SB0342PN1315 - 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
"Third-party vendor." The provider of a publicly accessible
Internet website, online service, online application or mobile
application with actual knowledge that the site, service or
application is used primarily for K-12 school purposes, was
designed and marketed for K-12 school purposes and has entered
into a contract with an educational entity to provide a related
good or service. The term includes a subcontractor.
Section 1323-C. Department duties and responsibilities.
(a) Duties.--Within six months of the effective date of this
subsection, the department shall:
(1) Develop guidelines for the educational entities' use
of a State data system third-party platform to assist
educational entities in protecting student data.
(2) In consultation with interested parties, develop a
definition for best practices for the protection of student
data and model policies and procedures that an educational
entity may use in the following areas:
(i) The educational entity's student data privacy
protection and security plan with procedures to protect
student records, and student data, including critical
infrastructures of student data processes and procedures,
in accordance with this subarticle.
(ii) The provider's protection of student data,
including best practices strategies for student data
security.
(iii) Training programs.
(iv) Materials and resources for staff, students,
parents, guardians and providers on student data privacy
and protection issues based on best practices for the
protection of student data and the use of provider
20240SB0342PN1315 - 12 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
platforms.
(v) Protection of information from unauthorized
access, destruction, use, modification or disclosure.
(vi) A model review process for an educational
entity to implement to respond to a request for data for
the purpose of external research or evaluation.
(3) Each year, in consultation with interested parties,
review the definition for best practices and update as
needed.
(4) Post on the department's publicly accessible
Internet website the model policies and procedures developed
under this subsection.
(5) Develop model contracts in accordance with the
following:
(i) The department shall develop a model contract
for use between educational entities and providers to
ensure that the requirements of this subarticle are
incorporated with the educational entities' use of
technologies and that providers are contractually bound
to sustain, enhance and not erode privacy protections
relating to the use, collection and disclosure of student
data. The department shall consult with interested
parties, for the establishment of guidance and the model
contract. The model contract shall be reviewed on a
biennial basis and revised if necessary.
(ii) An educational entity shall not be required to
use the model contract to meet the requirements of this
subarticle. The model contract is to be provided by the
department for an educational entity to use as a model
for an educational entity's interactive computer service
20240SB0342PN1315 - 13 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
contract if the educational entity, in its sole
discretion, deems it necessary.
(b) Chief data security officer.--Within 60 days of the
effective date of this subsection, the secretary shall designate
a chief data security officer within the department.
(c) Report.--The department shall submit an annual report to
the General Assembly on the protection of student data,
including a description of all data collected from educational
entities under this subarticle, the findings from the
department's review of best practices required under subsection
(a)(3) and recommendations for improvements in protection of
student data requirements the department intends to review,
investigate or implement or status of implementation of any
recommendation made in a prior annual report.
(d) Construction.--Nothing in this section shall be
construed to interfere with the ability of the department to
assign or designate existing employees of the department or hire
other persons to assist with or provide staff for performing the
duties of the chief data security officer.
Section 1324-C. Educational entity duties and responsibilities.
(a) Policy.--Within one year of the effective date of this
subsection, each educational entity shall adopt a written policy
regarding:
(1) Third-party vendor protection of student data
policy.
(2) Reasonable security policies and procedures to
protect student records and student data, in accordance with
this subarticle to protect information from unauthorized
access, destruction, use, modification or disclosure.
(3) A process for a request for external research or
20240SB0342PN1315 - 14 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
evaluation of student data. The process for a student's
parents or legal guardian request to review personally
identifiable data that is contained in student information,
student records or student generated content shall include
provider specific response process and a procedure through
the provider to correct erroneous information.
(4) The policies adopted under this subsection may be
based on the model policies developed by the department under
section 1323-C(a).
(5) The policies under this subsection shall be in
addition to requirements of the Family Educational Rights and
Privacy Act, Protection of Pupil Rights Amendment, Children's
Online Privacy Protection Act and any regulations promulgated
under the acts, the Breach of Personal Information
Notification Act, Privacy of Social Security Numbers Law and
any regulations promulgated under the acts and any other
Federal or State data privacy and security laws applicable to
educational entities. This subarticle is not intended to
limit the educational entities under the laws.
(b) Policy.--
(1) Within 10 days after adoption of any policy or any
revision made to a previously adopted policy, the educational
entity shall submit the policy or the revised policy to the
chief data security officer for review.
(2) In the event that the chief data security officer
finds any of the policies or revisions to be noncompliant
with this subarticle, the chief data security officer shall
provide the educational entity with notice of noncompliance.
Notice shall include an explanation of findings and
recommendations to cure deficiencies found. The educational
20240SB0342PN1315 - 15 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
entity shall have 60 days to adopt a revised policy with any
deficiencies cured. Within 10 days after adoption, the
educational entity shall submit the policy to the chief data
security officer for review.
(c) Compromise.--Within 10 days of an educational entity
being notified or becoming aware of a compromise of student
data, the following shall apply:
(1) The educational entity shall submit information to
the chief data security officer of the occurrence of the
compromise.
(2) The educational entity shall request the following
information from the provider:
(i) The number of students affected by the
compromise.
(ii) The status of the compromise.
(iii) The steps taken by the provider to cure the
deficiencies in the data system that facilitated the
compromise of the data.
(3) The provider shall have five days to issue a report
of the requested information.
(4) Upon receipt of the report, the educational entity
shall submit the report to the chief data security officer.
Section 1325-C. Interactive computer service contract.
(a) Contract.--
(1) An educational entity may enter into a contract with
a provider for goods and services related to interactive
learning, access software or online communication services,
including on-site learning services, remote online learning
services, quasi remote online learning services, virtual
video and audio conferencing, to be used primarily for K-12
20240SB0342PN1315 - 16 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
school purposes. The contract must be in writing and signed
by each party. Within 10 days of entering a contract with a
provider, an educational entity shall report to the chief
data security officer the name of the provider, provider
contact information and a list of services contracted for
with the provider.
(2) A contract with a provider entered into by the
educational entity prior to the effective date of this
paragraph shall be reviewed by the governing body of the
educational entity within 60 days of the effective date of
this paragraph to determine if any provisions are contrary to
this subarticle. In the event there is a determination that
there are provisions of the contract contrary to this
subarticle, the educational entity shall:
(i) with the consent of all parties, modify the
contract to comply with this subarticle; or
(ii) terminate the contract and the provider awarded
the contract shall be compensated for the actual expenses
reasonably incurred under the contract prior to the
termination. The compensation shall not include loss of
anticipated profit, loss of use of money or
administrative overhead cost.
(b) Terms.--The service or goods under the contract may
include educational learning tools or communication platforms
requiring the use of student data only if the contract with the
provider contains binding terms for:
(1) Implementation and maintenance of reasonable
security procedures and practices appropriate for student
data.
(2) Protection of student data from unauthorized access,
20240SB0342PN1315 - 17 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
destruction, use, modification or disclosure.
(3) Deletion of student data if the educational entity
requests deletion of student data that is under the control
of the educational entity.
(4) Assurance that any contract the provider enters with
any subcontractor will contain the same binding provisions
that the provider is subject to and the same protections and
prohibited uses of student data for the subcontractor.
(b.1) Damages.--The use of student data contrary to the
provisions of this subarticle shall subject the provider to all
remedies and damages available to the student or the student's
parent or legal guardian and the educational entity. The payment
of damages for actual costs incurred by the educational entity
for any and all occurrences of a violation or a compromise of
student information, records or content, shall be the
responsibility of the provider if damages were caused by the
provider's failure to protect student data.
(c) Duties to be included.--A contract for goods or services
with a provider shall contain, at a minimum, the duties and
requirements under section 1326-C.
(d) Use of model contract.--An educational entity, in its
sole discretion, may base its contract on the model contract
developed by the department or may develop an original contract
to meet the requirements of this subarticle.
(e) Limitation.--Except when applicable in Federal or State
law, or clearly expressed in this subarticle, the selling or
disclosing of student data prohibition does not apply to a
merger or acquisition of a provider by another provider when the
acquiring or successor provider continues to be subject to this
subarticle and the prohibition of acts, uses or disclosures of
20240SB0342PN1315 - 18 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
student data, including any student data obtained through the
merger or acquisition.
Section 1326-C. Third-party vendor duties and responsibilities.
(a) Student data use and disclosure.--A third-party vendor
may:
(1) Use or disclose student data to ensure legal and
regulatory compliance, including complying with requirements
of Federal and State law in protecting and disclosing the
data.
(2) Disclose student data to respond to or participate
in the judicial process.
(3) Disclose student data to a service provider or a
subsequent subcontractor that may accompany the third-party
vendor in the provision of the good or service, if the third-
party vendor contractually prohibits the use of the student
data for any purpose other than providing the contracted
service to, or on behalf of, the third-party vendor,
prohibits the disclosure of student data provided by the
third-party vendor with subsequent third parties and requires
the implementation and maintenance of reasonable security
procedures and practices required of the third-party vendor
under section 1325-C(c).
(b) Merger or sale.--In the event of a merger or sale by a
provider to a third party, the following shall apply:
(1) A provider shall delete student data if the
educational entity requests deletion of student data under
the control of the educational entity.
(2) A provider may disclose student data to a service
provider or a subsequent subcontractor if the acquiring
service provider, provider or subsequent subcontractor agrees
20240SB0342PN1315 - 19 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
to be subject to this subarticle with respect to previously
acquired student data and subsequently acquired student data.
(3) A provider shall provide notification to the
educational entity at least 60 days prior to the sale or
merger.
(4) An educational entity shall have the right to
terminate the existing contract with the provider with no
compensation for early termination or damages to the
provider.
Section 1327-C. Construction.
(a) Duty not imposed.--Notwithstanding any other provision
under this subarticle, this subarticle shall not impose a duty
upon:
(1) An electronic store, gateway, marketplace or other
means of purchasing or downloading software or applications
to review or enforce compliance of this section on the
applications or software.
(2) An interactive computer service to review or enforce
compliance with this section by third-party content
providers.
(b) Ability not limited.--Nothing under this subarticle
shall be construed to prohibit or otherwise limit the ability
of:
(1) An educational entity from reporting or making
available aggregate student data or other collective data for
reasonable usage.
(2) A third-party vendor from using student data,
including information protected in this subarticle, for the
purposes of adaptive learning or customized student learning
purposes or for maintaining, developing, supporting,
20240SB0342PN1315 - 20 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
improving or diagnosing the third-party vendor's publicly
accessible Internet website, service or application.
(3) A third-party vendor from marketing educational
products directly to parents or students if the marketing did
not result from the use of student data obtained by the
third-party vendor through the provisions of goods or
services covered under this subarticle.
(4) An Internet service provider from providing Internet
connectivity to schools or students and their families.
(5) A student or the student's parent or legal guardian
to download, export or save or maintain student data.
Section 1328-C. Enforcement.
A provider that fails to comply with a duty or other
provision under this chapter resulting in a data breach or
security compromise shall be subject to the following penalties
and process:
(1) The Bureau of Consumer Protection in the Office of
Attorney General shall investigate any complaints received
concerning violations of this subarticle. If, after
investigating a complaint, the Attorney General finds that
there has been a violation of this subarticle, the Attorney
General may bring an action to impose a civil penalty up to
$10,000 for each violation and to seek other relief,
including injunctive relief, restitution and costs under the
act of December 17, 1968 (P.L.1224, No.387), known as the
Unfair Trade Practices and Consumer Protection Law.
(2) Prior to the initiation of a civil action, the
Attorney General may require the attendance and testimony of
witnesses and the production of documents. For this purpose,
the Attorney General may issue subpoenas, examine witnesses
20240SB0342PN1315 - 21 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
and receive evidence. If a person objects to or otherwise
fails to comply with a subpoena or request for testimony, the
Attorney General may file in Commonwealth Court or any court
of record of the Commonwealth an action to enforce the
subpoenas or request. Noti ce of hearing of the action and a
copy of each pleading shall be served upon the person who may
appear in opposition.
(3) Testimony taken or material produced shall be kept
confidential by the Attorney General except to the extent
that the information may be used in a judicial proceeding, if
the disclosure is authorized by the court for good cause
shown or confidentiality is waived by the person being
investigated and by the person who has testified, answered
interrogatories or produced materials.
Section 1329-C. Criminal and civil liability.
Nothing under this subarticle shall limit, preclude or
supersede an action for criminal or civil liabilities applicable
or enforceable under a Federal or State law.
Section 1330-C. Regulations.
(a) General rule.--The State Board of Education, in
consultation with the Office of Attorney General, shall develop
regulations necessary to implement this subarticle .
(b) Final-omitted regulations.--Within one year of the
effective date of this subsection, the State Board of Education
shall promulgate final-omitted regulations under the act of June
25, 1982 (P.L.633, No.181), known as the Regulatory Review Act.
Section 4. The sum of $500,000 shall be appropriated from
the General Fund to the Department of Education for the purposes
of implementation of the provisions of this act.
Section 5. This act shall take effect in six months.
20240SB0342PN1315 - 22 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30