HB 655 — An Act amending the act of March 10, 1949 (P.L.30, No.14), known as the Public School Code of 1949, in preliminary provisions, providing for student data security.

PRINTER'S NO.    664

                     THE GENERAL ASSEMBLY OF PENNSYLVANIA



                         HOUSE BILL
                         No. 655
                                               Session of
                                                 2025

     INTRODUCED BY RYNCAVAGE AND KUZMA, FEBRUARY 20, 2025

     REFERRED TO COMMITTEE ON COMMUNICATIONS AND TECHNOLOGY,
        FEBRUARY 20, 2025


                                    AN ACT
 1   Amending the act of March 10, 1949 (P.L.30, No.14), entitled "An
 2      act relating to the public school system, including certain
 3      provisions applicable as well to private and parochial
 4      schools; amending, revising, consolidating and changing the
 5      laws relating thereto," in preliminary provisions, providing
 6      for student data security.
 7      The General Assembly of the Commonwealth of Pennsylvania
 8   hereby enacts as follows:
 9      Section 1.    The act of March 10, 1949 (P.L.30, No.14), known
10   as the Public School Code of 1949, is amended by adding a
11   section to read:
12      Section 135.    Student Data Security.--(a)   The department
13   shall develop, in consultation with the Office of Information
14   Technology, and update regularly, but no less than annually, a
15   model data security plan for the protection of student data held
16   by a school entity.
17      (b)    The model student data security plan shall include:
18      (1)    Guidelines for access to student data and student data
19   systems, including guidelines for authentication of authorized
20   access.
 1      (2)   Privacy compliance standards.
 2      (3)   Privacy and security audits.
 3      (4)   Procedures to follow in the event of a breach of student
 4   data.
 5      (5)   Data retention and disposition policies.
 6      (c)   The model plan and any updates shall be made available
 7   to all school entities.
 8      (d)   The department shall designate a chief data security
 9   officer, with any State money as made available, to assist a
10   school entity, upon request, with the development and
11   implementation of a student data security plan and to develop
12   best practice recommendations regarding the use, retention and
13   protection of student data.
14      (e)   The department shall convene a working group to assist
15   with the development of initial instructions, procedures,
16   services, security assessments, best practices and security
17   measures required by this section for the development of a model
18   student data security plan. The working group shall include the
19   Secretary of Education, the chief information officer,
20   representatives from school entities across this Commonwealth
21   and other parties deemed necessary by the department.
22      (f)   The working group shall compile a report on or before
23   December 1, 2026, on the cost of developing and implementing a
24   model student data security plan. The working group shall submit
25   the report to the chair and minority chair of the Appropriations
26   Committee of the Senate, the chair and minority chair of the
27   Appropriations Committee of the House of Representatives, the
28   chair and minority chair of the Education Committee of the
29   Senate and the chair and minority chair of the Education
30   Committee of the House of Representatives.

20250HB0655PN0664                  - 2 -
 1      (g)     As used in this section, the following words and phrases
 2   shall have the meanings given to them in this subsection unless
 3   the context clearly indicates otherwise:
 4      "Department."     The Department of Education of the
 5   Commonwealth.
 6      "Personally identifiable information."     The term includes,
 7   but is not limited to:
 8      (1)     The student's name.
 9      (2)     The name of the student's parent or other family
10   members.
11      (3)     The address of the student or student's family.
12      (4)     A personal identifier, such as the student's Social
13   Security number, student number or biometric record.
14      (5)     Other indirect identifiers, such as the student's date
15   of birth, place of birth and mother's maiden name.
16      (6)     Other information that, alone or in combination, is
17   linked or linkable to a specific student that would allow a
18   reasonable person in the school community, who does not have
19   personal knowledge of the relevant circumstances, to identify
20   the student with reasonable certainty.
21      (7)     Information requested by a person who the educational
22   agency or institution reasonably believes knows the identity of
23   the student to whom the education record relates.
24      "School entity."     A school district, intermediate unit, area
25   career and technical school, charter school, cyber charter
26   school or regional charter school.
27      "Student data."     Personally identifiable information from
28   student records of a school entity.
29      Section 2.     This act shall take effect in 60 days.



20250HB0655PN0664                     - 3 -