(a) A local educational agency may, pursuant to a policy adopted by its governing board or, in the case of a charter school, its governing body, enter into a contract with a third party for either or both of the following purposes:

(1) To provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records.

(2) To provide digital educational software that authorizes a third-party provider of digital educational software to access, store, and use pupil records in accordance with the contractual provisions listed in subdivision (b).

(b) A local educational agency that enters into a contract with a third party for purposes of subdivision (a) shall ensure the contract contains all of the following:

(1) A statement that pupil records continue to be the property of and under the control of the local educational agency.

(2) Notwithstanding paragraph (1), a description of the means by which pupils may retain possession and control of their own pupil-generated content, if applicable, including options by which a pupil may transfer pupil-generated content to a personal account.

(3) A prohibition against the third party using any information in the pupil record for any purpose other than those required or specifically permitted by the contract.

(4) A description of the procedures by which a parent, legal guardian, or eligible pupil may review personally identifiable information in the pupil’s records and correct erroneous information.

(5) A description of the actions the third party will take, including the designation and training of responsible individuals, to ensure the security and confidentiality of pupil records. Compliance with this requirement shall not, in itself, absolve the third party of liability in the event of an unauthorized disclosure of pupil records.

(6) A description of the procedures for notifying the affected parent, legal guardian, or eligible pupil in the event of an unauthorized disclosure of the pupil’s records.

(7) (A) A certification that a pupil’s records shall not be retained or available to the third party upon completion of the terms of the contract and a description of how that certification will be enforced.

(B) The requirements provided in subparagraph (A) shall not apply to pupil-generated content if the pupil chooses to establish or maintain an account with the third party for the purpose of storing that content pursuant to paragraph (2).

(8) A description of how the local educational agency and the third party will jointly ensure compliance with the federal Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g).

(9) A prohibition against the third party using personally identifiable information in pupil records to engage in targeted advertising.

(c) In addition to any other penalties, a contract that fails to comply with the requirements of this section shall be rendered void if, upon notice and a reasonable opportunity to cure, the noncompliant party fails to come into compliance and cure any defect. Written notice of noncompliance may be provided by any party to the contract. All parties subject to a contract voided under this subdivision shall return all pupil records in their possession to the local educational agency.

(d) For purposes of this section, the following terms have the following meanings:

(1) “Deidentified information” means information that cannot be used to identify an individual pupil.

(2) “Eligible pupil” means a pupil who has reached 18 years of age.

(3) “Local educational agency” includes school districts, county offices of education, and charter schools.

(4) “Pupil-generated content” means materials created by a pupil, including, but not limited to, essays, research reports, portfolios, creative writing, music or other audio files, photographs, and account information that enables ongoing ownership of pupil content. “Pupil-generated content” does not include pupil responses to a standardized assessment where pupil possession and control would jeopardize the validity and reliability of that assessment.

(5) (A) “Pupil records” means both of the following:

(i) Any information directly related to a pupil that is maintained by the local educational agency.

(ii) Any information acquired directly from the pupil through the use of instructional software or applications assigned to the pupil by a teacher or other local educational agency employee.

(B) “Pupil records” does not mean any of the following:

(i) Deidentified information, including aggregated deidentified information, used by the third party to improve educational products, for adaptive learning purposes, and for customizing pupil learning.

(ii) Deidentified information, including aggregated deidentified information, used to demonstrate the effectiveness of the operator’s products in the marketing of those products.

(iii) Deidentified information, including aggregated deidentified information, used for the development and improvement of educational sites, services, or applications.

(6) “Third party” refers to a provider of digital educational software or services, including cloud-based services, for the digital storage, management, and retrieval of pupil records.

(e) If the provisions of this section are in conflict with the terms of a contract in effect before January 1, 2015, the provisions of this section shall not apply to the local educational agency or the third party subject to that agreement until the expiration, amendment, or renewal of the agreement.

(f) Nothing in this section shall be construed to impose liability on a third party for content provided by any other third party.

(Amended by Stats. 2015, Ch. 386, Sec. 20. (SB 436) Effective January 1, 2016.)