2016 -- S 2171

========

LC004064

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2016

____________

A N   A C T

RELATING TO EDUCATION -- PROTECTING STUDENT PRIVACY ON SCHOOL-

OWNED TECHNOLOGY

     

     Introduced By: Senators Satchell, Metts, Pichardo, Sheehan, and Archambault

     Date Introduced: January 27, 2016

     Referred To: Senate Education

     It is enacted by the General Assembly as follows:

1

     SECTION 1. Title 16 of the General Laws entitled "EDUCATION" is hereby amended

2

by adding thereto the following chapter:

3

CHAPTER 106

4

STUDENT PRIVACY IN TAKE-HOME TECHNOLOGY PROGRAMS

5

     16-106-1. Definitions. – For the purposes of this chapter:

6

     (1) "Educational institution" or "school" means a private or public institution that offers

7

participants, students, or trainees an organized course of study or training that is academic, trade-

8

oriented or preparatory for gainful employment in a recognized occupation and shall include any

9

person acting as an agent of the institution.

10

     (2) "Device" means any computer, including laptop or tablet computers, or other

11

electronic device owned or maintained by the educational institution and provided to a student

12

pursuant to a take-home technology program.

13

     (3) "Internet filtering measures" means the use of a specific technology or program to

14

block or filter access to websites on the Internet.

15

     (4) "Location tracking" means a global positioning service or other mapping, locational,

16

or directional information service, used to determine the location of the device in real time or

17

historically.

18

     (5) "Remote access" means the ability to access a computer from a remote location. This

 

1

includes the ability to view a computer's network, desktop or files from an external location or

2

server, as well as the ability to open, modify, or delete programs.

3

     (6) "Student" means any student, participant, or trainee, whether full-time or part-time, in

4

an organized course of study at an educational institution.

5

     (7) "Take-home technology program" means any program wherein a device is provided

6

to a student for overnight or at-home use.

7

     16-106-2. Optional participation in take-home technology programs. -- (a) No

8

educational institution shall compel, coerce, or require a student to participate in a take-home

9

technology program.

10

     (b) No student shall be permitted to participate in a take-home technology program

11

without the written consent of the student's parent or guardian, including the signing of an opt-in

12

agreement.

13

     (c) A valid opt-in agreement shall identify, with specificity:

14

     (1) The precise subset of data on the device to which access is being granted;

15

     (2) The name of the school employee(s) or third party to whom the authority to access the

16

data on the device is being granted;

17

     (3) The name of any third party to whom data is being sold, shared, or otherwise

18

transferred; and

19

     (4) The purpose(s) for which the school employee(s) or third party is being granted

20

access to the device or for which data is being sold, shared, or otherwise transferred.

21

     (d) An opt-in agreement shall not be valid if it actually or effectively grants a third party:

22

     (1) General authority to access a student's device; or

23

     (2) The authority to collect all personally-identifiable student data that is generated by

24

and/or used in connection with a specific program or application.

25

     (e) No third party or school employee who receives personally identifiable information

26

from a device pursuant to an opt-in agreement may share, sell or otherwise transfer such data to

27

another third party.

28

     (f) An opt-in agreement may be revoked at any time, upon written notice to an

29

educational institution, buy a student or their parent or guardian. Within fourteen (14) days of

30

such a revocation, notice to any affected third parties shall be made by the educational institution.

31

     (g) No device or other educational benefit may be withheld from, or punitive measure

32

taken against, a student or their parent or legal guardian:

33

     (1) Based in whole or in part upon a decision not to sign, or to revoke, an opt-in

34

agreement; or

 

LC004064 - Page 2 of 6

1

     (2) Based in whole or in part upon a student's refusal to open, close, or maintain an e-mail

2

or other electronic communications or social media account with a specific service provider.

3

     (h) Where a take-home technology program is offered at an educational institution, any

4

attempt by the educational institution or a third party to condition the offer, provision or receipt of

5

a device upon a student's or their parent's or legal guardian's agreement to provide or permit the

6

sharing of personally-identifiable student data is unlawful under this chapter.

7

     (i) When a device is permanently returned by a student, the educational institution or

8

third party who provided it shall, without otherwise accessing the data on the device, fully erase

9

all the data stored on the device and return the device to its default factory settings.

10

     16-106-3. Use of data on take-home technology. -- (a) Where an educational institution

11

or third party provides a student with a technological device pursuant to a take-home technology

12

program, no school employee or third party may access such a device or the data thereupon,

13

either remotely or in person, except in accordance with the provisions of this chapter.

14

     (b) No school employee or third party may access any data input into, stored upon, or

15

sent or received by a student's device, including its browser, keystroke or location history, unless:

16

     (1) A school employee or third party has been authorized to access specific data by a

17

student and their parent or legal guardian pursuant to a valid opt-in agreement, and access is

18

limited to that purpose;

19

     (2) A school employee has reasonable suspicion that the student has violated or is

20

violating a school policy and that data on the device contains evidence of the suspected violation,

21

subject to the following limitations:

22

     (i) Prior to searching a student's device based on reasonable suspicion, the school

23

employee shall document the reasonable suspicion and notify the student's parent or legal

24

guardian of the suspected violation and what data will be accessed in searching for evidence of

25

the violation;

26

     (ii) Searches of a student's device based upon a reasonable suspicion of a school policy

27

violation shall be strictly limited to finding evidence of the suspected policy violation; and

28

     (iii) Where a student is suspected of illegal conduct, no search may occur unless a judicial

29

warrant has been secured, even if the student is also suspected of a related or unrelated violation

30

of school policy.

31

     (3) A school employee or law enforcement official reasonably suspects the student has

32

engaged or is engaging in illegal conduct, reasonably suspects data on the device contains

33

evidence of the suspected illegal conduct, and has secured a judicial warrant for a search of the

34

device;

 

LC004064 - Page 3 of 6

1

     (4) Doing so is necessary to update or upgrade the device's software and access is limited

2

to that purpose; or

3

     (5) Doing so is necessary in response to an imminent threat to life or safety and access is

4

limited to that purpose.

5

     16-106-4. Follow up required after accessing a service. -- (a) Within seventy-two (72)

6

hours of accessing a device's location tracking technology in response to an imminent threat to

7

life or safety, the school employee or law enforcement official who accessed the device shall

8

provide the student whose device was accessed, their parent or legal guardian and the educational

9

institution a written explanation of the precise threat that prompted the access and what data and

10

features were accessed.

11

     (b) No school employee or third party may use a device's location tracking technology to

12

track a device's real-time or historical location, unless:

13

     (1) Such use is ordered pursuant to a judicial warrant;

14

     (2) The student to whom the device was provided, or their parent or legal guardian, has

15

notified a school employee or law enforcement official in writing that the device is missing or

16

stolen; or

17

     (3) Doing so is necessary in response to an imminent threat to life or safety and access is

18

limited to that purpose.

19

     (c) No personally-identifiable student data obtained or received from a device by a school

20

employee or authorized third party may be sold, shared, or otherwise transferred to another third

21

party, except pursuant to a valid opt-in agreement or other express authorization from a student

22

and their parent or legal guardian.

23

     16-106-5. Remote access prohibited. – (a) No educational institution or third party shall

24

activate or access any audio or video receiving, transmitting, or recording functions on a student's

25

device, unless:

26

     (1) A student initiates a video chat or audio chat for educational purposes and access is

27

limited to that purpose;

28

     (2) The activation and/or access is ordered pursuant to a judicial warrant; and

29

     (3) Doing so is necessary in response to an imminent threat to life or safety and access is

30

limited to that purpose:

31

     (b) Within seventy-two (72) hours of accessing a device's audio or video receiving,

32

transmitting, or recording functions in response to an imminent threat to life or safety, the school

33

employee or law enforcement official who accessed the device shall provide the student whose

34

device was accessed, their parent or legal guardian and the educational institution a written

 

LC004064 - Page 4 of 6

1

explanation of the precise threat that prompted the access and what data and features were

2

accessed.

3

     (c) This section shall not apply to video chats, audio chats or file transfers initiated by a

4

student for educational purposes and with the consent of a parent or guardian.

5

     16-106-6. Reasonable suspicion required for searches. – (a) No educational institution

6

shall search the contents of a device absent reasonable suspicion that a student has engaged in

7

misconduct.

8

     (b) Educational institutions shall, as soon as practicable, but no later than forty-eight (48)

9

hours after a search has taken place, notify a student's parent or legal guardian in writing that a

10

search was conducted, and the reasons for the search.

11

     (c) This shall not include instances when the student's parent or legal guardian consents

12

to a search.

13

     16-106-7. Parental disabling of internet filtering software. -- Every educational

14

institution issuing a device shall establish a procedure for parents and/or legal guardians to

15

request that a blocked website be unblocked in a timely manner, and in no case shall the time to

16

unblock a website be longer than two (2) business days.

17

     16-106-8. Location tracking of devices prohibited. -- No educational institution shall

18

engage in location tracking of a device without the written consent of a child's parent or legal

19

guardian, unless the device has been reported stolen and a police report has been filed with the

20

local police department.

21

     16-106-9. Training. – Notwithstanding any other provisions of this chapter, no school

22

employee may supervise, direct, or participate in a take-home technology program or access any

23

device or data thereupon until they have received adequate training to ensure understanding in

24

compliance with the provisions of this chapter.

25

     16-106-10. Penalties. -- In any civil action alleging a violation of this chapter, the court

26

may:

27

     (1) Award to a prevailing applicant or student declaratory relief, damages, and reasonable

28

attorneys' fees and costs; and

29

     (2) Award injunctive relief against any school or agent of any educational institution that

30

commits or proposes to commit a violation of this chapter.

31

     SECTION 2. This act shall take effect upon passage.

========

LC004064

========

 

LC004064 - Page 5 of 6

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO EDUCATION -- PROTECTING STUDENT PRIVACY ON SCHOOL-

OWNED TECHNOLOGY

***

1

     This act would establish certain student privacy rights in regard to take-home technology

2

devices from school. The act would limit the ability of school officials to monitor and search a

3

student's take-home technology device and would establish the process and criteria which school

4

officials must follow to access a student's take-home technology device.

5

     This act would take effect upon passage.

========

LC004064

========

 

LC004064 - Page 6 of 6