Bill > HB655

This bill amends the Public School Code of 1949 to establish comprehensive student data security requirements for educational institutions in Pennsylvania. The bill mandates that the Department of Education develop and regularly update a model data security plan in consultation with the Office of Information Technology, which will include guidelines for accessing student data, privacy compliance standards, security audits, data breach procedures, and data retention policies. The department will designate a chief data security officer to help school entities develop and implement their data security plans and will convene a working group including education and technology leaders to create initial instructions and best practices. The bill also provides detailed definitions of key terms like "personally identifiable information" and "school entity," which broadly covers school districts, charter schools, and technical schools. The definitions of personally identifiable information are expansive, including not just names and addresses but also indirect identifiers that could potentially identify a student. A critical requirement of the bill is that the working group must submit a report by December 1, 2026, detailing the costs of developing and implementing the model data security plan to various legislative committees. The act will take effect 60 days after its passage, signaling an immediate but measured approach to enhancing student data protection.

Business and Industry

https://www.legis.state.pa.us/cfdocs/billinfo/bill_history.cfm?syear=2025&sind=0&body=H&type=B&bn=655