2017 -- H 5682

========

LC001954

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2017

____________

A N   A C T

RELATING TO EDUCATION -- PROTECTING STUDENT PRIVACY ON SCHOOL-

OWNED TECHNOLOGY

     Introduced By: Representatives Kennedy, O`Grady, Casey, Johnston, and Kazarian

     Date Introduced: March 01, 2017

     Referred To: House Health, Education & Welfare

     It is enacted by the General Assembly as follows:

     SECTION 1. Title 16 of the General Laws entitled "EDUCATION" is hereby amended

by adding thereto the following chapter:

CHAPTER 107

STUDENT PRIVACY IN TAKE-HOME TECHNOLOGY PROGRAMS

     16-107-1. Definitions.

     For the purposes of this chapter:

     (1) "Educational institution" or "school" means a private or public institution that offers

participants, students, or trainees an organized course of study or training that is academic, trade-

oriented or preparatory for gainful employment in a recognized occupation and shall include any

person acting as an agent of the institution.

     (2) "Device" means any computer, including laptop or tablet computers, or other

electronic device owned or maintained by the educational institution and provided to a student

pursuant to a take-home technology program.

     (3) "Internet filtering measures" means the use of a specific technology or program to

block or filter access to websites on the Internet.

     (4) "Location tracking" means a global positioning service or other mapping, locational,

or directional information service, used to determine the location of the device in real time or

historically.

     (5) "Remote access" means the ability to access a computer from a remote location. This

includes the ability to view a computer's network, desktop or files from an external location or

server, as well as the ability to open, modify, or delete programs.

     (6) "Take-home technology program" means any program wherein a device is provided

to a student for overnight or at-home use.

     (7) "Student" means any student, participant, or trainee, whether full-time or part-time, in

an organized course of study at an educational institution.

     16-107-2. Optional participation in take-home technology programs.

     (a) No educational institution shall compel, coerce, or require a student to participate in a

take-home technology program.

     (b) No student shall be permitted to participate in a take-home technology program

without the written consent of the student's parent or guardian, including the signing of an opt-in

agreement.

     (c) A valid opt-in agreement shall identify, with specificity:

     (1) The precise subset of data on the device to which access is being granted;

     (2) The name of the school employee(s) or third party to whom the authority to access the

data on the device is being granted;

     (3) The name of any third party to whom data is being sold, shared, or otherwise

transferred; and

     (4) The purpose(s) for which the school employee(s) or third party is being granted

access to the device or for which data is being sold, shared, or otherwise transferred.

     (d) An opt-in agreement shall not be valid if it actually or effectively grants a third party:

     (1) General authority to access a student's device; or

     (2) The authority to collect all personally-identifiable student data that is generated by

and/or used in connection with a specific program or application.

     (e) No third party or school employee who receives personally identifiable information

from a device pursuant to an opt-in agreement may share, sell or otherwise transfer such data to

another third party.

     (f) An opt-in agreement may be revoked at any time, upon written notice to an

educational institution, by a student or their parent or guardian. Within fourteen (14) days of such

a revocation, notice to any affected third parties shall be made by the educational institution.

     (g) No device or other educational benefit may be withheld from, or punitive measure

taken against, a student or their parent or legal guardian:

     (1) Based in whole or in part upon a decision not to sign, or to revoke, an opt-in

LC001954 - Page 2 of 7

agreement; or

     (2) Based in whole or in part upon a student's refusal to open, close, or maintain an e-mail

or other electronic communications or social media account with a specific service provider.

     (h) Where a take-home technology program is offered at an educational institution, any

attempt by the educational institution or a third party to condition the offer, provision or receipt of

a device upon a student's or their parent's or legal guardian's agreement to provide or permit the

sharing of personally-identifiable student data is unlawful under this chapter.

     (i) When a device is permanently returned by a student, the educational institution or

third party who provided it shall, without otherwise accessing the data on the device, fully erase

all the data stored on the device and return the device to its default factory settings.

     16-107-3. Use of data on take-home technology.

     (a) Where an educational institution or third party provides a student with a technological

device pursuant to a take-home technology program, no school employee or third party may

access such a device or the data thereupon, either remotely or in person, except in accordance

with the provisions of this chapter.

     (b) No school employee or third party may access any data input into, stored upon, or

sent or received by a student's device, including its browser, keystroke or location history, unless:

     (1) A school employee or third party has been authorized to access specific data by a

student and their parent or legal guardian pursuant to a valid opt-in agreement, and access is

limited to that purpose;

     (2) A school employee has reasonable suspicion that the student has violated or is

violating a school policy and that data on the device contains evidence of the suspected violation,

subject to the following limitations:

     (i) Prior to searching a student's device based on reasonable suspicion, the school

employee shall document the reasonable suspicion and notify the student's parent or legal

guardian of the suspected violation and what data will be accessed in searching for evidence of

the violation;

     (ii) Searches of a student's device based upon a reasonable suspicion of a school policy

violation shall be strictly limited to finding evidence of the suspected policy violation; and

     (iii) Where a student is suspected of illegal conduct, no search may occur unless a judicial

warrant has been secured, even if the student is also suspected of a related or unrelated violation

of school policy;

     (3) A school employee or law enforcement official reasonably suspects the student has

engaged or is engaging in illegal conduct, reasonably suspects data on the device contains

LC001954 - Page 3 of 7

evidence of the suspected illegal conduct, and has secured a judicial warrant for a search of the

device;

     (4) Doing so is necessary to update or upgrade the device's software and access is limited

to that purpose; or

     (5) Doing so is necessary in response to an imminent threat to life or safety and access is

limited to that purpose.

     16-107-4. Follow up required after accessing a service.

     (a) Within seventy-two (72) hours of accessing a device's location tracking technology in

response to an imminent threat to life or safety, the school employee or law enforcement official

who accessed the device shall provide the student whose device was accessed, their parent or

legal guardian and the educational institution a written explanation of the precise threat that

prompted the access and what data and features were accessed.

     (b) No school employee or third party may use a device's location tracking technology to

track a device's real-time or historical location, unless:

     (1) Such use is ordered pursuant to a judicial warrant;

     (2) The student to whom the device was provided, or their parent or legal guardian, has

notified a school employee or law enforcement official in writing that the device is missing or

stolen; or

     (3) Doing so is necessary in response to an imminent threat to life or safety and access is

limited to that purpose.

     (c) No personally-identifiable student data obtained or received from a device by a school

employee or authorized third party may be sold, shared, or otherwise transferred to another third

party, except pursuant to a valid opt-in agreement or other express authorization from a student

and their parent or legal guardian.

     16-107-5. Remote access prohibited.

     (a) No educational institution or third party shall activate or access any audio or video

receiving, transmitting, or recording functions on a student's device, unless:

     (1) A student initiates a video chat or audio chat for educational purposes and access is

limited to that purpose;

     (2) The activation and/or access is ordered pursuant to a judicial warrant; and

     (3) Doing so is necessary in response to an imminent threat to life or safety and access is

limited to that purpose:

     (b) Within seventy-two (72) hours of accessing a device's audio or video receiving,

transmitting, or recording functions in response to an imminent threat to life or safety, the school

LC001954 - Page 4 of 7

employee or law enforcement official who accessed the device shall provide the student whose

device was accessed, their parent or legal guardian and the educational institution a written

explanation of the precise threat that prompted the access and what data and features were

accessed.

     (c) This section shall not apply to video chats, audio chats or file transfers initiated by a

student for educational purposes and with the consent of a parent or guardian.

     16-107-6. Reasonable suspicion required for searches.

     (a) No educational institution shall search the contents of a device absent reasonable

suspicion that a student has engaged in misconduct.

     (b) Educational institutions shall, as soon as practicable, but no later than forty-eight (48)

hours after a search has taken place, notify a student's parent or legal guardian in writing that a

search was conducted, and the reasons for the search.

     (c) This shall not include instances when the student's parent or legal guardian consents

to a search.

     16-107-7. Parental disabling of Internet filtering software.

     Every educational institution issuing a device shall establish a procedure for parents

and/or legal guardians to request that a blocked website be unblocked in a timely manner, and in

no case shall the time to unblock a website be longer than two (2) business days.

     16-107-8. Location tracking of devices prohibited.

     No educational institution shall engage in location tracking of a device without the

written consent of a child's parent or legal guardian, unless the device has been reported stolen

and a police report has been filed with the local police department.

     16-107-9. Training.

     Notwithstanding any other provisions of this chapter, no school employee may supervise,

direct, or participate in a take-home technology program or access any device or data thereupon

until they have received adequate training to ensure understanding in compliance with the

provisions of this chapter.

     16-107-10. Penalties.

     In any civil action alleging a violation of this chapter, the court may:

     (1) Award to a prevailing applicant or student declaratory relief, damages, and reasonable

attorneys' fees and costs; and

     (2) Award injunctive relief against any school or agent of any educational institution that

or who commits or proposes to commit a violation of this chapter.

LC001954 - Page 5 of 7

     SECTION 2. This act shall take effect upon passage.

========

LC001954

========

LC001954 - Page 6 of 7

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO EDUCATION -- PROTECTING STUDENT PRIVACY ON SCHOOL-

OWNED TECHNOLOGY

***

     This act would establish certain student privacy rights in regard to take-home technology

devices from school. The act would limit the ability of school officials to monitor and search a

student's take-home technology device and would establish the process and criteria which school

officials must follow to access a student's take-home technology device.

     This act would take effect upon passage.

========

LC001954

========

LC001954 - Page 7 of 7