Amendment vs bill Amendment CA2 vs Enrolled

Struck = removed from the bill · added = the amendment's new text.

Previous
Latest
Senate Bill No.
Session (80th) CA SB403 R3 CA2 Amendment No.
403–Senator Denis Joint Sponsor:
CA2 Conference Committee Amendment to (BDR 34-309) Senate Bill No.
Assemblywoman Krasner CHAPTER..........
403 Third Reprint Proposed by:
Conference Committee Amends:
Summary:
No Title:
No Preamble:
No Joint Sponsorship:
No Digest:
Yes EXPLANATION:
Matter in (1) blue bold italics is new language in the original bill;
(2) variations of green bold underlining is language proposed to be added in this amendment;
(3) red strikethrough is deleted language in the original bill;
(4) purple double strikethrough is language proposed to be deleted in this amendment;
(5) orange double underlining is deleted language in the original bill proposed to be retained in this amendment.
RBL - Date:
6/1/2019 S.B.
No.
403—Revises provisions relating to data privacy for pupils.
(BDR 34-309) Page 1 of 9 *CA_SB403_R3_CA2* Conference Committee Amendment No.
CA2 to Senate Bill No.
403 Third Reprint Page 3 SENATE B ILLN O.
403–SENATOR D ENIS M ARCH 20,2019 _______________ JOINTS PONSOR :
ASSEMBLYWOMAN K RASNER _______________ Referred to Committee on Education SUMMARY—Revises provisions relating to data privacy for pupils.
(BDR 34-309) FISCAL NOTE:
Effect on Local Government:
May have Fiscal Impact.
Effect on the State:
Yes.
~ EXPLANATION – Matter in bolded italics is new;
matter between brackets [omitted material] is material to be omitted.
Existing law generally controls the manner in which a school service provider service provider from engaging in targeted advertising.
Existing law generally controls the manner in which a school service provider may use the personally identifiable information of a pupil and prohibits a school service provider from existing law as a provider of certain Internet services, online services or mobile applications.
(NRS 388.292) “Schoolhool service provider” is defined in existing law as a provider of certain Internet services, online services or mobile applications.
Such information must include a description of the laws governing school service providers, a list of the school service providers for the school, confirmation that each school service provider has a plan for the security of data established by district, or the applicable governing body to protect the data of the pupils and thel manner in which a person may report suspicious activity related to the use of a school service.
Such information must include a description of the laws governing school service providers, a list of the school service providers for the school, confirmation that each school service provider has a plan for the security of data established by the school service provider, any other actions taken by the public school, the school district, or the applicable governing body to protect the data of the pupils and the manner in which a person may report suspicious activity related to the use of a school service.
Section 2 also authorizes a school service provider to use is required or authorized by federal or state law.
Section 2 also authorizes a school service provider to use the personally identifiable information of a pupil to this bill authorizes a school service provider to use aggregated, deidentified information3 of derived from the personally identifiable information of pupils to develop and improve the products of the school service provider.
Section 3 of this bill authorizes a school service provider to use aggregated, deidentified information derived from the personally identifiable information of pupils to develop and improve the products of the school service provider.
Conference Committee Amendment No.
Existing law requires a school service provider to establish a plan for the security of any data concerning pupils that is collected or maintained by the school service provider.
CA2 to Senate Bill No.
(NRS 388.293) Section 2.5 of this bill requires the school service provider to inform a school district, charter school or university school for profoundly gifted pupils or a private school if there is a breach of the security of the a school that receives such notice to provide the notice to the pupils and the parents and legal guardians of pupils who are less than 18 years of age.
403 Third Reprint Page 4 Existing law requires a school service provider to establish a plan for the security of any 388.293) Section 2.5 of this bill requires the school service provider to inform a schoolRS district, charter school or university school for profoundly gifted pupils or a private school if there is a breach of [the plan for the security of the data or any breach of the] the security of the system data [itself.] concerning pupils in violation of the plan.
Section 2.5 further requires a school that receives such notice to provide the notice to the pupils and the parents and legal guardians of pupils who are less than 18 years of age.
EXPLANATION – Matter in bolded italics is new;
THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:
Show all 87 changed rows (47 more)
Previous
Latest
matter between brackets [omitted material] is material to be omitted.
Section 1.
- 80th Session (2019) – 2 – THE SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:D IN Section 1.
(d) Describes any other actions taken by the public school, the school district or the governing body of the charter school or university school for profoundly gifted pupils, as applicable, to provider, including, without limitation, covered information and personally identifiable information, concerning pupils;
(d) Describes any other actions taken by the public school, the school district or the governing body of the charter school or university school for profoundly gifted pupils, as applicable, to protect the security of any data collected by a school service provider, including, without limitation, covered information and personally identifiable information, concerning pupils;
- 80th Session (2019) – 3 – an employee of a public school, a school district or the governing body of a charter school;
(2) Created by or provided to a school service provider by an employee of a public school, a school district or the governing body of a charter school;
(b) “Personally identifiable information” has the meaning ascribed to it in 34 C.F.R.
Conference Committee Amendment No.
CA2 to Senate Bill No.
403 Third Reprint Page 5 (b) “Personally identifiable information” has the meaning ascribed to it in 34 C.F.R.
(a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;
(a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;
A school service provider may transfer personally identifiable information concerning a pupil to a third-party service designated in a policy of the school district, charter school orerson university school for profoundly gifted pupils, as applicable, to receive such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:
A school service provider may transfer personally identifiable information concerning a pupil to a third-party service provider if the school service provider provides notice to any person designated in a policy of the school district, charter school or university school for profoundly gifted pupils, as applicable, to receive such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:
- 80th Session (2019) – 4 – personally identifiable information concerning a pupil unless the any disclosure is authorized pursuant to subsection 1;
(b) Prohibits the third-party service provider from disclosing any personally identifiable information concerning a pupil unless the disclosure is authorized pursuant to subsection 1;
and (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive [.] , and section of this act.
and (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive [.] , and section 1 of this act.
The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the request that such information about the pupil be deleted.
The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review such information and request that such information about the pupil be deleted.
5.
Conference Committee Amendment No.
CA2 to Senate Bill No.
403 Third Reprint Page 6 5.
(b) Except as otherwise provided in this paragraph, sell service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.
(b) Except as otherwise provided in this paragraph, sell personally identifiable information concerning a pupil.
- 80th Session (2019) – 5 – create a profile of the pupil for any purpose not related to thel to instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.
A school service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and section 1 of this act, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.
(c) Use personally identifiable information concerning a pupil to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.
This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or mai(a) Adaptive learning or providing personalized or customized education;
This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or maintained by a school service provider for the purposes of:
(a) Adaptive learning or providing personalized or customized education;
or or legal guardian of any pupil to download, transfer, or otherwiseent maintain data concerning a pupil.
or (g) Allowing a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to download, transfer, or otherwise maintain data concerning a pupil.
- 80th Session (2019) – 6 – Sec.
Conference Committee Amendment No.
CA2 to Senate Bill No.
403 Third Reprint Page 7 Sec.
The plan mus(a) Procedureshout foritaprotecting the security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;
The plan must include, without limitation:
(a) Procedures for protecting the security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil;
A school service provider shall provide notice to a school district, charter school or university school for profoundly gifted pupils, as applicable, or a private school pursuant to section 10 of this act, of any breach of the security of the system data in violation of the plan and any actions taken or being taken by the school service provider to address the breach.
A school service provider shall provide notice to a school district, charter school or university school for profoundly gifted pupils, as applicable, or a private school pursuant to section 10 of this act, of any breach of [the plan for] the security of [any] the system data [concerning pupils or any breach of such data] in violation of the plan and any actions taken or being taken by the school service provider to address the breach.
A school district, charter school, university school for profoundly gifted pupils or private school that receives a notice pursuant to subsection 3 shall provide the notice to each pupil parent or legal guardian of the pupil.
A school district, charter school, university school for profoundly gifted pupils or private school that receives a notice pursuant to subsection 3 [,] shall provide the notice to each pupil affected by the breach or, if a pupil is less than 18 years of age, the parent or legal guardian of the pupil.
The notice must be provided, the as soon as practicable and without unreasonable delay.
The notice must be provided as soon as practicable and without unreasonable delay.
388.295 A school service provider may use and disclose information derived from personally identifiable information - 80th Session (2019) – 7 – concerning a pupil to demonstrate the effectiveness of the products or services of the school service provider, including, without limitation, for use in advertising or marketing regarding the school service , and to develop and improve a school service or any other service provider so long as the information is aggregated or ischool presented in a manner which does not disclose the identity of the pupil about whom the information relates.
388.295 A school service provider may use and disclose information derived from personally identifiable information concerning a pupil to demonstrate the effectiveness of the products or services of the school service provider, including, without limitation, for use in advertising or marketing regarding the school service , and to develop and improve a school service or any other Internet website, online service or mobile application of the school service provider so long as the information is aggregated or is presented in a manner which does not disclose the identity of the pupil about whom the information relates.
1.
Conference Committee Amendment No.
CA2 to Senate Bill No.
403 Third Reprint Page 8 1.
meaning ascribed to it in 34 C.F.R.
Sec.
§ 99.3.nformation” has the Sec.
7.
“Personally identifiable information” has the meaning ascribed to it in 34 C.F.R.
§ 99.3.
Sec.
- 80th Session (2019) – 8 – (c) A school service for which a school service provider has:
(c) A school service for which a school service provider has:
operates a school service, to the extent the provider is operating in that capacity.
9.
“School service provider” means a person that operates a school service, to the extent the provider is operating in that capacity.
Sec.
At the beginning of each school year, each private school shall communicate to the pupils enrolled at the school and the parents and legal guardians of such pupils the availability of the information described in subsection 1 and the manner in which to locate the information.
At the beginning of each school year, each private school shall communicate to the pupils enrolled at the school and the parents and legal Conference Committee Amendment No.
CA2 to Senate Bill No.
403 Third Reprint Page 9 guardians of such pupils the availability of the information described in subsection 1 and the manner in which to locate the information.
~~~~~ 19 - 80th Session (2019)