HOUSE DOCKET, NO. 1870        FILED ON: 1/19/2017

HOUSE  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  No. 253

The Commonwealth of Massachusetts

_________________

PRESENTED BY:

Kimberly N. Ferguson

_________________

To the Honorable Senate and House of Representatives of the Commonwealth of Massachusetts in General
Court assembled:

The undersigned legislators and/or citizens respectfully petition for the adoption of the accompanying bill:

An Act relative to student data privacy.

_______________

PETITION OF:

HOUSE DOCKET, NO. 1870        FILED ON: 1/19/2017

HOUSE  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  No. 253

The Commonwealth of Massachusetts

_______________

In the One Hundred and Ninetieth General Court
(2017-2018)

_______________

An Act relative to student data privacy.

Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority of the same, as follows:
 

SECTION 1. Chapter 71 of the Massachusetts General Laws is hereby amended by adding at the end thereof the following section:--

Section 97. (a) As used in this section, the following words shall have the following meanings unless the context clearly requires otherwise:

''District'' or ''school district'', the school department of a city, town, regional school district, county agricultural school, charter school, or private school.

“Personal social media account", a social media account, service or profile that is used by a current or prospective student exclusively for personal communications unrelated to any educational purpose of the school district; provided however, that “personal social media account” shall not include any social media account created, maintained, used or accessed by a student or prospective student for education related communications or for an educational purpose of the school district.

“Social media”, an electronic medium allowing users to create, share and view user-generated content including, but not limited to, uploading or downloading videos or still photographs, audio content, blogs, video blogs, podcasts, messages, e-mails or internet website profiles or locations. 

(b) Each school district shall not:

(i) require, request or cause a student to disclose a user name, password or other means for access, or provide access through a user name or password, to a personal social media account;

(ii) compel a student , as a condition of acceptance or participation in curricular or extracurricular activities, to add a person, including, but not limited to, a coach, teacher, school administrator or other school employee or school volunteer, to the student’s or applicant’s list of contacts associated with a personal social media account;

(iii) require, request or cause a student to reproduce in any manner photographs, videos, or information contained within a personal social media account; or

(iv) take or threaten adverse action against a student , including, but not limited to, restraining the student’s participation in extracurricular activities, for refusing to disclose information specified in clause (i) or clause (iii) or for refusing to add a coach, teacher, school administrator or other school employee or school volunteer to a list of contacts associated with a personal social media account, as specified in clause (ii).

(c) This section shall not apply to information about a student that is publicly available.

(d) Nothing in this section shall limit a school district’s right to promulgate and maintain lawful policies governing the use of the school district’s electronic equipment, including policies regarding use of the internet, email or social media.

(e) An aggrieved student may institute a civil action for damages or to restrain a violation of this section and may recover: (i) $1,000 for each request that violates clause (i) or (ii) of subsection (b); (ii) $1,000 for each adverse action, which violates clause (iii) of subsection (b), or actual damages, whichever amount is higher; (iii) punitive damages if a court determines that a violation was willful; and (iv) reasonable attorneys’ fees and other litigation costs reasonably incurred.

(f) Nothing in this section shall prevent the school district from requesting access to a student’s personal social media account to ensure compliance with applicable state or federal laws or judicial directives; provided, however, that a school district, prior to requesting access to a personal social media account, shall notify the student and the student’s parent or guardian of the grounds for the request; and provided further, that (i) the school district has no other means of obtaining the relevant information; (ii) information gained from access to the student’s personal social media account shall be used solely for purposes of the investigation or a related proceeding; and (iii) any access to a student’s personal social media account shall be limited to identifying relevant evidence. If a student does not permit access to a personal social media account, the school district shall not take or threaten adverse action against a student for refusing to permit access to said personal social media account.

(g)  An operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for K-12 school purposes and was designed and marketed for K-12 school purposes shall not use the online service to sell student data or to process student data in furtherance of advertising or to amass a profile on a K-12 student provided that the online service provider may process student data to provide, improve, develop or maintain the integrity of its online services. Furthermore, such operator shall take all reasonable steps to protect the privacy of the data at rest and in motion in a manner that meets or exceeds commercial best practice.

Nothing in this section prohibits such operator from using aggregated student information to demonstrate the effectiveness of the operator’s products or services, including in his marketing or within the operator’s site, service, or application or other sites, services, or applications owned by the operator to improve educational projects.

SECTION 2. (a)This section shall not be construed to limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction.

(b) This section shall not prohibit an operator from complying with federal or state law that requires the disclosure of student information.

(c) This section shall not prohibit an operator from using student information for legitimate research purposes: (A) as required by state or federal law and subject to the restrictions under applicable state and federal law or (B) as allowed by state or federal law and under the direction of a school, school district, or state department of education, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the student for purposes other than K-12 school purposes. 

(d) This section shall not limit internet service providers from providing internet connectivity to schools or students and their families.

(e) This section shall not be construed to prohibit an operator of an internet website, online service, online application, or mobile application from marketing educational products directly to parents so long as the marketing did not result from the use of covered information obtained by the operator through the provision of services covered under this section.

(f) This section shall not impede the ability of students to download, export, or otherwise save or maintain their own student created data or documents.