To Chainnan Brenner, Vice Chair O'Brien, Ranking Member Ingram, and members of the Senate Education Committee, thank you for this opportunity to provide proponent testimony on Senate Bill 29.
The ACLU of Ohio believes SB 29 is crucial legislation to protect the fundamental privacy of public school student across Ohio. The use of technology and educational services by schools and students to send, receive, read, and store digital information is continually and rapidly growing. As a result, school districts frequently contract with third parties to provide electronic devices, equipment, and other services to students if the district itself does not.
What is missing is common sense, statewide regulation that allows use of this technology for legitimate educational and other purposes but balances that with robust protections for the personal and private information of our students. The ACLU of Ohio believes SB 29 threads that needle. With passage of this bill, Ohio would join a growing number of states passing such laws with bipartisan support.
Such protections have long been desired by privacy advocates who have repeatedly revealed the extent of information collected by these private third parties and schools. Such routine information capturing and storage is not limited to such personally identifiable information as a student's name, date of birth, or home address. It also includes such sensitive information as internet search history and search terms, contact lists, their physical locations, and behavioral information.
The ACLU of Ohio believes any legislation to adequately address such concerns must include at least the following:
1) Clear guidance on the types of data regulated for collection and storage, with allowances for aggregate data that do not personally identify individual students;
2) Acknowledgements that data captured and stored by providers and third parties belongs to the school or school district, not the provider or third party;
3) Prohibitions against using personally identifiable student information except for legitimate educational purposes, and with few, limited, and distinct exceptions;
4) Full transparency regarding what information is collected, which entities have access to that information, and under what circumstances. Ideally, such notice is proactively provided to parents, guardians, and students, without any request.
5) Mandated procedures for what occurs in the event of a data breach, including notice to impacted students and their parents and guardians and;
6) Requirements for deletion or turning over of data and records by third party providers when a contract or agreement expires or otherwise ends;
I am happy to report SB 29 addresses positively all of these concerns. With passage of this legislation, schools will still be pennitted to use all the various technology it currently does, and contract with other parties to do so, but with appropriate safeguards in place protecting the privacy and personal information of students.
The ACLU of Ohio does have two general suggestions we believe would make SB 29 even more critical with regard to the protection of student privacy. The first is to expand SB 29 to all K-12 schools, including private ones. The second is
protection against the unreasonable search and seizure of student-owned devices by school staff. As always, the ACLU of Ohio is ready and willing to collaborate on such improvements.
With every passing year, Ohio falls further behind with regard to statewide laws protecting student privacy. SB 29 not only adequately updates our laws, its passage will make Ohio a leader for the rest of the country. The ACLU of Ohio encourages this committee's support for Senate Bill 29.
