Legislature(2013 - 2014)CAPITOL 106
04/11/2014 08:00 AM House EDUCATION
| Audio | Topic |
|---|---|
| Start | |
| HB257 | |
| HB365 | |
| Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
| *+ | HB 257 | TELECONFERENCED | |
| + | TELECONFERENCED | ||
| += | HB 365 | TELECONFERENCED | |
HB 257-ACCESS TO STUDENT DATA
8:05:33 AM
CHAIR GATTIS announced that the first order of business would be
HOUSE BILL NO. 257, "An Act relating to restrictions on the
collection, storage, and handling of student data."
8:06:13 AM
REPRESENTATIVE REINBOLD moved to adopt the proposed committee
substitute (CS) for HB 257, labeled 28-LS1096\Y, Mischel,
4/10/14 as the working document. There being no objection,
Version Y was before the committee.
8:06:28 AM
ELIJAH VERHAGEN, Staff, Representative Lora Reinbold, Alaska
State Legislature, presented HB 257, on behalf of the sponsor,
Representative Lora Reinbold, paraphrasing from the sponsor
statement, said:
As the educational system merges into the Digital Age
it is important that we protect the privacy, security,
and confidentiality of student data. Throughout
Alaska, and our country as a whole, there has been
growing public concern about the collection of
personal data. [HB] 257 addresses these concerns and
strengthens student digital privacy laws.
Referenced by the U.S. Secretary of Education,
Secretary Duncan, in the supporting documents in your
packet entitled, "Technology in Education, Privacy and
Progress," Secretary Duncan states, on page 3, three
paragraphs from the bottom, that there are three
keystone federal laws protecting student privacy: The
Family Educational Rights and Privacy Act, The
Protection of Pupil Rights Amendment, and the
Children's Online Privacy Protection Act.
Directing attention to page 4, second paragraph down,
he continues and says, "But federal law provides only
some of the guard rails for data and privacy practice.
Much of the control over these issues lies in the
policies of states and districts."
And so, the U.S. Secretary of Education is kind of
asking for the states' participation in helping ensure
that all children and their families' privacy rights
are secured.
There are four states so far that have either
introduced and passed similar private data privacy
legislation or are working on it right now. The
states of New York and Oklahoma have already passed
similar legislation and the states of Idaho and
Louisiana are currently working on legislation. Both
of the states have a bill that has passed one of the
bodies and is currently in the process and moving
forward.
So for Alaska's case, this bill is more of a
preventative measure. To get ahead of the game and
protect our students and their families' privacy
before it really becomes a major issue in Alaska, but
with the current direction that we're going and using
all the wonderful capabilities that we have nowadays
with technology it is important at the same time to be
cautious of students and their private information
that can be easily accessed by computer hacking on the
web.
8:11:25 AM
MR. VERHAGEN continued by providing a sectional analysis of HB
257, Version Y. Section 1 would amend the access to school
records to include student data based on the preference of the
parent, foster parent, or guardian. Currently, a parent can
receive a physical copy of student's record and this language
would allow them to obtain it in a digital form.
8:12:04 AM
CHAIR GATTIS asked whether a parent can currently obtain this
information.
MR. VERHAGEN answered yes; that parents can ask and obtain a
physical copy of the student's record. This bill would amend it
to allow parents the preference to receive a digital copy.
8:12:24 AM
REPRESENTATIVE SEATON directed attention to line 12 to paragraph
(2), which read, "record information that consists of the
child's address ...." He asked if this is the only personal
identifier that should be excluded or if phone numbers or other
information should be excluded.
MR. VERHAGEN answered that the language is in current statute.
Further on in the bill, the language will limit access to school
districts and to restrict outside entities from gathering
information, he said.
8:13:35 AM
REPRESENTATIVE REINBOLD acknowledged Representative Seaton's
point and she agreed it needs to be addressed.
8:13:45 AM
REPRESENTATIVE SEATON pointed out that the potential for broad
distribution with electronic means exists and the sponsor may
wish to also consider adding phone numbers to the list of
restricted information.
MR. VERHAGEN offered to look into this further.
8:14:22 AM
MR. VERHAGEN continued with Section 2, Version Y, which adds a
new subsection that bans the use of student data for commercial
purposes without the consent of a parent or legal guardian.
8:14:41 AM
REPRESENTATIVE LEDOUX asked whether that information is
currently banned.
MR. VERHAGEN responded that it is not currently banned and this
language would establish a preventative measure for a situation
that is becoming prevalent in the Lower 48. He said the
Department of Education and Early Development (EED) does not
currently give out information for commercial use.
8:15:19 AM
REPRESENTATIVE SADDLER referred to page 2, line 3, of HB 257,
Version Y, which refers to "student's parent or legal guardian",
but similar language on page 4, line 2 of Version Y, adds,
"foster parent" to the list. He asked for further clarification
on why was it necessary to include foster parents on page 4 but
not mention them on page 2.
MR. VERHAGEN responded that it may be an oversight.
REPRESENTATIVE LEDOUX added that Section 1 also contains a
foster parent reference.
8:16:18 AM
REPRESENTATIVE SEATON noted that currently the information is
not given out for commercial purposes, but the language [on page
2, lines 1-10] provides an avenue to do so. He questioned what
benefit this is to students and if the legislature needs to make
this exception. He offered to discuss this issue further with
the sponsor.
8:17:35 AM
REPRESENTATIVE REINBOLD explained that the intent is to prevent
students from being targeted for marketing purposes. She was
uncertain of what approach to take and whether it should be by
parental consent or simply not allowed.
REPRESENTATIVE SADDLER offered his preference that public
information gathered in this way should not be available for any
commercial use, and the bill should use an opt-in approach
rather than an opt-out approach.
REPRESENTATIVE REINBOLD agreed.
REPRESENTATIVE LEDOUX said schools should be concerned with
teaching rather than these types of issues related to marketing.
She offered her preference for a blanket blackout without
options.
REPRESENTATIVE REINBOLD responded that she tended to agree.
8:19:40 AM
MR. VERHAGEN directed attention to Section 3 of Version Y, which
adds a new section for school district data security that
requires each school district in the state to adopt, implement,
and monitor a plan and policies for student data security and to
annually publish the plan, a data inventory, and an explanation
of the inventory to increase transparency for parents and
guardians. The data security would include a description of
each data field, the reason for collection and additional
information published annually on the school's website. Thus,
districts could develop their own security data plan to increase
security of student information. Adoption, implementation and
compliance would meet EED's requirements for security measures,
as well. Parents would have access to the school website to see
what student information is available. He concluded that the
intent is to provide transparency while securing private
information.
8:23:18 AM
CHAIR GATTIS asked why schools collect the data and the reason
for schools to have this information. She related a scenario to
illustrate how the information might be accessed and used by
parents, teachers, and the school. She asked whether any data
will be collected on students such as their reading ability.
MR. VERHAGEN clarified that HB 257 is intended to restrict the
ability for the information to be "hacked into" since the
department would already have access to the data.
8:26:25 AM
REPRESENTATIVE DRUMMOND referred to proposed Sec. 3,
subparagraphs (A)-(F) of Version Y, and asked whether this is
the type of information published by other states that use data
security systems.
MR. VERHAGEN answered he believes that is correct; that HB 257
is similar to legislation passed by other states since it is
based on model legislation.
8:27:00 AM
REPRESENTATIVE DRUMMOND referred to subparagraph (D) of Version
Y, and asked why the public should know where the server is
located. She wondered if that knowledge could lead to a data
security breach.
MR. VERHAGEN offered to look into this aspect. He suggested the
location may be general, such as advising the public that the
server containing the student information is retained on site
rather than contracted out.
REPRESENTATIVE DRUMMOND pointed out all of the information
resides on the server so these are high security areas. She
offered her belief that knowing that the information is held in-
state versus in another state or country may be more acceptable
approach to take.
MR. VERHAGEN responded with agreement.
8:29:08 AM
REPRESENTATIVE SEATON directed attention to subparagraph (E) of
Version Y, which read, "a list of nongovernmental entities that
have access to one or more student data fields linked to
personally identifiable information." He asked the reason
nongovernmental agencies should have access to student data.
MR. VERHAGEN related that the examples include testing services
or on-line educational support services that are nongovernmental
organizations (NGOs).
REPRESENTATIVE SEATON offered to hold the question for the
department.
8:32:16 AM
REPRESENTATIVE REINBOLD, in response to Representative Seaton,
clarified that subparagraph (E), Version Y, isn't designed for
permissiveness, but is to establish parameters.
8:33:03 AM
MR. VERHAGEN related that proposed Sec. 4 of Version Y,
provides a definition of "student data" which read as
follows:
Sec. 14.03.200. Definition. In AS 14.03.015 -
14.03.200, "student data" means
(1) electronic information pertaining to an individual
student or group of students collected or reported by
a school while the student or group of students was
enrolled in a school in the state or that was accessed
or produced by a student or group of students while
enrolled in a school in the state;
(2) electronic information pertaining to a student or
group of students that has been or is intended to be
transmitted to or stored by a third-party contractor
that provides cloud computing services or other
similar services to the school; and
(3) electronic mail communication and access
information, document production, and similar
electronic information accessed or produced by a
student on a school server
MR. VERHAGEN acknowledged that information can be useful to
teachers; however, it will prohibit future collection of
irrelevant information that isn't vital for helping the
student with their success.
8:34:26 AM
REPRESENTATIVE SADDLER said definitions are important controls.
He directed attention to page 3, line 1, of Version Y, which
limits data generated when a student was enrolled in a school.
He noted that language isn't carried forward in paragraphs (2)
and (3). He encouraged redrafting to carry forward that
language.
MR. VERHAGEN agreed.
8:35:05 AM
REPRESENTATIVE SADDLER referred to page 3, line 8, to paragraph
(3). He asked for further clarification on whether his
understanding is correct, that paragraph (1) relates to website
visits and paragraph (3) relates to electronic mail accessed or
sent by a student.
MR. VERHAGEN agreed the definition is important. He offered to
work with the drafters to ensure these points are covered.
8:35:52 AM
REPRESENTATIVE SEATON suggested that student data may need to be
separated into two groups, one for private personal information
and another for other student related information or activities.
He related a scenario to illustrate how a student preparing a
video might inadvertently release private information if it is
attached. He offered to work with the sponsor on the language.
MR. VERHAGEN agreed to continue to work on the language. He
directed attention to page 3 of the U.S. Secretary Duncan's
statement on technology to the phrase which read, "No one make
you sign up for Facebook, but you have to go to school. Our
expectations for the protection of children must be paramount."
He said the school should keep relevant information to help the
student but not keep irrelevant information if the student
happens to give more details.
8:38:53 AM
REPRESENTATIVE DRUMMOND suggested that parental oversight may be
lacking. She asked for further clarification on the source of
the model legislation.
MR. VERHAGEN answered that HB 257 is modeled after New York
legislation. He offered to provide a copy to the committee.
REPRESENTATIVE LEDOUX related his understanding, based on [a
drafting memo from Legal Services] that the bill was based on
model legislation prepared by the ALEC [the American Legislative
Exchange Council].
REPRESENTATIVE REINBOLD agreed; she elaborated that Microsoft
actually helped design some of language due to the prevalence of
data security issues.
8:40:01 AM
MR. VERHAGEN turned to Section 5 of Version Y, which adds
several duties to the State Board of Education and Early
Development that relate to adoption of a data inventory and
policies and procedures regarding access to student data. He
referred to page 3, lines 26-28, to proposed paragraph (6),
which read:
(6) policies and procedures consistent with relevant
state and federal privacy laws that
(A) limit access to individual and redacted
student data to
(i) persons who require access to perform
duties assigned by the department, a school district,
the administrator of a public school;
(ii) the student who is the subject of
the data and the student's parent, foster parent,
or guardian;
(iii) authorized agencies as provided
in state or federal law or by an interagency
agreement;
MR. VERHAGEN explained that this bill will work with the three
aforementioned federal acts to tighten student data.
8:41:49 AM
REPRESENTATIVE REINBOLD offered her belief that the department
doesn't need access to certain information so this bill limits
access to information that could be construed as invading
privacy.
MR. VERHAGEN referred to sub-subparagraphs (i)-(iii), which
would allow parents to access student data.
8:42:53 AM
REPRESENTATIVE SEATON asked whether the reference to AS
14.03.075 [on page 3, line 21] refers to the secondary school
competency testing, the HSGQE [High School Graduation Qualifying
Examination] which has been repealed. He suggested that this
may need some revision.
REPRESENTATIVE REINBOLD welcomed Representative Seaton's
assistance in refining the bill.
8:43:48 AM
MR. VERHAGEN, continuing with the sectional analysis of proposed
Sec. 5 of Version Y, noting this language allows access by
authorized agencies in state and federal law or by interagency
agreement. Subparagraph (B) would restrict student data
transfer except as necessary to comply with state and federal
law as per the aforementioned federal Acts. It also would not
limit schools from transferring data to other schools when
students transfer. In addition it would allow the state to
compare multistate data to better evaluate the state's progress;
however, but would not use personal information.
MR. VERHAGEN related that subparagraph (C) of Version Y
prohibits collecting and reporting student data pertaining to
juvenile delinquency records, criminal records, or health
records.
8:45:38 AM
REPRESENTATIVE LEDOUX suggested that criminal records might be
quite relevant to what should be collected, noting that criminal
records are not private records.
REPRESENTATIVE REINBOLD offered to research this aspect.
8:47:54 AM
REPRESENTATIVE DRUMMOND agreed; noting that it's important to
ensure the safety of Alaskan children. She asked for further
clarification on the intent of subparagraph (C).
REPRESENTATIVE REINBOLD responded that the goal is to protect
privacy of students and eliminate access by marketers.
8:49:59 AM
REPRESENTATIVE SEATON commented on [sub-subparagraph] (v) to
political or religious affiliation and agreed there wouldn't be
a need to collect that type of information. He suggested that
schools need to collect certain data, such as health record
information, which may prove vital in certain situations. Even
though this would not be made public, it may be a necessity for
school officials to have access to student health information.
He stressed the importance of not attaching specific names to
the data; however, he acknowledged that the collection is
important, but it should not be published.
8:51:41 AM
REPRESENTATIVE LEDOUX pointed out another example of medical
necessity could be relevant such as information that a student
with the AIDS virus "bit" another student.
CHAIR GATTIS agreed that allergies and emergency numbers are
important to collect.
REPRESENTATIVE REINBOLD added that it is important to note
proposed sub-subparagraph (iii) indicates "without the written
consent of a parent or legal guardian." She recalled a scenario
to illustrate that some type of protection for children is
important.
8:53:51 AM
REPRESENTATIVE LEDOUX noted that in some situations a parent may
not want to disclose information, such as that their child has
AIDS, but it may still be relevant information for the school to
know.
8:54:16 AM
REPRESENTATIVE DRUMMOND acknowledged that type of information
may delve into a delicate subject area, but many reasons for
full disclosure on medical history exist. She offered her
belief that individual schools already handle these issues. She
noted the bill appears to be focused on digital data. The area
of medical assistance in schools is becoming more minimal and
she suggested avoiding this in the bill.
8:56:10 AM
REPRESENTATIVE REINBOLD pointed out that HB 257 is designed to
protect student information and ensure privacy around data that
is collected.
REPRESENTATIVE DRUMMOND directed attention to subparagraph (C)
of Version Y, which states that the board shall adopt policies
and procedures that "prohibit collecting and reporting student
data pertaining to" and under sub-subparagraph (iii) and it goes
on to identify "medical and health records without the written
consent of the student's parent or guardian ...." She said
dealing with students on a day-to-day basis at a school is
different from collecting and reporting student data. She
thought it'd be important to know if an elementary school had
three diabetic students to address issues that may require
having a visiting nurse. She offered her belief that individual
students aren't covered by the bill.
MR. VERHAGEN agreed. He acknowledged the parents will want to
ensure their children get appropriate care at school and likely
would report health issues such as diabetes.
8:58:43 AM
MR. VERHAGEN directed attention to subparagraph (D) of Version
Y, which requires schools to have a detailed data security plan
that includes ways to address privacy, authentication, breaches
in security, training, encryption, and other data retention and
disposition practices.
MR. VERHAGEN finished by noting proposed Sec. 6 would cross-
reference the definition to proposed Sec. 5 for "student data."
9:00:02 AM
JOSEPH CHATFIELD said this bill is a good start towards
protecting student privacy although it doesn't go quite far
enough. He shared some of the concerns expressed today. The
health records issues are ones already taken care of by the
health department, such as issues related to communicable
diseases. Thus, this bill provides duplicate efforts and health
records don't need to be included, unless a condition has a
direct effect on others. He related a personal scenario to
illustrate the volume of documents requiring signatures in order
for his child to attend a school field trip, including
permission to allow access to all of his child's medical
records, which isn't relevant. The Health Insurance Portability
and Accountability Act (HIPAA) laws protect patients and
safeguard this information. Furthermore, public health nurses
work closely with the public schools. Therefore, other than
targeted items, such as diabetes or allergies, the health
information should not be collected. He also strongly objected
to collecting any data on religion or political affiliation. He
thanked members.
9:05:29 AM
REPRESENTATIVE DRUMMOND reiterated that to have health care
record access for field trip related activities is important.
She recalled a news report in which a vehicle filled with
California students on a field trip was involved in a serious
accident, which emphasizes that the need for medical information
may arise.
CHAIR GATTIS also related her experience as a chaperone on
school trips and the importance of having access to pertinent
health and parent contact information.
REPRESENTATIVE LEDOUX acknowledged that it can be difficult to
ascertain what is pertinent until an accident occurs.
CHAIR GATTIS acknowledged that it's important for the schools to
retain some information, but acknowledged that parents may feel
very uncomfortable providing specific information.
9:09:01 AM
REPRESENTATIVE SEATON commented that the availability of school
nurses varies throughout the state as does the access to public
health nurses. For example, he noted that two nurses cover the
entire Kenai Peninsula.
CHAIR GATTIS agreed that school nurses are often shared. She
asked what the EED is doing in regards to student privacy. She
recognized that some states in the Lower 48 have experienced
privacy breeches.
9:11:56 AM
LES MORSE, Deputy Commissioner, Office of the Commissioner,
Department of Education and Early Development (EED), understood
the intent of HB 257 is to protect student data and the
department is clear and cautious in this regard. He stated HB
257 is fairly complex. He related that the department follows
the Family Education Rights to Privacy Act (FERPA), which
provides school districts with guidance. This law indicates
what information can be disclosed and what can't be disclosed.
It also requires districts to provide public notice and notice
to all families at the beginning of the year informing them of
family rights. Another law he is less familiar with is HIPAA;
however, this law does provide additional privacy protections.
With respect to the new assessments, the department has been
assessing students for the state for many years.
MR. MORSE indicated that the department has been collecting
individual student data using a student identifier for over ten
years. He indicated that the student identifier number and name
is confidential information. He recapped that disclosure of
student data is treated with the greatest respect and security
by districts and the department. The department does not intend
to treat data any differently than it currently does. He
understood that some people have expressed concerns about
consortiums having access to student data and the state is no
longer part of any consortium. The state has contracted with an
individual enterprise for testing, but since the 1990s has
developed and used a state test. He reiterated the department
doesn't plan on any changes.
9:16:17 AM
REPRESENTATIVE REINBOLD expressed interest in working with the
department and others to hone the focus of the bill.
9:17:07 AM
REPRESENTATIVE SEATON referred to pages 2-3, to proposed Sec. 4
of Version Y, noting that the definition of "student data" may
require clarification.
[HB 257 was held over].
| Document Name | Date/Time | Subjects |
|---|---|---|
| HB 257 version C.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| HB 257 Sponsor Statement version C.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| HB 257 Sectional version C.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| Endorsement letter for HB 257.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| HB 257 - Legal Opinion.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| HB 365 - KPBSD test scores.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 365 |
| HB 365 - University of Alaska data.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 365 |
| HB 257 Sectional analysis - Legal.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| HB 257 - Remarks by Sec. Duncan.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| 257 version P.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 257 |
| Changes to CS HB 93 by section.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 93 |
| WK_ParentStudent_Brochure.pdf |
HEDC 4/11/2014 8:00:00 AM |
HR 9 |
| Timeline Standards Transition and Implementation Process.pdf |
HEDC 4/11/2014 8:00:00 AM |
HR 9 |
| Nat'l Alliance of PCS - Written Testimony - AK_March 2014.pdf |
HEDC 4/11/2014 8:00:00 AM |
HB 93 |