What's happening
This bill prohibits cloud computing service providers from using K-12 student data for commercial purposes and requires compliance certification.
Why it matters
Protects student privacy by explicitly banning cloud service providers from using K-12 student data for commercial gain. including targeted advertising, profiling, or selling data—which limits data exploitation and reduces risks of student information being misused beyond educational purposes.
Broadly defines “student data” to include identifiers, documents, communications, and derivatives. , ensuring that virtually all digital traces created by students or educators are covered, not just traditional records like grades or addresses. This comprehensive scope closes potential loopholes.
Forces cloud vendors to formally certify compliance in writing to schools. , creating a documented, enforceable commitment. This raises the bar for accountability and gives schools leverage to demand privacy protections, potentially shaping vendor practices industry-wide.
Empowers NYS education authorities to set further rules and oversee enforcement. , making it possible to adapt privacy protections as technology and threats evolve, ensuring ongoing vigilance over student data security.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Protect Student Data Privacy
Plain English, a few words. Used as the page title.
Sponsors
3 Co-sponsors
History
- Referred to education
- Referred to education
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
2883
2017-2018 Regular Sessions
IN ASSEMBLY
January 23, 2017
Introduced by M. of A. SIMOTAS, ROSENTHAL, OTIS, FRIEND -- read once and referred to the Committee on Education
AN ACT to amend the education law, in relation to enacting the "K12 student privacy and cloud computing act" to prohibit service providers who offer cloud computing services to primary and secondary educational institutions from processing student data for commercial purposes
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Short title. This act shall be known and may be cited as the "K12 student privacy and cloud computing act".
§ 2. Legislative findings. The legislature hereby finds and declares:
1. Cloud computing services enable convenient, on-demand network access to a shared pool of configurable computing resources (including networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction;
2. Cloud computing services offer tremendous potential to educational institutions in terms of helping consolidate technical infrastructure, reducing energy and capital costs, increasing collaboration through "anytime-anywhere" access to applications and information, and realizing efficiencies, network resilience, and flexible deployment; and
3. Cloud computing service providers hold the potential to invade the privacy of students by tracking students' online activities for commercial purposes, such as delivering behaviorally targeted advertising or otherwise improving advertising services that the service provider may offer in connection with or separate from the services it offers to the educational institution.
In light of the foregoing, the legislature deems it necessary to ensure that when an educational institution engages a cloud computing service provider to process student data, that the service provider uses student data only for the benefit of the educational institution and does not use such data for the service provider's own commercial purposes.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD04150-01-7
A. 2883 2
§ 3. The education law is amended by adding a new section 756 to read as follows:
§ 756. Student privacy and cloud computing. 1. Definitions. For the purposes of this section, the following terms shall have the following meanings:
(a) "Cloud computing service" shall mean a service that enables convenient, on-demand network access to a shared pool of configurable computing resources to provide a student, teacher or staff member account-based productivity applications such as email, document storage and document editing that can be rapidly provisioned and released with minimal management effort or cloud computing service provider interaction.
(b) "Cloud computing service provider" shall mean an entity, other than an educational institution, that operates a cloud computing service.
(c) "Educational institution" shall mean any public or nonpublic school, charter school, school district or board of cooperative educational services serving students in grades kindergarten through twelfth grade.
(d) "Person" shall mean individual, partnership, corporation, association, company or any other legal entity.
(e) "Process" or "processing" shall mean to use, access, manipulate, scan, modify, transform, disclose, store, transmit, transfer, retain, aggregate, or dispose of student data.
(f) "Student data" shall mean any information or materials in any media or format created or provided by: (i) a student in the course of the student's use of the cloud computing service; or (ii) an employee or agent of the educational institution that is related to a student. In each case the term "student data" shall include, but not be limited to the name, electronic mail address, postal address, phone number, email message, word processing documents, unique identifiers, metadata, of a student, or any aggregations or derivatives thereof.
2. Prohibition on the use of student data. Any person who, with knowledge that student data will be processed, provides a cloud computing service to an educational institution, is prohibited from using that cloud computing service to process student data for any secondary uses that benefit the cloud computing service provider or any third party, including, but not limited to, online behavioral advertising, creating or correcting an individual or household profile primarily for the cloud computing service provider's or any third party's benefit, the sale of the data for any commercial purpose, or any other similar commercial for-profit activity; provided, however, a cloud computing service may process or monitor student data solely to provide such service to the educational institution and maintain the integrity of such service.
3. Certification of compliance. Any person who enters into an agreement to provide a cloud computing service to an educational institution must certify in writing to the educational institution that it shall comply with the terms and conditions set forth in subdivision two of this section.
§ 4. This act shall take effect on the first of November next succeeding the date on which it shall have become a law, provided that the commissioner of education and the board of regents are authorized to promulgate such rules and regulations as may be necessary for the timely implementation of this act on or before such effective date.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.