SB 403 — Revises provisions relating to data privacy for pupils. (BDR 34-309)

(ReprintedSenate withBill amendmentsNo. adopted on June 3, 2019) FOURTH REPRINT S.B.

403403–Senator SENATEDenis BILLJoint NOSponsor: .

403–SENATORAssemblywoman DENISKrasner MCHAPTER.......... ARCH 20, 2019 ____________ OINT S PONSOR :

ASSEMBLYWOMAN KRASNER ____________ Referred to Committee on Education SUMMARY—Revises provisions relating to data privacy for pupils.

(BDR 34-309) FISCAL NOTE:

Effect on Local Government:

May have Fiscal Impact.

Effect on the State:

Yes.

~ EXPLANATION – Matter in bolded italics is new;

matter between brackets [omitted material] is material to be omitted.

Existing law generally controls the manner in which a school service provider school service provider from engaging in targeted advertising.

(NRS 388.292) “School“Schoolhool service provider” is defined in existing law as a provider of certain Internet services, online services or mobile applications.

(NRS 388.283, 388.284) Section 1 of this bill requires a public school, including a charter school and a university school for profoundly gifted pupils, to post certain information on the Internet website of the school before a pupil uses a school service of a school service serviceprovider. providers, a list of the school service providers for the school, confirmation that each school service provider has a plan for the security of data established by the school service provider, any other actions taken by the public school, the school district, or the applicable governing body to protect the data of the pupils and the manner in which a person may report suspicious activity related to the use of a school service.

EachSuch schoolinformation must alsoinclude communicatea description of the mannerlaws ingoverning whichschool toservice locateproviders, theSectiona 2list of thisthe billschool revisesservice theproviders prohibitionfor onthe targetedschool, advertisingconfirmation bythat aeach school service provider tohas prohibita theplan schoolfor servicethe providersecurity fromof engagingdata inestablished targetedby -district, *SB403_R4*or –the 2applicable –governing advertisingbody withinto itsprotect schoolthe servicedata orof onthe anypupils otherand Internetthel website,manner onlinein servicewhich ora mobileperson applicationmay ifreport thesuspicious targetedactivity advertisingrelated isto basedthe uponuse informationof gathereda from its school service.

Each school must also communicate the manner in which to locate the information at the beginning of each school year.

Section 2 of this bill revises the prohibition on targeted advertising by a school service provider to prohibit the school service provider from engaging in targeted advertising within its school service or on any other Internet website, online service or mobile application if the targeted advertising is based upon information gathered from its school service.

Existing law requires a school service provider to establish a plan for the security of any data concerning pupils that is collected or maintained by the school service provider.

(NRS 388.293) Section 2.5 of this bill requires the school service provider to inform a school district, charter school or university school for profoundly gifted pupils or a private school if there is a breach of the security of the systema dataschool concerningthat receives such notice to provide the notice to the pupils inand violationthe parents and legal guardians of thepupils plan.who are less than 18 years of age.

SectionSections 2.5 further requires a school that receives such notice to provide the notice to the pupils and the parents andSections 5-10 of this bill establish similar provisions for private schools.

THEEXPLANATION PEOPLE– OFMatter THEin STATEbolded OFitalics NEVADA,is REPRESENTEDnew; IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

Sectionmatter 1.between brackets [omitted material] is material to be omitted.

- 80th Session (2019) – 2 – THE SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:D IN Section 1.

(d) Describes any other actions taken by the public school, the school district or the governing body of the charter school or university school for profoundly gifted pupils, as applicable, to protect the security of any data collected by a school service provider, including, without limitation, covered information and personally identifiable information, concerning pupils;

- *SB403_R4* – 3 – 2.

(2)- Created80th bySession or(2019) provided– to3 a– school service provider by an employee of a public school, a school district or the governing body of a charter school;

(a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;

- *SB403_R4* – 4 – 2.

A school service provider may transfer personally identifiable information concerning a pupil to a third-party service provider if the school service provider provides notice to any person designated in a policy of the school district, charter school ororerson university school for profoundly gifted pupils, as applicable, to receive such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:

(b)- Prohibits80th theSession third-party(2019) service– provider4 from– disclosing any personally identifiable information concerning a pupil unless the any disclosure is authorized pursuant to subsection 1;

and (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive [.] , and section 1 of this act.

The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review such information and request that such information about the pupil be deleted.

(b) Except as otherwise provided in this paragraph, sell service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a pupil.school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.

A- school80th -Session *SB403_R4*(2019) – 5 – servicecreate providera mayprofile transferof personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the schoolpupil servicefor andany thepurpose acquiringnot entityrelated becomes subject to thethel requirements of NRS 388.281 to 388.296,instruction inclusive, and section 1 of thisthe act,pupil andprovided anyby contractual provisions between the school servicewithout provider and the boardconsent of trustees of a school district, the governingappropriate bodyperson ofdescribed ain charterparagraph school(e) or the governing body of asubsection university1. school for profoundly gifted pupils, as applicable, governing such information.

(c) Use personally identifiable information concerning a pupil to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.

This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or maintainedmai(a) byAdaptive alearning schoolor serviceproviding providerpersonalized foror thecustomized purposeseducation; of:

(a) Adaptive learning or providing personalized or customized education;

or (g) Allowing a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to download, transfer, or otherwiseotherwiseent maintain data concerning a pupil.

- *SB403_R4* – 6 – 7.

- 80th Session (2019) – 6 – Sec.