Bill > S364

This bill establishes comprehensive privacy standards for student and educator data in Massachusetts, creating new legal protections for personal information collected in educational settings. The legislation defines key terms like "covered information" (which includes a wide range of student data from names and addresses to test results and biometric information) and "operator" (entities providing online services to schools). The bill prohibits operators from engaging in targeted advertising, selling student information, or using data to create profiles about students, teachers, or administrators outside of educational purposes. Operators must implement reasonable security procedures, protect data from unauthorized access, and return or destroy information when no longer needed. The bill requires educational entities to develop detailed privacy and security policies, including reporting significant data breaches within 10 business days, and mandates that school districts publicly list the types of personally identifiable information they collect. Additionally, the legislation establishes a chief privacy officer position to oversee data protection, develop model policies, and provide training and guidance. The bill also allows for civil actions against operators who violate these provisions, with potential damages up to $10,000 per violation and the possibility of the commissioner barring operators from accessing student data for up to five years.

Budget and Finance, Education

https://malegislature.gov/Bills/194/S364