Section 1 also requires the written consent of a pupil or the parent or legal guardian of a pupil before the public school allows the pupil to use any school service or provides any item of technology to the pupil.

If written consent is not received, section 1 requires the public school to withhold the school service or item of technology from the pupil and provide an alternative method for the pupil to receive the same educational benefit.] Existing law requires a school service provider to establish a plan for the security of any data concerning pupils that is collected or maintained by the school service provider.

(NRS 388.293) Section 2.5 of this bill requires the school service provider to inform a school district, charter school or university school for profoundly data.

Section 2.5 further requires a school that receives such notice to provide the notice to the pupils and the parents and legal guardians of pupils who are less than 18 years of age.

EXPLANATIONTHE –PEOPLE MatterOF inTHE boldedSTATE italicsOF isNEVADA, new;REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

matterSection between1. brackets [omitted material] is material to be omitted.

- 80th Session (2019) – 2 – THE SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:D IN Section 1.

Before a public school,school , including, without limitation, a charter school and a university school for profoundly gifted pupils, allows a pupil to use any school service or provides a pupil with any technology, the public school must post[: on the Internet website of the public school information that:

(a) SummarizesProvide] post on the lawsInternet governingwebsite of the public school serviceinformation providers[to setthe forthpupil inor, thisif sectionthe andpupil NRSis 388.281less tothan 388.296,18 inclusive;years of age, the parent or legal guardian of the pupil, which fully describes the risks associated with the collection of covered information as a result of the use of a school service or any technology provided by the public school;

and (b) ListsRequest the pupil or, if the pupil is less than 18 years of age, the parent or legal guardian of the pupil, to consent in writing to the use of each school service provideror foritem of technology provided by the school;public school.

(c) Confirms that each such school service provider for the school has created a plan for the security of any data concerning pupils, including, without limitation, covered information and personally identifiable information pursuant to NRS 388.293 and informs about the circumstances under which notification will be provided pursuant to that section if a breach of the security of the system data is discovered;

(d) Describes any other actions taken by the public school, the school district or the governing body of the charter school or university school for profoundly gifted pupils, as applicable, to provider, including, without limitation, covered information and personally identifiable information, concerning pupils;

and (e) Describes the manner in which a pupil or the parent or legal guardian of a pupil may report any suspicious activity relating to the use of a school service by a pupil.

If a pupil or, if the pupil is less than 18 years of age, the parent or legal guardian of a pupil, does not provide the consent required by paragraph (b) of subsection 1 for the use of a school service or item of technology, the public school:

(a) Shall not allow the pupil to use the school service or item of technology;

(b) Shall not penalize or in any way discriminate against the pupil because the pupil does not use the school service or item of technology;

and (c) Shall provide an alternative method for the pupil to receive the same educational benefit as would have been provided by use of the school service or item of technology.

3.

Nothing in this section shall be construed to require the consent of a pupil or the parent or legal guardian of a pupil before information relating to the pupil is entered into or used as part of the automated system of accountability information for Nevada established pursuant to NRS 385A.800 or the statewide longitudinal data system maintained pursuant to paragraph (e) of subsection 4 of NRS 223.820.

4.] that :

(a) Summarizes the laws governing school service providers set forth in this section and NRS 388.281 to 388.296, inclusive:

Senate Amendment No.

434 to Senate Bill No.

403 Page 5 (b) Lists each school service provider for the school and the plan for the security of any data concerning pupils, including, without limitation, covered information and personally identifiable information, that is established by the school service provider pursuant to NRS 388.293;

(c) Describes any other actions taken by the public school, the school district or the governing body of the charter school or university school for profoundly gifted pupils, as applicable, to protect the security of any data collected by a school service provider, including, without limitation, covered information and personally identifiable information, concerning pupils;

and (d) Describes the manner in which a pupil or the parent or legal guardian of a pupil may report any suspicious activity relating to the use of a school service by a pupil.

2.

-(2) 80thCreated Sessionby (2019)or –provided 3to –a school service provider by an employee of a public school, a school district or the governing body of a charter school;

(a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;

A school service provider may transfer personally identifiable information concerning a pupil to a third-party service provider if the school service provider provides notice to any person designated in a policy of the school district, charter school orersonor university school for profoundly gifted pupils, as applicable, to receive suchSenate noticeAmendment or,No. if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:

434 to Senate Bill No.

403 Page 6 such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:

-(b) 80thProhibits Sessionthe (2019)third-party –service 4provider –from disclosing any personally identifiable information concerning a pupil unless the any disclosure is authorized pursuant to subsection 1;

and (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive [.] , and section 1 of this act.

The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review such information and request that such information about the pupil be deleted.

(b) Except as otherwise provided in this paragraph, sell service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a schoolpupil. district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.

-A 80thschool Sessionservice (2019)provider –may 5transfer –personally createidentifiable ainformation profileconcerning ofpupils to an entity that purchases, merges with or otherwise acquires the pupilschool forservice anyand purposethe notacquiring relatedentity becomes subject to thelthe requirements of NRS 388.281 to instruction388.296, inclusive, and section 1 of thethis pupilact, providedand byany contractual provisions between the school withoutservice provider and the consentboard of trustees of a school district, the appropriategoverning personbody describedof ina paragraphcharter (e)school or the governing body of subsectiona 1.university school for profoundly gifted pupils, as applicable, governing such information.

(c) Use personally identifiable information concerning a pupil to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.

(e) Knowingly retain, without the consent of the appropriate person described in paragraph (e) of subsection 1, personally identifiable information concerning a pupilSenate beyondAmendment theNo. period authorized by the contract governing the activities of the school service provider.

434 to Senate Bill No.

403 Page 7 pupil beyond the period authorized by the contract governing the activities of the school service provider.

This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or mai(a)maintained Adaptiveby learninga orschool providingservice personalizedprovider orfor customizedthe education;purposes of:

(a) Adaptive learning or providing personalized or customized education;

or (g) Allowing a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to download, transfer, or otherwiseentotherwise maintain data concerning a pupil.

- 80th Session (2019) – 6 – Sec.

The plan mus(a)must Procedureshoutinclude, foritaprotectingwithout thelimitation: security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;

(a) Procedures for protecting the security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;

A school service provider shall provide notice to a school district, charter school or university school for profoundly gifted pupils, as applicable, or a private school pursuant to section 10 of this act, of any breach of the securityplan offor the systemsecurity dataof inany violationdata ofconcerning thepupils plan and any actions taken or being taken by the school service provider to address the breach.

A school district, charter school, university school for profoundly gifted pupils or private school that receives a notice pursuant to subsection 33, shall provide the notice to each pupil affected by the breach or, if a pupil is less than 18 years of age, the parent or legal guardian of the pupil.

The notice must be provided,provided the as soon as practicable and without unreasonable delay.

5.

As used in this section, “breach of the security of the system data” means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of data concerning pupils that is collected or maintained by the school service provider.

The term does not include the good faith acquisition of data concerning pupils by an employee or agent of the school service provider for a legitimate purpose of the school service provider, so long as the data is not used for a purpose unrelated to the school service provider or subject to further unauthorized disclosure.

388.295 A school service provider may use and disclose information derived from personally identifiable information - 80th Session (2019) – 7 – concerning a pupil to demonstrate the effectiveness of the products or services of the school service provider, including, withoutSenate limitation,Amendment forNo. use in advertising or marketing regarding the school service , and to develop and improve a school service or any other service provider so long as the information is aggregated or ischool presented in a manner which does not disclose the identity of the pupil about whom the information relates.

434 to Senate Bill No.

403 Page 8 without limitation, for use in advertising or marketing regarding the school service , and to develop and improve a school service or any other Internet website, online service or mobile application of the school service provider so long as the information is aggregated or is presented in a manner which does not disclose the identity of the pupil about whom the information relates.

meaningSec. ascribed to it in 34 C.F.R.

§7. 99.3.nformation” has the Sec.

“Personally identifiable information” has the meaning ascribed to it in 34 C.F.R.

§ 99.3.

Sec.

- 80th Session (2019) – 8 – (c) A school service for which a school service provider has:

operates a school service, to the extent the provider is operating in that capacity.

9.

“School service provider” means a person that operates a school service, to the extent the provider is operating in that capacity.

Sec.

Before a private school allows a pupil to use any school service or provides a pupil with any technology, the private school must post[: on the Internet website of the school information that:

(a) Provide] post on the Internet website of the school information [to the pupil or, if the pupil is less than 18 years of age, the parent or legal guardian of the pupil, which fully describes the risks associated with the collection of covered Senate Amendment No.

434 to Senate Bill No.

403 Page 9 information as a result of the use of a school service or any technology provided by the private school;

and (b) Request the pupil or, if the pupil is less than 18 years of age, the parent or legal guardian of the pupil, to consent in writing to the use of each school service or item of technology provided by the private school.

2.

If a pupil or, if the pupil is less than 18 years of age, the parent or legal guardian of a pupil, does not provide the consent required by paragraph (b) of subsection 1 for the use of a school service or item of technology, the private school:

(a) Shall not allow the pupil to use the school service or item of technology;

(b) Shall not penalize or in any way discriminate against the pupil because the pupil does not use the school service or item of technology;

and (c) Shall provide an alternative method for the pupil to receive the same educational benefit as would have been provided by use of the school service or item of technology.] that:

This act becomes effective upon passage and approval for the purpose of adopting regulations and performing any other administrative tasks that are necessary to carry out the provisions of this act and on JulyJanuary 1, 2020, for all other purposes.

~~~~~ 19 - 80th Session (2019)