Student Data Protection: No Fear; Congress is Here to Save the Day. Education Vendors Beware.

U.S. Senators Hatch & Markey this month filed a measure to protect student data. Following suit is Senator Vitter. 

Hatch & Markey focus on amending FERPA. Yes, that FERPA at issue in the UT System/Wallace Hall debacle. The Senators’ Protecting Student Privacy Act seeks to:

  • Require that “data security safeguards be put in place to protect sensitive student data that is held by private companies,”
  • Prohibit “the use of students’ personally identifiable information to advertise or market a product or service,”
  • Provide “parents with the right to access the personal information about their children—and amend that information if it is incorrect—that is held by private companies,”
  •  Make “transparent the names of all outside parties that have access to student information,”

Hatch-Markey Press Release

Vitter’s covertly named Student Privacy Protection Act will:

  • ” Reinstate protections originally outlined under [FERPA] by clarifying who can access student data and what information is accessible,”
  • “Require educational agencies to gain prior consent from students or parents and implement measures to ensure records remain private,”
  • Hold liable through monetary fines “[a]ny educational agency, school, or third party that fails to get consent.” 
  • Extend “FERPA’s protections to ensure records of homeschooled students are treated equally”
  • Prohibit “educational agencies, schools, and the Secretary of Education from including personally identifiable information obtained from federal or state agencies through data matches in student data.” 

Vitter Press Release

 

State Attorney Generals to Congress: Drop Preemption from Data Security Bill

California Attorney General Kamala Harris, front runner to succeed U.S. Senator Barbara Boxer, is urging Congress to allow states to have stonger data security bills.  

Her concerns about the federal bill are many, including:

  • Allowing breached companies to determine whether harm has occurred
  • Need to protect  medical data and health insurance information
  • Need for a stronger notification timeframe for companies targeted by identity thieves and hackers.

Law360

Lege Trend: Expand Definition of Personal Information to Trigger Notification

Nevada is the most recent state to expand the definition of personal information that trigger data security laws. 

The expanded definition includes:

  • individual’s medical identification number or health insurance identification number and
  • a user name, unique identifier or email address with its associated password, access code or security question and answer that would permit access to an online account

This reflects a growing trend to include email address/usernames along with passwords in state data security statutes. 

Assembly Bill 179   

Oregon Data Breach of Employment Background Checks leads to False IRS Tax Refunds

Thieves aquired names, addresses, social security numbers and other personal information from a database owned by CICS employment services., whiched housed employment background check information.

The thieves then took the personal information and filed false IRS forms to obtain tax refunds. The company does not know how the informaiton was taken, but they know it was when the theft ring was busted.

Oregon Live