Struck = removed from the bill ·
added = the amendment's new text.
SenateSession Bill(80th) A SB403 R1 579 Amendment No.
403–Senator579 DenisSenate JointAmendment Sponsor:to Senate Bill No.
Assemblywoman403 KrasnerFirst CHAPTER..........Reprint (BDR 34-309) Proposed by:
Senator Denis Amendment Box:
Replaces Amendment No.
548.
Amends:
Summary:
No Title:
No Preamble:
No Joint Sponsorship:
No Digest:
Yes ASSEMBLY ACTION Initial and Dat| SENATE ACTION Initial and Date Adopted Lost | Adopted Lost Concurred In Not | Concurred In Not Receded Not | Receded Not EXPLANATION:
Matter in (1) blue bold italics is new language in the original bill;
(2) variations of green bold underlining is language proposed to be added in this amendment;
(3) red strikethrough is deleted language in the original bill;
(4) purple double strikethrough is language proposed to be deleted in this amendment;
(5) orange double underlining is deleted language in the original bill proposed to be retained in this amendment.
RBL - Date:
4/19/2019 S.B.
No.
403—Revises provisions relating to data privacy for pupils.
(BDR 34-309) Page 1 of 8 *A_SB403_R1_579* Senate Amendment No.
579 to Senate Bill No.
403 First Reprint Page 3 S ENATE B ILLN O.
403–S ENATOR D ENIS M ARCH 20,2019 _______________ Referred to Committee on Education SUMMARY—Revises provisions relating to data privacy for pupils.
(BDR 34-309) FISCAL NOTE:
Effect on Local Government:
May have Fiscal Impact.
Effect on the State:
Yes.
~ EXPLANATION – Matter in bolded italics is new;
matter between brackets [omitted material] is material to be omitted.
Existing law generally controls the manner in which a school service provider may use the personally identifiable information of a pupil and prohibits a school service provider from engaging in targeted advertising.
(NRS 388.292) “Schoolhool“School service provider” is defined in existing law as a provider of certain Internet services, online services or mobile applications.
Such information must include a description of the laws governing school service providers, a list of the school service providers for the school, [a copy of the] confirmation that each school service provider has a plan for the security of data established by the school service provider, any other actions taken by the public school, the school district, or the applicable governing body to protect the data of the pupils and thelthe manner in which a person may report suspiciousthe activitymanner relatedin which to locate the useinformation at the beginning of each school year.ommunicate Section 2 of this bill revises the prohibition on targeted advertising by a school service provider to prohibit the school service provider from engaging in targeted advertising within its school service or on any other Internet website, online service or mobile application if the targeted advertising is based upon information gathered from its school service.
EachSection school2 must also communicateauthorizes thea mannerschool inservice whichprovider to locateuse the personally identifiable information atof thea beginningpupil ofto eachperform schoolcertain year.research which is required or authorized by federal or state law.
Section 2 of this bill revises the prohibition on targeted advertising by a school service provider to prohibit the school service provider from engaging in targeted advertising within its school service or on any other Internet website, online service or mobile application if the targeted advertising is based upon information gathered from its school service.
Section 2 also authorizes a school service provider to use is required or authorized by federal or state law.
(NRS 388.293) Section 2.5 of this bill requires the school service provider to inform a school district, charter school or university school for profoundly gifted pupils or a private school if there is a breach of the securityplan offor the asecurity schoolof that receives such notice to provide the noticedata. to the pupils and the parents and legal guardians of pupils who are less than 18 years of age.
SectionsSection 5-102.5 offurther thisrequires billa establishschool similarSenate provisionsAmendment forNo. private schools.
EXPLANATION579 –to MatterSenate inBill boldedNo. italics is new;
matter403 betweenFirst bracketsReprint [omittedPage material]4 isof materialpupils who are less than 18 years of age.ice to bethe omitted.pupils and the parents and legal guardians Sections 5-10 of this bill establish similar provisions for private schools.
-THE 80thPEOPLE SessionOF (2019)THE –STATE 2OF –NEVADA, THEREPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:DFOLLOWS: IN Section 1.
Section 1.
(b) Lists each school service provider for the school;school [and the] ;
(c) Confirms that each such school service provider for the school has created a plan for the security of any data concerning pupils, including, without limitation, covered information and personally identifiable information pursuant[, tothat NRSis 388.293established andby informs about the circumstancesschool underservice whichprovider] notification will be provided pursuant to thatNRS section388.293 if[; a breach of the security of the system data is discovered;
(d)(c)] Describesand anyinforms otherabout actions taken by the publiccircumstances school,under thewhich schoolnotification districtwill orbe theprovided governingif bodya ofbreach theis charterdiscovered; school or university school for profoundly gifted pupils, as applicable, to provider, including, without limitation, covered information and personally identifiable information, concerning pupils;
and(d) (e) Describes theany mannerother inactions whichtaken aby pupilthe orpublic school, the parentschool district or legalthe guardiangoverning body of athe pupilcharter mayschool reportor anyuniversity suspiciousschool activityfor relatingprofoundly gifted pupils, as applicable, to protect the usesecurity of any data collected by a school service byprovider, aincluding, pupil.without limitation, covered information and personally identifiable information, concerning pupils;
and [(d)] (e) Describes the manner in which a pupil or the parent or legal guardian of a pupil may report any suspicious activity relating to the use of a school service by a pupil.
-(2) 80thCreated Sessionby (2019)or –provided 3to –a school service provider by an employee of a public school, a school district or the governing body of a charter school;
Sec.Senate Amendment No.
579 to Senate Bill No.
403 First Reprint Page 5 Sec.
(a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;
A school service provider may transfer personally identifiable information concerning a pupil to a third-party service provider if the school service provider provides notice to any person designated in a policy of the school district, charter school orersonor university school for profoundly gifted pupils, as applicable, to receive such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:
-(b) 80thProhibits Sessionthe (2019)third-party –service 4provider –from disclosing any personally identifiable information concerning a pupil unless the any disclosure is authorized pursuant to subsection 1;
and (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive [.] , and section 1 of this act.
The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review such information and request that such information about the pupil be deleted.
(b)Senate ExceptAmendment asNo. otherwise provided in this paragraph, sell service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.
-579 80th Session (2019) – 5 – create a profile of the pupil for any purpose not related to thelSenate toBill instructionNo. of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.
403 First Reprint Page 6 (b) Except as otherwise provided in this paragraph, sell personally identifiable information concerning a pupil.
A school service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.
(c) Use personally identifiable information concerning a pupil to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.
This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or mai(a)maintained Adaptiveby learninga orschool providingservice personalizedprovider orfor customizedthe education;purposes of:
(a) Adaptive learning or providing personalized or customized education;
or (g) Allowing a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to download, transfer, or otherwiseentotherwise maintain data concerning a pupil.
- 80th Session (2019) – 6 – Sec.
The plan mus(a)must Procedureshoutinclude, foritaprotectingwithout thelimitation: security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;
(a) Procedures for protecting the security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;
2.Senate Amendment No.
579 to Senate Bill No.
403 First Reprint Page 7 2.
A school service provider shall provide notice to a school district, charter school or university school for profoundly gifted pupils, as applicable, or a private school pursuant to section 10 of this act, of any breach of the securityplan offor the systemsecurity dataof inany violationdata ofconcerning thepupils plan and any actions taken or being taken by the school service provider to address the breach.
A school district, charter school, university school for profoundly gifted pupils or private school that receives a notice pursuant to subsection 33, shall provide the notice to each pupil affected by the breach or, if a pupil is less than 18 years of age, the parent or legal guardian of the pupil.
The notice must be provided,provided the as soon as practicable and without unreasonable delay.
5.
As used in this section, “breach of the security of the system data” means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of data concerning pupils that is collected or maintained by the school service provider.
The term does not include the good faith acquisition of data concerning pupils by an employee or agent of the school service provider for a legitimate purpose of the school service provider, so long as the data is not used for a purpose unrelated to the school service provider or subject to further unauthorized disclosure.
388.295 A school service provider may use and disclose information derived from personally identifiable information - 80th Session (2019) – 7 – concerning a pupil to demonstrate the effectiveness of the products or services of the school service provider, including, without limitation, for use in advertising or marketing regarding the school service , and to develop and improve a school service or any other Internet website, online service or mobile application of the school service provider so long as the information is aggregated or ischoolis presented in a manner which does not disclose the identity of the pupil about whom the information relates.
meaningSec. ascribed to it in 34 C.F.R.
§7. 99.3.nformation” has the Sec.
“Personally identifiable information” has the meaning ascribed to it in 34 C.F.R.
§ 99.3.
Sec.
(b)Senate AnAmendment internalNo. database, system or program maintained or operated by a private school or the governing body of a private school;
-579 80thto SessionSenate (2019)Bill –No. 8 – (c) A school service for which a school service provider has:
403 First Reprint Page 8 (b) An internal database, system or program maintained or operated by a private school or the governing body of a private school;
(c) A school service for which a school service provider has:
operates a school service, to the extent the provider is operating in that capacity.
9.
“School service provider” means a person that operates a school service, to the extent the provider is operating in that capacity.
Sec.
This act becomes effective upon passage and approval for the purpose of adopting regulations and performing any other administrative tasks that are necessary to carry out the provisions of this act and on [January] July 1, 2020, for all other purposes.
~~~~~ 19 - 80th Session (2019)