HOUSE BILL NO. 178

AMENDMENT IN THE NATURE OF A SUBSTITUTE

(Proposed by the House Committee on Education

on ________________)

(Patron Prior to Substitute—Delegate Anthony)

A BILL to amend the Code of Virginia by adding in Article 5 of Chapter 14 of Title 22.1 a section numbered 22.1-289.01:1, relating to public schools; student support services; student personal information and data security; certification; requirements; report.

Be it enacted by the General Assembly of Virginia:

1. That the Code of Virginia is amended by adding in Article 5 of Chapter 14 of Title 22.1 a section numbered 22.1-289.01:1 as follows:

§ 22.1-289.01:1. Student support services; certified student support agencies; student personal information and data security; requirements; report.

A. As used in this section:

"Certified student support agency" means a nonprofit organization certified by the Commonwealth pursuant to subsection B to provide student support programs to students enrolled in a public elementary or secondary school.

"Personal profile" does not include account information that is collected and retained by a student support agency and remains under control of a student, parent, or elementary or secondary school.

"Secure data transfer" means a method of transmitting data, including personally identifiable information, through the use of certain technical and organizational measures and protocols, including data encryption and authentication, to ensure that the integrity and confidentiality of such data is not compromised during such transfer and is only accessible by authorized recipients.

"Student personal information" means information collected through a student support program that identifies a currently or formerly enrolled individual student or is linked to information that identifies a currently or formerly enrolled student.

"Student support program" means a program administered by a nonprofit organization pursuant to a memorandum of understanding with a school board that involves the receipt of student personal information from the school division for the purpose of providing continuity of education services to at-risk students, including students experiencing housing instability or displacement, and may include housing stabilization, case management, tutoring or instructional support, youth mentoring and development, or summer enrichment services.

"Targeted advertising" means advertising that is presented to a student and selected on the basis of information obtained or inferred over time from such student's online behavior, use of applications, or sharing of student personal information.

B. Each nonprofit organization that seeks to operate a student support program pursuant to a memorandum of understanding with a school board and that receives student personal information from such school board shall register and maintain status as a certified student support agency. In order to register and maintain status as a certified student support agency, each such nonprofit organization shall:

1. Provide at the time of registration and once every three years thereafter or upon request of the Department (i) documentation establishing the organization's nonprofit status; (ii) a copy of the organization's (a) privacy policy and procedures, (b) background check policy and procedures, and (c) mandated reporting policy and procedures; and (iii) a description of each student support program that such organization provides;

2. Agree to provide at least 30 days' notice to the Department prior to the cessation of providing any student support program to public school students in the Commonwealth; and

3. Comply with the provisions of subsections D and E. Nothing in this section shall be construed to prohibit a nonprofit organization from providing student support services if such nonprofit organization does not receive student personal information from a school board.

C. The Department shall be responsible for administering and overseeing the certification of any certified student support agency, in accordance with the provisions of subsection B. In administering and overseeing the certification of any certified student support agency, the Department shall:

1. Develop a certification process;

2. Establish and maintain a registry of each certified student support agency;

3. Develop policies and procedures for the secure disposal of student personal information upon such student's withdrawal from a student support program, upon the cessation of any such program, or upon such student's graduation or transfer from the school division;

4. Develop and implement procedures for reviewing certifications and responding to credible complaints or evidence of noncompliance, including procedures for suspension or revocation of certification for noncompliance, to ensure that each certified student support agency complies with the provisions of this section and any other applicable state or federal law or regulation;

5. Develop a model memorandum of understanding and guidelines and policies for the implementation of such memorandum of understanding to facilitate and establish requirements and limitations relating to the exchange of student personal information between certified student support agencies and school boards in the Commonwealth. Such model memorandum of understanding shall:

a. Act as template for the memorandum of understanding that, pursuant to subdivision D 7, each certified student support agency shall enter into with the applicable school board of any public elementary or secondary school through which it seeks to provide any student support program;

b. Contain specific authorizations of the applicable school board relating to the transmission, collection, and use of student personal information by the certified student support agency; and

c. Require the signed consent of the parent of any student or, in the case of a student who is 18 years of age or older, any student who participates in student support programs to the transmission of student personal information between school boards and the certified student support agency and to the transmission, collection, and use of such specific student's personal information as authorized pursuant to this subdivision;

6. Develop and make available to each certified student support program upon certification standard consent forms and procedures to be used by such certified student support programs to obtain the necessary consent from the parent of any student or, in the case of a student who is 18 years of age or older, any student, in accordance with the provisions of this section; and

7. Develop and make available to each school board and each certified student support program upon certification guidelines on recommended information and data security programs, systems, and protocols and best practices relating to information and data security.

D. Each certified student support agency that operates a student support program in accordance with this section shall:

1. Conform to the provisions of the federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) (FERPA);

2. Annually notify the parent of each student or, in the case of a student who is 18 years of age or older, the student, of the student's rights under FERPA and the provisions of this section;

3. Maintain a privacy policy relating to the security of student personal information that may be collected by the certified student support agency and provide prompt and prominent notice of any changes or updates made to such privacy policy to the applicable school board and to the parents of each student or, in the case of a student who is 18 years of age or older, each student receiving any support services through any such student support program;

4. Provide clear and accessible information to the applicable school board, to be distributed to each student or the parent of each student, detailing (i) the types of student personal information the student support agency collects through the provision of any student support program; (ii) how it maintains and transmits any student personal information collected in a manner that ensures the security, integrity, and confidentiality of such information; (iii) the uses for which any student personal information is collected by the certified student support agency; and (iv) the certified student support agency's privacy policy relating to the security of student personal information;

5. Maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information and makes use of appropriate administrative, technological, and physical safeguards;

6. Establish policies and procedures for facilitating access to and correction of student personal information collected, maintained, used, or shared by a certified student support agency, either directly or through a student's school or teacher, by the parent of each student or, in the case of a student who is 18 years of age or older, each student receiving student support services through the applicable student support program;

7. Execute a memorandum of understanding, in accordance with the memorandum of understanding developed by the Department pursuant to subdivision C 5;

8. Collect, maintain, and use student personal information only (i) with the informed consent of the parent of each student or, in the case of a student who is 18 years of age or older, each student, receiving support services through the applicable student support program and (ii) for the purposes authorized pursuant to the memorandum of understanding executed in accordance with subdivision 7;

9. Require any successor nonprofit organization with which the certified student support agency shall exchange any student personal information to comply with the agency's privacy policies and procedures, the provisions of FERPA, and the provisions of this section;

10. Upon request of the parent of any student or, in the case of a student who is 18 years of age or older, any student securely dispose of all student personal information within 30 days of receiving the request;

11. Retain student personal information only for the minimum period necessary to fulfill the purposes of the memorandum of understanding, not to exceed three years after the student ceases participation, unless earlier deletion is requested;

12. In the event that the certified student support agency closes without any successor nonprofit organization, provide for the secure data transfer of any student personal information collected pursuant to this section to the school board of the school division in which each such student is or was enrolled, to be retained by the school board as a part of the student's scholastic record in accordance with § 22.1-289; and

13. Annually submit to the school board of the school division in which each student is or was enrolled a compliance report (i) detailing (a) basic security measures the certified student support agency took to ensure compliance with the provisions of this section for the immediately preceding school year and (b) any known security breaches or other relevant incidents and (ii) summarizing (a) program participation and student and parent outcomes for the immediately preceding school year and (b) any program goals for the forthcoming school year. Such report shall be made available to the Department upon request.

E. No certified student support agency that operates a student support program in accordance with this section shall knowingly:

1. Use or share or permit any affiliated platform or partner organization to use or share any student personal information for the purpose of targeted advertising or for any other purpose that is not essential to the provision of student support programs or otherwise authorized or permitted by this section;

2. Use or share any student personal information to create a personal profile of any student other than for student support programs without the consent of the parent of the student or, in the case of a student who is 18 years of age or older, the student;

3. Transfer or transmit any student personal information except as provided by this section; or

4. Retain any student personal information in violation of the provisions of subsection B.

F. Nothing in this section shall be construed to prohibit any certified student support agency from:

1. Using student personal information solely to provide noncommercial tutoring or instructional support services pursuant to a memorandum of understanding;

2. Using student personal information for maintaining, developing, supporting, improving, or evaluating the applicable certified student support program;

3. Using aggregate data collected in whole or in part from student personal information collected through providing any student support program for assessing student population needs and student support program performance;

4. Providing recommendations to any student through a student support program relating to employment, education, or purposes relating to learning or postsecondary achievement provided that any such recommendations are not in whole or in part determined by or based on consideration from a third party;

5. Disclosing student personal information (i) as necessary to comply with applicable state or federal law or regulation; (ii) to protect against liability; or (iii) to protect the security or integrity of the applicable student support program; or

6. Disclosing student personal information for the purpose of coordinating student support services with a governmental entity, provided that the certified student support agency, pursuant to a contract with the governmental entity, (i) prohibits such governmental entity from using any such student personal information for any purpose other than providing a student support service through or on behalf of the certified student support agency; (ii) prohibits such governmental entity from disclosing to any third party any student personal information provided by the certified student support agency, except to the extent such disclosure is permitted by subdivision D 8; and (iii) requires the governmental entity to comply with the provisions of this section, any policies and procedures developed in accordance with this section, or any other applicable federal or state law or regulation.

G. Each school board that enters into a memorandum of understanding with a certified student support agency to provide student support programs to students enrolled therein, pursuant to subdivision D 7, shall transmit any of the student personal information, as authorized by the memorandum of understanding, to the certified student support agency as soon as practicable after the school board receives from the parent of such student or, in the case of a student who is 18 years of age or older, the student's signed consent to the memorandum of understanding, pursuant to subdivision C 5 c and, upon receiving any request for additional student personal information thereafter, as soon as practicable after any such request was received, provided that the transmission of any such requested student personal information is permitted in accordance with the provisions of this section. However, in any case designated by the Department as an exceptional case, such requirement shall be waived and the transmission of such student personal information may be delayed. Upon designating any case as an exceptional case, the Department shall notify the requesting party of the delay and provide in such notification a timeline for the transmission of such student personal information The Department shall develop guidelines for determining whether a case should be designated as an exceptional case and for handling such exceptional cases.

H. Nothing in this section shall be construed to prohibit any school board from:

1. Establishing policies and procedures relating to the protection of student personal information that are more comprehensive than those required by the provisions of this section;

2. Requesting or receiving student personal information from any certified student support agency with which it has a memorandum of understanding, pursuant to subdivision D 7, for the purpose of coordinating any applicable student support programs; or

3. Establishing a regional collaboration network with one or more school board that governs a contiguous school division and one or more certified student support agency providing any student support programs pursuant to this section for the purpose of facilitating resource sharing, providing compliance assistance, and collaborating to improve the efficiency and reduce the cost of delivering any such student support programs.

I. In the case of any data breach or unauthorized disclosure of any student personal information transmitted or collected by a certified student support agency in accordance with this section, such certified student support agency shall take immediate corrective action and promptly provide notice to the parent of each student or, in the case of a student who is 18 years of age or older, each student who was affected by such breach or unauthorized disclosure and to the applicable school board. Such notice shall be made (i) in writing to the residence of each such student or to the school board which, upon receipt of such notice, shall provide the notice directly to the student or his parent; (ii) by telephone; (iii) through e-mail; or (iv) upon demonstration by the certified student support agency that providing notice pursuant to clauses (i), (ii), or (iii) would be unduly burdensome due to cost or inability to obtain the requisite contact information for each affected individual in a reasonable amount of time, substitute notice by posting such notice conspicuously on the website of the student support agency and providing it to any major local and state news media.

J. No school board or public elementary or secondary school shall be liable for any civil damages for any acts or omissions resulting from any certified student support agency's noncompliance with the provisions of this section.

2. That the Department of Education shall, by the beginning of the 2027–2028 school year, develop and fully implement the registry of student support agencies, required pursuant to subdivision C 2 of § 22.1-289.01:1 of the Code of Virginia, as created by this act, and shall develop and make available to each school board the model memorandum of understanding, required pursuant to subdivision C 5 of § 22.1-289.01:1 of the Code of Virginia, as created by this act.