The 2016 legislative session’s biggest education policy bill — a measure intended to protect the privacy and security of student educational data — is on its way to the governor.
The bill passed the Senate 35-0 Tuesday and was re-passed 65-0 by the House Thursday after it accepted Senate amendments.
The votes continued the unbroken string of success for House Bill 16-1423, which has passed unanimously on every committee and floor roll call since it was introduced. That’s a pattern usually seen only with the most minor, technical bills. The measure’s original text also has survived almost entirely intact.
The main elements of the bill include a detailed definition of personally identifiable information that must be protected, restrictions on software companies and other vendors, and additional transparency and disclosure requirements for the Colorado Department of Education and school districts. The bill also sets some district controls over classroom apps and software used by teachers.
The bill’s easy path to approval stands in sharp contrast to what happened in 2015, when a data privacy bill died in that session’s closing days because the House and Senate couldn’t agree.
The success of this year’s bill can be attributed to its sponsors’ ability to craft a compromise and to a realization among lawmakers that they needed to pass something on data privacy and not make too big a fuss about it.
The interest groups involved in the issue — activist parents, school districts and the software industry — also seemed more amenable to compromise this year.
Rep. Paul Lundeen, a House sponsor, said the time was right this session after last years last year’s work laid the foundation.
“The districts realized they needed guidelines, and the industry realized they had a pubic relations problem on their hands,” he said.
The good feelings were reflected in senators’ comments before the final vote.
“This is a bill that deserves all of our votes, all of our support,” said Sen. Chris Holbert, R-Parker and sponsor of last year’s unsuccessful bill. He credited the 2016 bill’s authors, Lundeen of Monument and Rep. Alec Garnett of Denver.
Sen. Andy Kerr, D-Lakewood, said he believes the legislation will prove to be a national model.
Sen. Owen Hill, R-Colorado Springs, a sponsor, promised the bill will promote educational innovation.
“Parents, we have heard you, we listened and now you have some data security,” said Sen. Laura Woods, R-Thornton.
The anxieties of some parent groups, fueled by fears about new tests and growing collection of electronic data about students, have helped make data privacy an issue over the last couple of years.
The 2014 legislative session took a small step on the issue, passing a law that required the Department of Education to improve transparency about data collection and set rules for outside use of data held by the state. After failure of the 2015 data bill, the State Board of Education its own steps to increase regulation of software, testing and other companies with which the state has contracts.
It was against that background that Lundeen, a conservative Republican and Garnett, a liberal Democrat, began work late last year on HB 16-1423, holding countless meetings with interest groups and others. Their effort was actively backed by the state board and its chair, Republican Steve Durham.
The bill’s full impact won’t be felt immediately, given that school districts don’t have to finish their privacy plans until the end of 2017. Small rural districts don’t have to complete their plans until the middle of 2018.
Among the bill’s main sections, sponsors point to a provision in the definition of protected personal information that requires protection of seemingly unidentifiable information that, when cross-referenced with other, outside databases, could identify a student.
Other key elements of HB 16-1423:
- Bans on selling personal student information and advertising targeted to individual students.
- Penalties and due process rights for companies that violate the law.
Contractor responsibility for subcontractors’ actions. - Adoption of privacy policies by school boards.
- Posting of information about contracts and full contract texts on district websites.
- Districts also must post and explain the type of personally identifiable information collected.
- Specific requirements for data security and for permanent removal after contracts end.
- Guaranteed parent access to information about the data collected on their children.
The bill is focused on software specifically intended for the educational market. It doesn’t apply to tools and software also available to the general pubic, such as websites and search engines.
Lawmakers and interest groups acknowledge that the bill likely won’t be the last word on the issue, given the rapidly changing nature of educational technology. And software industry lobbyists weren’t completely satisfied with the bill, perhaps providing more impetus for future tinkering with privacy law.
“Technology will evolve. Our response to technology must evolve as well,” Lundeen said.