,,ii  #aacth ,,congress  #b;d ,session  
,s4 #bfij  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,july #cj1     
#bjad,mr4 ,markey 7for himself1 ,mr4    
,hatch1 ,mr4 ,walsh1 and ,mr4 ,kirk7    
introduced the following bill2 which was
 read twice and referred to the         
,committee on ,health1 ,education1      
,labor1 and ,pensions  ,a ,,bill  ,to   
amend the ,family ,educational ,rights  
and ,privacy ,act of #aigd to ensure    
that student data handled by private    
companies is protected1 and for other   
purposes4  #a4 ,short title ,this ,act  
may be cited as the ,protecting ,student
 ,privacy ,act of #bjad4  #b4 ,,ferpa   
improvements ,subsection 7b7 of section 
#ddd of the ,general ,education         
,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7
 7commonly referred to as the ,family   
,educational ,rights and ,privacy ,act  
of #aigd7 is amended-- 7#a7 by          
redesignating paragraphs 7#d7 through   
7#g7 as paragraphs 7#h7 through 7#aa71  
respectively2  7#b7 by inserting after  

paragraph 7#c7 the following3  7#d7 7,a7
 ,no funds shall be made available under
 any applicable program to any          
educational agency or institution that  
has not implemented information security
 policies and procedures that-- 7i7     
protect personally identifiable         
information from education records      
maintained by the educational agency or 
institution2 and  7ii7 require each     
outside party to whom personally        
identifiable information from education 
records is disclosed to have information
 security policies and procedures that  
include a comprehensive security program
 designed to protect the personally     
identifiable information from education 
records4  7,b7 ,for purposes of this    
subsection1 the term outside party means
 a person that is not an employee1      
officer1 or volunteer of the educational
 agency or institution or of a ,federal1
 ,state1 or local governmental agency   
and includes any contractor or          
consultant acting as a school official  

or authorized representative or in any  
other capacity4  7#e7 ,notwithstanding  
any other provision of this section or  
paragraph 7#b77;,a71 no funds shall be  
made available under any applicable     
program to any educational agency or    
institution that has a policy or        
practice of using1 knowingly releasing1 
or otherwise knowingly providing access 
to personally identifiable information1 
as described in paragraph 7#b71 in the  
education records of a student to       
advertise or market a product or        
service4  7#f7 ,each ,state educational 
agency receiving funds under an         
applicable program1 and each educational
 agency or institution1 shall ensure    
that any outside party with access to   
education records with personally       
identifiable information complies with  
the following3 7,a7 ,any education      
records that are held by the outside    
party shall be held in a manner that    
provides1 as directed by the educational
 agency or institution1 parents with--  

7i7 the right to access the personally  
identifiable information held about     
their students by the outside party1 to 
the same extent and in the same manner  
as provided in subsection 7a77#a72 and  
7ii7 a process to challenge1 correct1 or
 delete any inaccurate1 misleading1 or  
otherwise inappropriate data in any     
education records of such student that  
are held by the outside party1 through  
an opportunity for a hearing by the     
agency or institution providing the     
outside party with access1 in accordance
 with subsection 7a77#b74  7,b7 ,the    
outside party shall maintain a record of
 all individuals1 agencies1 or          
organizations that have requested or    
obtained access to the education records
 of a student held by the outside party1
 in the same manner as is required under
 paragraph 7#h74  7,c7 ,the outside     
party shall have policies or procedures 
in place regarding information security 
practices regarding the education       
records1 in accordance with paragraph   

7#d74  7#g7 ,no funds under any         
applicable program shall be made        
available to any educational agency or  
institution1 or any ,state educational  
agency1 unless the agency or institution
 has a policy or practice that-- 7,a7   
promotes data minimization in order to  
safeguard individual privacy by meeting 
any request for student information with
 non-personally identifiable            
information1 if the purpose of any      
appropriate request can be effectively  
met with non-personally identifiable    
information2 and  7,b7 requires that all
 personally identifiable information on 
an individual student held by any       
outside party be destroyed when the     
information is no longer needed for the 
specified purpose4  2 and  7#c7 in      
paragraph 7#h77;,a71 as redesignated by 
paragraph 7#a7-- 7,a7 by inserting who  
are employees1 officers1 or volunteers  
of the agency or institution after of   
this subsection2  7,b7 by striking or   
organizations and inserting             

organizations1 or outside parties2  7,c7
 by striking or organization and        
inserting organization1 or outside      
party2 and  7,d7 by inserting and will  
describe the information shared with    
such person1 outside party1 agency1 or  
organization after obtaining this       
information4