The Act requires that in the event of a data security breach information holders are to contact anyone whose data may have been accessed by an unauthorized person. Additionally, this Act requires that cloud computing service providers will not process student data without parental permission.

Suggested State Legislation: This draft Act prohibits school districts and charter schools from collecting a pupil’s biometric information without written permission from the pupil’s parent. The Act requires each school to provide written notice to the parents or guardians of pupils stating their intent to collect biometric information 30 days prior to the collection. It stipulates that the written notice must contain a statement informing the parent or guardian that they must give written permission before the school can collect biometric information from the pupil.