California passes student privacy laws aimed at ed-tech companies

CALIFORNIA — Gov. Jerry Brown signed into law two bills Monday that aim to further protect students’ education records from third parties, the first of their kind in the country.

Both bills, Assembly Bill 1584 and Senate Bill 1177, contain language that supporters say will make timely updates in relation to the Family Educational Rights and Privacy Act — the federal student privacy law — when it comes to protecting students’ privacy online.

Although the laws, which go into effect Jan. 1, do create another level of protection that keeps records hidden from the public, there doesn’t seem to be any detrimental effect on journalists, said Frank LoMonte, the Student Press Law Center’s executive director.

“A news organization is not going to be receiving confidential student data as part of providing a school service,” he said. “The challenge for journalists will be making sure that schools actually understand that the law does not impose any new secrecy requirements above and beyond the already excessive secrecy of the federal FERPA law.”

AB 1584 will require local school officials and third-party technology companies used by the schools to enter a contract that ensures student data shared through those companies’ services is protected in compliance in FERPA.

Richard Pratt, chief consultant to the California State Assembly’s Committee on Education, said he is pleased with the governor’s decision to sign the bill.

“We had several meetings with the administration and didn’t get a lot of feedback, but we didn’t get any negative vibes or any pushback from them on any of the provisions of the bill,” he said. “So we’re not totally surprised, but very pleased.”

SB 1177, also known as the Student Online Personal Information Act, will prohibit education technology companies from using a minor’s personal information for profit.

Richard Holober, executive director of the Consumer Federation of California, said in a statement that SB 177 is “the vanguard for consumer rights in the digital era.”

“Until this point, protecting students’ online information has been a Wild West,” he said.

Pratt said the two new laws are meant to bring FERPA protections “into the 21st century,” and that FERPA was “written when student records were kept in file cabinets, or maybe on floppy disks.”

“Now we’re using the cloud-based services,” he said, “and we’re also using a lot more technology in the classroom for instructional purposes, for classroom management purposes and FERPA hasn’t kept pace with all of that.”

Khaliah Barnes, the Electronic Privacy Information Center’s Student Privacy Project’s director, said that while both laws are “landmark” legislation for student privacy, she said AB 1584 should go further to protect college students, not just K-12.

Barnes also said that California’s new privacy laws set a precedent that could be seen across the states and even at the federal level. In July, Sens. Ed Markey, D-Mass, and Orrin Hatch, R-Utah, introduced a similar bill that would amend FERPA in an effort to better protect student data held by third-party companies that could sell or monetize student data.

Contact SPLC staff writer Michael Bragg by email or at (703) 807-1904 ext. 119.