Struck = removed from the bill ·
added = the amendment's new text.
SenateSession Bill(80th) A SB403 R2 786 Amendment No.
403–Senator786 DenisAssembly JointAmendment Sponsor:to Senate Bill No.
Assemblywoman403 KrasnerSecond CHAPTER..........Reprint (BDR 34-309) Proposed by:
Assembly Committee on Education Amends:
Summary:
No Title:
No Preamble:
No Joint Sponsorship:
Yes Digest:
Yes ASSEMBLY ACTION Initial and Dat| SENATE ACTION Initial and Date Adopted Lost | Adopted Lost Concurred In Not | Concurred In Not Receded Not | Receded Not EXPLANATION:
Matter in (1) blue bold italics is new language in the original bill;
(2) variations of green bold underlining is language proposed to be added in this amendment;
(3) red strikethrough is deleted language in the original bill;
(4) purple double strikethrough is language proposed to be deleted in this amendment;
(5) orange double underlining is deleted language in the original bill proposed to be retained in this amendment.
AMM/AAK - Date:
5/20/2019 S.B.
No.
403—Revises provisions relating to data privacy for pupils.
(BDR 34-309) Page 1 of 8 *A_SB403_R2_786* Assembly Amendment No.
786 to Senate Bill No.
403 Second Reprint Page 3 SENATE B ILLN O.
403–SENATOR D ENIS M ARCH 20,2019 _______________ JOINT SPONSOR :
ASSEMBLYWOMAN K RASNER _______________ Referred to Committee on Education SUMMARY—Revises provisions relating to data privacy for pupils.
(BDR 34-309) FISCAL NOTE:
Effect on Local Government:
May have Fiscal Impact.
Effect on the State:
Yes.
~ EXPLANATION – Matter in bolded italics is new;
matter between brackets [omitted material] is material to be omitted.
LegislativeLegiExisting Counsel’slaw Digest:generally controls the manner in which a school service provider may use the personally identifiable information of a pupil and prohibits a school service provider from engaging in targeted advertising.
Existing(NRS law388.292) generally“School controlsservice theprovider” manneris defined in whichexisting alaw schoolas servicea provider serviceof providercertain fromInternet engagingservices, inonline targetedservices advertising.or mobile applications.
(NRS 388.292) “Schoolhool service provider” is defined in existing law as a provider of certain Internet services, online services or mobile applications.
Such information must include a description of the laws governing school service providers, a list of the school service providers for the school, confirmation that each school service provider has a plan for the security of data established by the school service provider, any other actions taken by the public school, the school district, or the applicable governing body to protect the data of the pupils and thelthe manner in which a person may report suspicious activity related to the use of a school service.
Section 2 of this bill revises the prohibition on targeted advertising by a school service provider to prohibit the school service provider from engaging in targeted advertising within its school service or on any other Internet website, online service or mobile application if the targeted advertising is based upon information gathered from its school service.
Section 2 alsoalsoe authorizes a school service provider to use the personally identifiable information of a pupil to perform certain research which is required or authorized by federal or state law.
(NRS 388.293)Assembly SectionAmendment 2.5No. of this bill requires the school service provider to inform a school district, charter school or university school for profoundly gifted pupils or a private school if there is a breach of the security of the a school that receives such notice to provide the notice to the pupils and the parents and legal guardians of pupils who are less than 18 years of age.
786 to Senate Bill No.
403 Second Reprint Page 4 district, charter school or university school for profoundly gifted pupils or a private school if there is a breach of the plan for the security of the data [.] or any breach of the data itself.
Section 2.5 further requires a school that receives such notice to provide the notice to the pupils and the parents and legal guardians of pupils who are less than 18 years of age.
EXPLANATIONTHE –PEOPLE MatterOF inTHE boldedSTATE italicsOF isNEVADA, new;REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:
matterSection between1. brackets [omitted material] is material to be omitted.
- 80th Session (2019) – 2 – THE SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:D IN Section 1.
(c) Confirms that each such school service provider for the school has created a plan for the security of any data concerning pupils, including, without limitation, covered information and personally identifiable information pursuant to NRS 388.293 and informs about the circumstances under which notification will be provided pursuant to that section if a breach of the security of the system data is discovered;
(d) Describes any other actions taken by the public school, the school district or the governing body of the charter school or university school for profoundly gifted pupils, as applicable, to protect the security of any data collected by a school service provider, including, without limitation, covered information and personally identifiable information, concerning pupils;
-(2) 80thCreated Sessionby (2019)or –provided 3to –a school service provider by an employee of a public school, a school district or the governing body of a charter school;
Sec.Assembly Amendment No.
786 to Senate Bill No.
403 Second Reprint Page 5 Sec.
(a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;
A school service provider may transfer personally identifiable information concerning a pupil to a third-party service provider if the school service provider provides notice to any person designated in a policy of the school district, charter school orersonor university school for profoundly gifted pupils, as applicable, to receive such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:
-(b) 80thProhibits Sessionthe (2019)third-party –service 4provider –from disclosing any personally identifiable information concerning a pupil unless the any disclosure is authorized pursuant to subsection 1;
and (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive [.] , and section 1 of this act.
The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review such information and request that such information about the pupil be deleted.
(b)Assembly ExceptAmendment asNo. otherwise provided in this paragraph, sell service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.
-786 80th Session (2019) – 5 – create a profile of the pupil for any purpose not related to thelSenate toBill instructionNo. of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.
403 Second Reprint Page 6 (b) Except as otherwise provided in this paragraph, sell personally identifiable information concerning a pupil.
A school service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.
(c) Use personally identifiable information concerning a pupil to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.
This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or mai(a)maintained Adaptiveby learninga orschool providingservice personalizedprovider orfor customizedthe education;purposes of:
(a) Adaptive learning or providing personalized or customized education;
or (g) Allowing a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to download, transfer, or otherwiseentotherwise maintain data concerning a pupil.
- 80th Session (2019) – 6 – Sec.
The plan mus(a)must Procedureshoutinclude, foritaprotectingwithout thelimitation: security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;
(a) Procedures for protecting the security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;
2.Assembly Amendment No.
786 to Senate Bill No.
403 Second Reprint Page 7 2.
A school service provider shall provide notice to a school district, charter school or university school for profoundly gifted pupils, as applicable, or a private school pursuant to section 10 of this act, of any breach of the securityplan offor the systemsecurity of any data inconcerning violationpupils or any breach of thesuch plandata and any actions taken or being taken by the school service provider to address the breach.
A school district, charter school, university school for profoundly gifted pupils or private school that receives a notice pursuant to subsection 33, shall provide the notice to each pupil affected by the breach or, if a pupil is less than 18 years of age, the parent or legal guardian of the pupil.
The notice must be provided,provided the as soon as practicable and without unreasonable delay.
5.
As used in this section, “breach of the security of the system data” means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of data concerning pupils that is collected or maintained by the school service provider.
The term does not include the good faith acquisition of data concerning pupils by an employee or agent of the school service provider for a legitimate purpose of the school service provider, so long as the data is not used for a purpose unrelated to the school service provider or subject to further unauthorized disclosure.
388.295 A school service provider may use and disclose information derived from personally identifiable information - 80th Session (2019) – 7 – concerning a pupil to demonstrate the effectiveness of the products or services of the school service provider, including, without limitation, for use in advertising or marketing regarding the school service , and to develop and improve a school service or any other Internet website, online service or mobile application of the school service provider so long as the information is aggregated or ischoolis presented in a manner which does not disclose the identity of the pupil about whom the information relates.
meaningSec. ascribed to it in 34 C.F.R.
§7. 99.3.nformation” has the Sec.
“Personally identifiable information” has the meaning ascribed to it in 34 C.F.R.
§ 99.3.
Sec.
(a)Assembly AnAmendment InternetNo. website, online service or mobile application that is designed or marketed for use by a general audience, even if the school service is also marketed to private schools;
786 to Senate Bill No.
403 Second Reprint Page 8 (a) An Internet website, online service or mobile application that is designed or marketed for use by a general audience, even if the school service is also marketed to private schools;
- 80th Session (2019) – 8 – (c) A school service for which a school service provider has:
operates a school service, to the extent the provider is operating in that capacity.
9.
“School service provider” means a person that operates a school service, to the extent the provider is operating in that capacity.
Sec.
~~~~~ 19 - 80th Session (2019)