Lege Trend: Student Data Security Bills in KeyStone State. 9 Prohibitions for Education Vendors.

Multiple bills dealing with protecting student data have been filed in the Pennsylvania legislature.

The bills include provision to set standards on education vendors for:

  • Prohibit tapping student information to target them with advertising;
  • Prohibit amassing profiles of students for non-educational purposes; 
  • Prohibit the sale or sharing of student information outside of narrow circumstances.
  • Require vendors to secure student data and delete it all upon the district’s request.
  • Districts could continue to hire cloud computing firms to handle student data.
  • Vendors would be contractually required to ensure that the data remains the property of the school district
  • Vendor contracts will prohibit the student data use  for purposes not outlined in the contract
  • Permit students to review and correct their information.
  • Require contracts with those vendors would oblige the companies to disclose any data breach in which student records are compromised.

Government Technology | Pennsylvania Legislation to Set Student Data Privacy Standards

Lege Trend: Model forms for Data Breach Notifications

California amended its data breach notification statutes this year to do 2 things:

1. Expand the definition of what type of information breach requires a notification for information gathered by an automatic license plate reader.

2. Provide a model form for entities that experience a data breach

National Law Review | California Amends Data Breach Notification Statute by Requiring Specific Notification Content and Expanding the Definition of Personal Information 

Drones & Data Storage. A Legislative Trend.

Drones collect data. Data everywhere. Private data. Public Data.

Legislatures and local governments are focused on …How long that data is stored, under what conditions, and under what dislcosure requirements is legislative fodder.

Are these private drones or public drones? Data release and data storage could apply to either. Here’s some of the legislative questions:

  • Are there penalties for a person’s private drone that collects data of someone’s orivate property?
  • How long can law enforcement keep drone data?
  • Can they release drone data if the data is superfilous to a criminal investigation?

Georgia is starting to tackle these issues with a focus on how much would it cost for law enforcement to keep or maintain non-investigative drone footage.

WABE Atlanta

City Creates CyberSecurity Squad. 5 Details to Build Your Own.

  • The local government creating the Cyber Security Squad: San Diego Regional Economic Development Corp
  • Why? The region is replete with defense and communications technology expertise
  • Goal of the Cyber Squad: “foster, enable and accelerate the cyber economy and to create an innovation hub for cyber here in the region”
  • Economic Boost from the Cyber Squad? Yes. Yes. Yes. 13 percent growth in the region for cyber, with over 100 companies, & 6,500 jobs. The economic growth rate of other sectors is 2.2%.
  • Which city or state has the best model for Cyber Squads? Look to Maryland

Governing: San Diego Now Has a Cybersecurity Squad

Greater Houston Partnership Hosting Cybersecurity Forum. Link between strong cybersecurity & business.

Greater Houston Partnership for the upcoming Cybersecurity Forum: Protecting Your Business Online on Tuesday, October 13.

It’s part of the work of the Partnership’s Cybersecurity Task Force & stresses the import of cyber security to business. 

HAVE QUESTIONS?: Contact Amber Margraves at amargraves@houston.org or 713-844-3651.

Greater Houston Partnership Cybersecurity Forum

Sign of the Times: Warren Buffet Enters Data Security Insurance Market

This week Berkshire Hathaway Specialty Insurance division unvieled 2 new speciality policies:

  • Professional First Network Security & Privacy
  •  Professional First Professional Liability and Network Security & Privacy

What do the policies cover?

  • coverage for third-party exposures
  • resulting from data security and privacy breaches, breach expense and extortion threats, media liability and business interruption.

SC Magazine | Berkshire Hathaway Specialty Insurance enters cyberinsurance arena

What is the hubbub about the EU- US Data Security Ruling this week?

Why don’t Europeans want their data routed to the US by google or facebook? Europe has high data security protocols than the US.

Can’t the companies protect the European information?  Sure, Tim Cook Apple has said it will lead in data privacy, but the Patriot Act and other laws allow US to snoop on data. So, that European data gets siphoned up by the U.S. government.

So, what? Americans have learned to live with it? Remember the international kerfuffle that occured when it was learned that the US was spying on its German allies? Europeans place a higher value on data security.

What did the European Court do? 2 things:

  1. it invalidated an internatioanl safe harbor agreemnt for the transfer of the data
  2. It said that each EU country should have have oversight over how companies collect and use online information of their countries’ citizens.

NYTimes | Data Transfer Pact Between U.S. and Europe Is Ruled Invalid

3 Points from an Education Tech Expert on Student Data Security

Who is the expert? James Steyer

  •  Founder and CEO of Common Sense Media, a San Francisco-based not-for-profit that, among other things, studies and advocates for children’s online privacy.
  • He is a a former civil rights attorney
  • Common Sense Media helped push 2014 California legislation, the Student Online Personal Information Protection Act, that bars operators of educational websites aimed at kids from amassing data profiles on their users

What are his points to protect student data?

  • One, students’ personal information shall be used solely for educational purposes 
  • Two, students’ personal information or online activity shall not be used to target advertising to students or families
  • Three, schools and education technology providers shall adopt appropriate data security, retention and destruction policies.

Does he support federal student data security legislation or state based legislation?

He really likes his California legislation. Agrees that there needs to be uniformity, but that protection for student data should be high like the California model.

​The Recorder | Proponent of California Student Data Security Legislation

Trump Hotel Data Breach

What happened to expose customer data at Trump Hotels? Hotel security systems were “compromised as a result of malware that went unnoticed on system computers for more than a year.”

How long did hackers potentially have access? 1+ year

What responses did Trump Hotels have?

  • Hired independent investgators who found no instances of data being accessed through the malware
  • “Immediately upon learning of a possible incident, we [Trump Hotels] notified the F.B.I. and financial institutions, and engaged an outside forensic expert to conduct an investigation of the incident.”

lawsuits?  oh, yes, there were lawyer patrons. A suit has been filed in U.S. District Court for the Southern District of Illinois on Oct. 2, asking for a class action suit to be opened.

Washington Times  | Donald Trump’s hotel chain confirms ‘data security incident’; customers of 7 properties affected