SB 378 — An Act amending Title 24 (Education) of the Pennsylvania Consolidated Statutes, in preliminary provisions, providing for student data privacy and protection; conferring powers and imposing duties on the Department of Education; and imposing penalties.

PRIOR PRINTER'S NO.

240 THEPRINTER'S GENERALNO. ASSEMBLY OF PENNSYLVANIA SENATE BILL Session of No.

1528 THE GENERAL ASSEMBLY OF PENNSYLVANIA SENATE BILL Session of No.

WARD, STEFANOSTEFANO, DUSH AND DUSH,MASTRIANO, FEBRUARY 26, 2025 REFERREDSENATOR TOCULVER, EDUCATION, FEBRUARYAS 26,AMENDED, 2025MARCH 23, 2026 AN ACT Amending Title 24 (Education) of the Pennsylvania Consolidated Statutes, in preliminary provisions, providing for student data privacy and protection;

(5) Given the vast personally identifiable student information held, educational entities are prime targets for 20250SB0378PN024020250SB0378PN1528 - 2 - data and information poaching by identity thieves and other hackers.

20250SB0378PN024020250SB0378PN1528 - 3 - (i) A physical description, including height, weight, hair color or eye color.

"Educational entity." An organized education provider, <-- including a public school.

A PUBLIC SCHOOL DISTRICT, CHARTER <-- SCHOOL, REGIONAL CHARTER SCHOOL, CYBER CHARTER SCHOOL, INTERMEDIATE UNIT OR AREA CAREER AND TECHNICAL SCHOOL.

(6) A private licensed school as defined in the act of December 15, 1986 (P.L.1585, No.174), known as the Private 20250SB0378PN1528 - 4 - Licensed Schools Act.

"Necessary student data." Student data required by Federal 20250SB0378PN0240 - 4 - or State law to conduct the regular activities of an educational entity.

20250SB0378PN1528 - 5 - (vi) Ethnicity.

20250SB0378PN0240 - 5 - (viii) Sexual identity or orientation.

20250SB0378PN1528 - 6 - (xxv) An immunization record or the reason for an exception from receiving an immunization.

20250SB0378PN0240 - 6 - (xxvi) Remediation efforts.

(iii) Education status, an educational record or 20250SB0378PN1528 - 7 - student data of a family member who is a student.

"Targeted marketing." Advertising to a student or a 20250SB0378PN0240 - 7 - student's parent or guardian that is selected based on information obtained or inferred from the student's online or offline behavior, usage of applications or student data.

20250SB0378PN1528 - 8 - 513.

20250SB0378PN0240 - 8 - 515.

(5) Conduct a privacy impact assessment on legislative proposals and regulations and program initiatives of the 20250SB0378PN1528 - 9 - department, including the type of personal information collected and the number of students affected.

20250SB0378PN0240 - 9 - (6) Prepare an annual report for submission to the General Assembly on activities of the department that affect privacy, including complaints of privacy violations, internal controls and other related matters.

(1) Have access to all records, reports, audits, 20250SB0378PN1528 - 10 - reviews, documents, papers, recommendations and other materials available to the educational entity or third party 20250SB0378PN0240 - 10 - under investigation.

The department shall promulgate rules and regulations 20250SB0378PN1528 - 11 - necessary to implement the provisions of this chapter.

20250SB0378PN0240 - 11 - An educational entity shall:

20250SB0378PN1528 - 12 - 523.

20250SB0378PN0240 - 12 - 525.

20250SB0378PN1528 - 13 - (c) Contents.--The notice under this section must:

(1) List the necessary student data and optional student 20250SB0378PN0240 - 13 - data which the educational entity collects and the rationale for the collection of the data.

(3) determined to be necessary due to an imminent health 20250SB0378PN1528 - 14 - or safety emergency;

20250SB0378PN0240 - 14 - (b) Financial benefit.--Except as otherwise provided under this chapter, an educational entity may not release or otherwise disclose student data or information in an educational record in exchange for any good, product, application, service or any other thing of measurable value.

(1) is not maintained in electronic format, in which 20250SB0378PN1528 - 15 - case arrangements shall be made for transmittal in another format;

or 20250SB0378PN0240 - 15 - (2) cannot reasonably be made available to the requesting individual or the reproduction of the requested information would be unduly burdensome.

20250SB0378PN1528 - 16 - (b) Prohibited uses.--A third party may not manage or use student data or information from an educational record obtained 20250SB0378PN0240 - 16 - in the course of a contractual relationship with an educational entity to do any of the following:

(2) Market an educational application or product to a student's parent or legal guardian if the student is under 18 20250SB0378PN1528 - 17 - years of age if the third party did not use student data, shared by or collected on behalf of an educational entity, to 20250SB0378PN0240 - 17 - develop the educational application or product.

20250SB0378PN1528 - 18 - When contracting with a third party, an educational entity shall require the following provisions in the contract:

20250SB0378PN0240 - 18 - (1) Requirements and restrictions related to the collection, use, storage or sharing of student data by the third party that are necessary for the educational entity to ensure compliance with the provisions of this chapter and other State law.

20250SB0378PN1528 - 19 - § 530.

20250SB0378PN0240 - 19 - Notwithstanding any other provision of this chapter, this chapter does not apply to nonprofit organizations using the student data for legitimate educational interests, including engaging in activities to provide students higher education and scholarship opportunities or prohibit the use of the student's personally identifiable student data to identify for the student institutions of higher education or scholarship providers that are seeking students who meet specific criteria, provided a written data authorization by the student or a student's parent or legal guardian if the student is under 18 years of age permits the use.

(b) Notification of students, parents and legal guardians.-- 20250SB0378PN1528 - 20 - If there is an unauthorized release or compromise of student data by security breach or otherwise, the effected educational 20250SB0378PN0240 - 20 - entity shall, within three business days of verification of the release or compromise, notify all of the following:

20250SB0378PN1528 - 21 - An educational entity or third party that fails to comply with any duty or other provision under this chapter resulting in 20250SB0378PN0240 - 21 - the intentional, knowing, reckless or negligent data breach or security compromise shall be subject to the following penalties:

<-- (1) The following shall take effect August 1, 2024: