Bill > HB3547

This bill, known as the Parent Data Sovereignty Act of 2026, establishes that parents are the primary owners of their children's personally identifiable educational data (PIED), which includes information that could identify a student or parent like names, demographic data, or test results. The act prohibits state education agencies and their contractors from selling, trading, or licensing student data for commercial purposes, and clarifies that these entities act only as custodians of the data. Parents are granted rights to access all data collected on their child, request corrections or deletions, and opt out of non-essential data collection or linkage for purposes beyond what is legally required for enrollment, funding, or accountability, including research, predictive analytics, artificial intelligence training, or workforce linkage. The bill also mandates that certain sensitive data, such as political or religious affiliation, family income (beyond free/reduced lunch eligibility), biometric or health data unrelated to special education, and student social media identifiers, cannot be collected without explicit parental written consent. Furthermore, new data elements proposed for collection by the State Department of Education will require legislative approval after public notice and hearings. Transferring student data to other state or federal agencies, or to private organizations, is prohibited without parental consent, unless otherwise authorized by law, and all such data-sharing arrangements must be publicly disclosed on a Data Transparency Portal. This portal will also list all collected data elements, identify mandatory versus optional ones, publish vendor contracts and data-sharing agreements, report data breaches, and post privacy and security audits. Contractors and vendors handling student data must agree to privacy protection measures, including encryption and secure storage, and will be subject to audits, with violations potentially leading to bans from future contracts. The bill also outlines penalties for violations, including civil fines and misdemeanor charges, and allows parents to pursue legal action for harm caused by violations. The State Department of Education is required to create a standardized Parent Data Opt-Out Form and will develop rules to implement the act, which becomes effective on November 1, 2026.

Budget and Finance

http://www.oklegislature.gov/BillInfo.aspx?Bill=hb3547&Session=2600