S T A T E O F N E W Y O R K
________________________________________________________________________
2883
2017-2018 Regular Sessions
I N A S S E M B L Y
January 23, 2017
___________
Introduced by M. of A. SIMOTAS, ROSENTHAL, OTIS, FRIEND -- read once and
referred to the Committee on Education
AN ACT to amend the education law, in relation to enacting the "K12
student privacy and cloud computing act" to prohibit service providers
who offer cloud computing services to primary and secondary educa-
tional institutions from processing student data for commercial
purposes
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Short title. This act shall be known and may be cited as
the "K12 student privacy and cloud computing act".
§ 2. Legislative findings. The legislature hereby finds and declares:
1. Cloud computing services enable convenient, on-demand network
access to a shared pool of configurable computing resources (including
networks, servers, storage, applications, and services) that can be
rapidly provisioned and released with minimal management effort or
service provider interaction;
2. Cloud computing services offer tremendous potential to educational
institutions in terms of helping consolidate technical infrastructure,
reducing energy and capital costs, increasing collaboration through
"anytime-anywhere" access to applications and information, and realizing
efficiencies, network resilience, and flexible deployment; and
3. Cloud computing service providers hold the potential to invade the
privacy of students by tracking students' online activities for commer-
cial purposes, such as delivering behaviorally targeted advertising or
otherwise improving advertising services that the service provider may
offer in connection with or separate from the services it offers to the
educational institution.
In light of the foregoing, the legislature deems it necessary to
ensure that when an educational institution engages a cloud computing
service provider to process student data, that the service provider uses
student data only for the benefit of the educational institution and
does not use such data for the service provider's own commercial
purposes.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD04150-01-7
A. 2883 2
§ 3. The education law is amended by adding a new section 756 to read
as follows:
§ 756. STUDENT PRIVACY AND CLOUD COMPUTING. 1. DEFINITIONS. FOR THE
PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING
MEANINGS:
(A) "CLOUD COMPUTING SERVICE" SHALL MEAN A SERVICE THAT ENABLES
CONVENIENT, ON-DEMAND NETWORK ACCESS TO A SHARED POOL OF CONFIGURABLE
COMPUTING RESOURCES TO PROVIDE A STUDENT, TEACHER OR STAFF MEMBER
ACCOUNT-BASED PRODUCTIVITY APPLICATIONS SUCH AS EMAIL, DOCUMENT STORAGE
AND DOCUMENT EDITING THAT CAN BE RAPIDLY PROVISIONED AND RELEASED WITH
MINIMAL MANAGEMENT EFFORT OR CLOUD COMPUTING SERVICE PROVIDER INTER-
ACTION.
(B) "CLOUD COMPUTING SERVICE PROVIDER" SHALL MEAN AN ENTITY, OTHER
THAN AN EDUCATIONAL INSTITUTION, THAT OPERATES A CLOUD COMPUTING
SERVICE.
(C) "EDUCATIONAL INSTITUTION" SHALL MEAN ANY PUBLIC OR NONPUBLIC
SCHOOL, CHARTER SCHOOL, SCHOOL DISTRICT OR BOARD OF COOPERATIVE EDUCA-
TIONAL SERVICES SERVING STUDENTS IN GRADES KINDERGARTEN THROUGH TWELFTH
GRADE.
(D) "PERSON" SHALL MEAN INDIVIDUAL, PARTNERSHIP, CORPORATION, ASSOCI-
ATION, COMPANY OR ANY OTHER LEGAL ENTITY.
(E) "PROCESS" OR "PROCESSING" SHALL MEAN TO USE, ACCESS, MANIPULATE,
SCAN, MODIFY, TRANSFORM, DISCLOSE, STORE, TRANSMIT, TRANSFER, RETAIN,
AGGREGATE, OR DISPOSE OF STUDENT DATA.
(F) "STUDENT DATA" SHALL MEAN ANY INFORMATION OR MATERIALS IN ANY
MEDIA OR FORMAT CREATED OR PROVIDED BY: (I) A STUDENT IN THE COURSE OF
THE STUDENT'S USE OF THE CLOUD COMPUTING SERVICE; OR (II) AN EMPLOYEE OR
AGENT OF THE EDUCATIONAL INSTITUTION THAT IS RELATED TO A STUDENT. IN
EACH CASE THE TERM "STUDENT DATA" SHALL INCLUDE, BUT NOT BE LIMITED TO
THE NAME, ELECTRONIC MAIL ADDRESS, POSTAL ADDRESS, PHONE NUMBER, EMAIL
MESSAGE, WORD PROCESSING DOCUMENTS, UNIQUE IDENTIFIERS, METADATA, OF A
STUDENT, OR ANY AGGREGATIONS OR DERIVATIVES THEREOF.
2. PROHIBITION ON THE USE OF STUDENT DATA. ANY PERSON WHO, WITH KNOW-
LEDGE THAT STUDENT DATA WILL BE PROCESSED, PROVIDES A CLOUD COMPUTING
SERVICE TO AN EDUCATIONAL INSTITUTION, IS PROHIBITED FROM USING THAT
CLOUD COMPUTING SERVICE TO PROCESS STUDENT DATA FOR ANY SECONDARY USES
THAT BENEFIT THE CLOUD COMPUTING SERVICE PROVIDER OR ANY THIRD PARTY,
INCLUDING, BUT NOT LIMITED TO, ONLINE BEHAVIORAL ADVERTISING, CREATING
OR CORRECTING AN INDIVIDUAL OR HOUSEHOLD PROFILE PRIMARILY FOR THE CLOUD
COMPUTING SERVICE PROVIDER'S OR ANY THIRD PARTY'S BENEFIT, THE SALE OF
THE DATA FOR ANY COMMERCIAL PURPOSE, OR ANY OTHER SIMILAR COMMERCIAL
FOR-PROFIT ACTIVITY; PROVIDED, HOWEVER, A CLOUD COMPUTING SERVICE MAY
PROCESS OR MONITOR STUDENT DATA SOLELY TO PROVIDE SUCH SERVICE TO THE
EDUCATIONAL INSTITUTION AND MAINTAIN THE INTEGRITY OF SUCH SERVICE.
3. CERTIFICATION OF COMPLIANCE. ANY PERSON WHO ENTERS INTO AN AGREE-
MENT TO PROVIDE A CLOUD COMPUTING SERVICE TO AN EDUCATIONAL INSTITUTION
MUST CERTIFY IN WRITING TO THE EDUCATIONAL INSTITUTION THAT IT SHALL
COMPLY WITH THE TERMS AND CONDITIONS SET FORTH IN SUBDIVISION TWO OF
THIS SECTION.
§ 4. This act shall take effect on the first of November next succeed-
ing the date on which it shall have become a law, provided that the
commissioner of education and the board of regents are authorized to
promulgate such rules and regulations as may be necessary for the timely
implementation of this act on or before such effective date.