To strengthen the rights of parents and safeguard their child’s educational record. This rule ensures full transparency to enhance the student’s record and protect parental rights. Sections (9) and (11) are being removed ....

 

DEPARTMENT OF EDUCATION

State Board of Education

RULE NO.:RULE TITLE:

6A-1.0955Education Records

PURPOSE AND EFFECT: To strengthen the rights of parents and safeguard their child’s educational record. This rule ensures full transparency to enhance the student’s record and protect parental rights. Sections (9) and (11) are being removed from Rule 6A-1.0955 because the language is now in Rule 6A-1.09550.

SUMMARY: This amendment removes language from Sections (9) and (11) in Rule 6A-10955 because the requirements are now in Rule 6A-1.09550 - Student Online Personal Information Protection.

SUMMARY OF STATEMENT OF ESTIMATED REGULATORY COSTS AND LEGISLATIVE RATIFICATION:

The Agency has determined that this will not have an adverse impact on small business or likely increase directly or indirectly regulatory costs in excess of $200,000 in the aggregate within one year after the implementation of the rule. A SERC has not been prepared by the Agency.

The Agency has determined that the proposed rule is not expected to require legislative ratification based on the statement of estimated regulatory costs or if no SERC is required, the information expressly relied upon and described herein: The proposed rule is not expected to have any adverse impact on economic growth, business competitiveness or any other factors listed in s. 120.541(2)(a), F.S., and will not require legislative ratification. No increase in regulatory costs are anticipated as a result of this rule. The language being removed from the rule exists elsewhere.

Any person who wishes to provide information regarding a statement of estimated regulatory costs, or provide a proposal for a lower cost regulatory alternative must do so in writing within 21 days of this notice.

RULEMAKING AUTHORITY: 1001.02(1), (2)(n), 1002.22(3), 1003.25(2), 1008.405, F.S.

LAW IMPLEMENTED: 1001.42(8)(c), 1001.52(2), (3), 1002.22(2), (3), 1002.221, 1003.25, 1008.405, F.S.

A HEARING WILL BE HELD AT THE DATE, TIME AND PLACE SHOWN BELOW:

DATE AND TIME: October 18, 2023, 9:00 a.m.

PLACE: Caribe Royale Orlando, 8101 World Center Drive, Grand Sierra Ballroom D, Orlando, FL 32821.

THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULE IS: Dr. Andre Smith, Deputy Commissioner, Division of Technology and Innovation, [e-mail]

 

THE FULL TEXT OF THE PROPOSED RULE IS:

 

6A-1.0955 Education Records.

(1) through (8) No chagne.

(9) School board and charter school governing board policies for required use of online educational services by students and parents. In order to protect a student’s PII from potential misuse and in order to protect students from data mining or targeting for marketing or other commercial purposes, school boards and charter school governing boards must adopt policies that provide for review and approval of any online educational service that students or their parents are required to use as part of a school activity. These policies are required whether or not there is a written agreement governing student use, and whether or not the online educational service is free. These policies are required even if the use of the online educational service is unique to specific classes or courses.

(a) These policies must include the following:

1. Review of the online educational service’s terms of service and privacy policy to ensure compliance with state and federal privacy laws, including FERPA and its implementing regulations, the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. ss. 6501-6506, and Section 1002.22, F.S.;

2. Designation of a person or persons responsible for the review and approval of online educational services that will be required for students to use and the procedure for seeking such approval;

3. Procedures for notifying parents and eligible students if student PII will be collected by the online educational service;

4. Where student PII will be collected by the online educational service, procedures for notifying parents and eligible students of information that will be collected, how it will be used, when and how it will be destroyed, and the terms of re-disclosure, if any; and

5. An explicit prohibition against using any online educational service that will share or sell a student’s PII for commercial purposes without providing parents a means to either consent or disapprove. This disclosure prohibition does not prevent the purchase, merger, or other type of acquisition of a third party provider or online educational service by another entity, provided that the successor entity continues to be subject to the provisions of this rule with respect to previously acquired PII.

(b) For any online educational service that a student is required to use, a district must provide notice on its website of the PII information that may be collected, how it will be used, when it will be destroyed and the terms of re-disclosure. This notice must include a link to the online educational service’s terms of service and privacy policy, if publicly available.

(9) (10) Procedures for transfer of education records.

(a) through (c) No change.

(11) School district and charter school contracts or agreements with third-party vendors.

(a) All contracts or agreements executed by or on behalf of a school district or charter school with a third-party vendor or a third-party service provider must protect the privacy of education records and student PII contained therein. Any agreement that provides for the disclosure or use of student PII must:

1. Require compliance with FERPA, its implementing regulations, and Section 1002.22, F.S.;

2. Where applicable, require compliance with COPPA, 15 U.S.C. ss. 6501-6506, and its implementing regulations;

3. Ensure that only the PII necessary for the service being provided will be disclosed to the third party; and

4. Prohibit disclosure or re-disclosure of student PII unless one of the conditions set forth in paragraph (11)(b) has been met.

(b) Contracts or agreements with a third-party vendor or third-party service provider may permit the disclosure of PII to the third party only where one or more of the following conditions has been met:

1. The disclosure is authorized by FERPA and 34 CFR §99.31;

2. The disclosure is authorized by the school board or charter governing board’s directory information policy implemented in accordance with FERPA and 34 CFR §99.37; or

3. The disclosure is authorized by written consent of an eligible student or parent. Consent must include, at a minimum, an explanation of who the PII would be disclosed to, how it would be used, and whether re-disclosure is permitted. Any re-disclosure must meet the requirements of paragraph (11)(b) and must be authorized by the school board or charter school governing board.

(10) (12) Security of education records.

(a) through (c) No change.

Rulemaking Authority 1001.02(1)(2)(n), 1002.22(3), 1003.25(2), 1008.405 FS. Law Implemented 1001.42(8)(c), 1001.52(2), (3), 1002.22(2), (3),1002.221, 1003.25, 1008.405 FS. History–New 4-11-70, Repromulgated 12-5-74, Revised 6-1-75, Amended 10-7-75, 2-21-77, 3-1-78, 5-24-81, Formerly 6A-1.955, Amended 6-17-87, 1-2-95, 10-25-10, 5-5-20, 11-22-22, 8-22-23,

 

NAME OF PERSON ORIGINATING PROPOSED RULE: Dr. Andre Smith, Deputy Commissioner, Division of Technology and Innovation.

NAME OF AGENCY HEAD WHO APPROVED THE PROPOSED RULE: Manny Diaz Jr., Commissioner, Department of Education.

DATE PROPOSED RULE APPROVED BY AGENCY HEAD: September 22, 2023

DATE NOTICE OF PROPOSED RULE DEVELOPMENT PUBLISHED IN FAR: August 29, 2023