A much-anticipated bill intended to strengthen privacy protections for data gathered on K-12 students won 11-0 approval Monday from the House Education Committee.
Witnesses from across the education spectrum had good things to say about the bill – with a few qualifications. And at just under two hours the hearing was short for such a major bill.
The sponsors, Republican Rep. Paul Lundeen of Monument and Democratic Rep. Alec Garnett of Monument, said they’re confident House Bill 16-1423 will pass the Democratic-controlled House in pretty much its current form and has a good chance in the Republican-controlled Senate. A similar privacy bill died in 2015 after the House and Senate couldn’t agree on amendments.
But the path to passage this year may not be smooth.
The last witness to speak politely raised some key concerns with the bill, and he represents an important and powerful voice in the debate – the software industry.
As drafted, the bill could have “unintended consequences,” said Brendan Desetti, director of education policy for the Software and Information Industry Association.
“We look forward to working with the authors moving forward,” he said.
During his testimony and in an interview, Desetti identified some key concerns.
He said the association feels the measure’s detailed definition of personally identifiable information is too broad and that software companies want as much standardization of state laws as possible.
“We look for commonality whenever we can,” he said.
Because companies tailor products for national and international markets, they may find it unattractive to sell in states with substantially different requirements, he said.
In a recent letter to Lundeen and Garnett, Desetti wrote that the bill could “institute barriers to the appropriate use of technology and data by Colorado educators, students, institutions and families. Harmonization with similar state laws … around the nation is key.”
He also said the association is concerned that the bill’s provisions for penalizing companies that violate the law, including public posting of such allegations. Doing that “before a hearing or an opportunity for a hearing can occur will effectively create a state-sanctioned blacklist based on opinion – not fact,” Desetti wrote to the sponsors.
Lundeen and Garnett met briefly with Desetti after the committee hearing adjourned. Garnett said later that he and Lundeen are comfortable with their definition of personally identifiable information but are happy to continue the conversation with industry offficials.
In addition to the provisions on personal information and company penalties, key elements of HB 16-1423 include:
- A ban of selling personal student information and on targeted advertising to students.
- Making contractors responsible for the actions of subcontractors.
- Adoption of privacy policies by school boards.
- Posting of information about contracts on district websites.
- Specific requirements for data security and for destruction after contracts end.
The bill’s provisions also would cover apps that teachers use in the classroom on their own, an area that some districts don’t oversee now.
While the witnesses who testified Monday were generally supportive of the bill, several cautioned that it’s not the last word on protecting student privacy.
“I do think this is a starting point and definitely isn’t going to be the last bill,” said Cheri Kiesecker, a Fort Collins parent who has advocated for the strictest possible privacy protections.