,,ii #aaeth ,,congress #b;d ,session ,s4 #bfdj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #aj1 #bjah,mr4 ,daines 7for himself and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require operators that provide online and similar services to educational agencies1 institutions1 or programs to protect the privacy and security of personally identifiable information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,safeguarding ,american ,families from ,exposure by ,keeping ,information and ,data ,secure ,act or the ,,safe ,,kids ,act4 #b4 ,definitions 7a7 ,in general ,in this ,act3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,covered information ,the term covered information means personally identifiable information or material1 or information that is linked or reasonably linkable to personally identifiable information or material1 in any media or format1 that-- 7,a7 is created by or provided to an operator by a student1 or the student's parent1 in the course of the student's or parent's use of the operator's site or service for pre,k-#ab purposes2 7,b7 is collected1 generated1 or maintained by an educational agency1 institution1 or program1 including teachers of such agency1 institution1 or program2 or 7,c7 is collected by an operator through the operation of its site or service for pre,k-#ab purposes and personally identifies a student1 including-- 7i7 the student's first and last name2 7ii7 the first and last name of the student's parent or another family member2 7iii7 the home or physical address of the student or student's family2 7iv7 online contact information1 as defined in section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja71 for the student2 7v7 a personal identifier1 such as the student's ,social ,security number1 student number1 or biometric record2 7vi7 an identifier described in subparagraph 7,d71 7,f71 or 7,g7 of section #acjb7h7 of such ,act 7#ae ,u4,s4,c4 #feja7h77 for the student2 7vii7 a photograph1 video1 or audio recording that contains the student's image or voice2 7viii7 geolocation information sufficient to identify the street name and name of a city or town2 and 7ix7 other indirect identifiers1 such as the student's date of birth1 place of birth1 or mother's maiden name4 7#c7 ,de-identified covered information ,the term de-identified covered information means covered information that-- 7,a7 has been de-identified by reasonable measures2 7,b7 is maintained in a de-identified fashion without attempt to re-identify2 and 7,c7 is not made available to other entities absent contractual agreement to not re-identify the covered information4 7#d7 ,early childhood education program ,the term early childhood education program means a program that meets the requirements of clauses 7i7 and 7ii77,,iii7 of section #ajc7h77;,c7 of the ,higher ,education ,act of #aife 7#bj ,u4,s4,c4 #ajjc7h77;,c774 7#e7 ,educational agency1 institution1 or program ,the term educational agency1 institution1 or program means-- 7,a7 an educational agency or institution1 as defined in section #ddd7;a77#c7 of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7a77#c771 except that such term does not include an institution of higher education2 or 7,b7 an early childhood education program4 7#f7 ,eligible student ,the term eligible student means a student who-- 7,a7 is #ah years of age or older2 7,b7 is enrolled in an institution of higher education2 or 7,c7 has graduated from a secondary school4 7#g7 ,institution of higher education ,the term institution of higher education has the meaning given such term in section #ajb of the ,higher ,education ,act of #aife 7#bj ,u4,s4,c4 #ajjb74 7#h7 ,operator ,the term operator-- 7,a7 means the operator of a website located on the ,internet or online service that is used primarily for pre,k-#ab purposes and was designed and marketed for pre,k-#ab purposes1 to the extent that it is operating in this capacity2 and 7,b7 does not include an educational agency1 institution1 or program4 7#i7 pre,k-#ab purposes ,the term pre,k-#ab purposes means purposes that-- 7,a7 are directed by or that customarily take place at the direction of an educational agency1 institution1 or program2 7,b7 aid in the administration of activities by an educational agency1 institution1 or program1 including instruction in the classroom or at home1 administrative activities1 and collaboration between students1 school personnel1 or parents2 or 7,c7 are otherwise for the use and benefit of the educational agency1 institution1 or program4 7#aj7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 each territory or possession of the ,united ,states1 and each federally recognized ,indian tribe4 7#aa7 ,student ,the term student means any individual who attends or has attended an early childhood education program1 elementary school1 or secondary school4 7#ab7 ,targeted advertising 7,a7 ,in general ,the term targeted advertising means presenting advertisements to a student or the student's parent1 where the advertisements are selected based on information obtained or inferred over time from the student's online behavior1 use of online services1 or covered information4 7,b7 ,exclusion ,such term does not include presenting advertisements to a student or the student's parent at an online location or through an online service1 as long as-- 7i7 information about the student's online behavior or use of the online location or online service is not retained over time for the purpose of targeting subsequent advertisements2 and 7ii7 7,i7 the advertisements are based solely upon that student's current visit to the online location2 or 7,,ii7 the advertisements are in response to a student's request for information or feedback4 7b7 ,terms defined in ,elementary and ,secondary ,education ,act of #aife ,in this ,act1 the terms elementary school1 parent1 and secondary school have the meanings given such terms in section #haja of the ,elementary and ,secondary ,education ,act of #aife 7#bj ,u4,s4,c4 #ghja74 #c4 ,protecting student privacy 7a7 ,prohibited practices ,an operator may not-- 7#a7 collect1 generate1 use or disclose any covered information1 or allow third parties to do so1 for purposes of engaging in or permitting targeted advertising on the operator's site or online service1 or target advertising on any other site or service1 if the targeting of the advertising is based on any information1 including covered information and persistent unique identifiers1 that the operator has acquired because of the use of that operator's site or service for pre,k-#ab purposes2 7#b7 sell or rent covered information to a third party1 except this paragraph shall not apply to a nationally recognized high school academic assessment provider solely to the extent that the provider secures the express written consent of the parent or student1 given in response to clear and conspicuous notice1 only to provide access to employment1 educational scholarships or financial aid1 or postsecondary educational opportunities2 7#c7 use information1 including covered information and persistent unique identifiers1 created or gathered by the operator's site or service to create a personal profile of a student other than for pre,k-#ab purposes1 except that for purposes of this paragraph1 creating a personal profile shall not include the collection and retention of account information that remains under the control of the student1 the student's parent1 or the educational agency1 institution1 or program2 or 7#d7 disclose covered information1 unless the disclosure is made-- 7,a7 pursuant to lawful process or to ensure legal and regulatory compliance with ,federal or ,state law2 7,b7 7i7 in furtherance of the pre,k-#ab purpose of the site or service2 and 7ii7 if the recipient of the covered information disclosed under this paragraph does not further disclose the information unless the disclosure is done to allow or improve operability and functionality of the operator's site or service2 7,c7 for a school1 educational1 or employment purpose requested by the student or the student's parent1 as long as the information is not used or further disclosed for any other purpose2 7,d7 to protect the safety or integrity of users or others or the security of the school service2 or 7,e7 to a ,state or local educational agency1 including elementary schools and secondary schools1 for pre,k-#ab purposes1 as permitted by ,federal or ,state law2 or 7#e7 notwithstanding paragraph 7#d71 disclose covered information to a third-party service provider of the school service for purposes of maintaining1 developing1 supporting1 improving1 or diagnosing the operator's site or service unless the operator contractually requires the provider to comply with all the provisions of this ,act 7including such paragraph74 7b7 ,requirements ,an operator shall-- 7#a7 establish1 implement1 and maintain reasonable security procedures appropriate to the nature of the covered information that are designed to protect the covered information from unauthorized access1 destruction1 use1 modification1 or disclosure2 7#b7 unless the educational agency1 institution1 or program or a student's parent consents to the maintenance of the covered information1 delete a student's covered information-- 7,a7 within a reasonable time after receiving a request for deletion through an educational agency1 institution1 or program1 or from the student's parent2 or 7,b7 once the data has outlived the legitimate purpose for which the data was collected2 7#c7 obtain consent from the educational agency1 institution1 or program1 through contracts or privacy policies in a manner that is clear and easy to understand1 regarding the types of covered information collected1 the purposes for which the covered information is used or disclosed to third parties1 and the identity of any such third parties2 7#d7 disclose publicly1 on the website of the operator1 every privacy policy that the operator has established with an educational agency1 institution1 or program2 7#e7 obtain consent from the educational agency1 institution1 or program and provide sufficient notice on its website before making material changes to a contract or privacy policy for a school service2 and 7#f7 support access to and correction of covered information through an educational agency1 institution1 or program4 7c7 ,authorized uses 7#a7 ,uses of covered information ,an operator may use or disclose covered information of a student under the following circumstances3 7,a7 ,if other provisions of ,federal or ,state law require the operator to disclose the information1 and the operator complies with the requirements of ,federal and ,state law in protecting and disclosing that information4 7,b7 ,for legitimate research purposes1 as required by ,federal or ,state law and subject to the restrictions under applicable ,federal and ,state law or as allowed by ,federal or ,state law and under the direction of an educational agency1 institution1 or program 7including a ,state educational agency71 if covered information is not used for advertising or to amass a profile on the student for purposes other than pre,k-#ab purposes4 7,c7 ,to an educational agency1 institution1 or program for pre,k-#ab purposes1 as permitted by ,federal or ,state law4 7d7 ,effect on mergers and acquisitions ,the prohibitions of this section on sale and disclosure of covered information do not apply to the merger of an operator with another entity or the acquisition of the operator by another entity 7including any subsequent merger or acquisition71 provided that the operator or successor entity continues to be subject to the provisions of this section with respect to covered information acquired before the merger or acquisition4 7e7 ,continued application ,this section shall continue to apply1 after a student is no longer enrolled in an educational agency1 institution1 or program1 to covered information relating to the student that was collected or generated while the student was enrolled4 #d4 ,rules of construction 7a7 ,in general ,this ,act shall not-- 7#a7 be construed to affect or otherwise alter the protections and guarantees set forth in section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g7 7commonly known as the ,family ,educational ,rights and ,privacy ,act of #aigd71 the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq471 or any other ,federal statute relating to privacy protection2 7#b7 be construed to limit the authority of a law enforcement agency to obtain content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction2 7#c7 limit the ability of an operator to use information1 including covered information1 for adaptive or personalized student learning purposes2 7#d7 limit an educational agency1 institution1 or program from providing ,internet access service for its own use1 to other educational agencies or institutions1 or to students and their families2 7#e7 be construed to prohibit an operator's use of information1 including covered information1 for maintaining1 developing1 supporting1 improving1 or diagnosing the operator's school service2 7#f7 impose a duty upon a provider of an electronic store1 gateway1 marketplace1 or other means of purchasing or downloading software or applications1 to review or enforce compliance with this ,act by operators of school services2 7#g7 impede the ability of a student or the student's parent to download1 export1 transfer1 or otherwise save or maintain data or documents created by or about the student or noncommercial applications created by the student2 7#h7 be construed to apply to general audience ,internet websites or general audience online services1 even if login credentials created for an operator's site or service may be used to access those general audience sites or services2 7#i7 prohibit an operator of a website or online service from marketing educational products directly to parents if the marketing did not result from the use of covered information obtained by the operator through the provision of services covered under this ,act2 7#aj7 limit service providers from providing ,internet connectivity to schools or students and their families2 or 7#aa7 be construed to apply to the sale1 under the direction and control of the educational agency1 institution1 or program1 of student and class pictures1 yearbooks1 memory books1 and similar traditional school-sanctioned commemorative activities4 7b7 ,nonprohibited actions ,nothing in this ,act prohibits an operator from-- 7#a7 using de-identified covered information within the operator's school service or other sites or online services owned by the operator to improve educational products2 7#b7 using de-identified covered information to demonstrate the effectiveness of the operator's products or services1 including in the marketing of such products or services2 7#c7 disclosing de-identified covered information for the development and improvement of educational sites and services2 or 7#d7 disclosing de-identified covered information for research and development1 including-- 7,a7 research1 development1 and improvement of educational sites1 services1 and applications2 and 7,b7 advancements in the science of learning2 7#e7 using recommendation engines to recommend to a student additional content1 websites1 or online services for pre,k-#ab purposes offered by an operator within a website or online service if the recommendation is based on educational improvement and is not determined in whole or in part by financial gain from a third party2 and 7#f7 responding to a student's request for information or for feedback without the information or response being determined in whole or in part by payment or other consideration from a third party4 7c7 ,power ,to consent and rights regarding information about eligible student ,any provision of this ,act that refers to the consent of the student's parent for the use or disclosure of covered information or the right of the student's parent to access or otherwise obtain1 use1 correct1 request disclosure of1 or request deletion of covered information1 shall1 in the case of covered information about an eligible student1 be considered to refer to the consent or right of the student and not the student's parent4 7d7 ,no effect on consent under other law ,this ,act does not modify the requirements or standards for consent1 including consent from minors and employees on behalf of educational institutions1 under any other provision of ,federal law or under ,state law4 #e4 ,implementation and enforcement 7a7 ,enforcement by ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act shall be treated as a violation of a rule prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of the commission 7,a7 ,in general ,the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act shall be subject to the penalties entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act1 except as provided in paragraph 7#c74 7#c7 ,enforcement with respect to nonprofit organizations ,notwithstanding sections #d1 #e7;a77#b71 and #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd2 #de7;a77#b72 #df71 any jurisdictional limitation of the ,commission with respect to nonprofit organizations or common carriers subject to the ,communications ,act of #aicd1 or ,acts amending or supplementing that ,act1 shall not apply for purposes of this ,act4 7b7 ,preservation of commission authority ,nothing in this ,act may be construed in any way to limit or affect the ,commission's authority under any other provision of law4 7c7 ,consultation and cooperation with ,secretary of ,education ,the ,commission shall consult and cooperate with the ,secretary of ,education in enforcing this ,act in matters involving educational agencies1 institutions1 or programs4 7d7 ,relationship to ,state law 7#a7 ,in general ,this ,act does not annul1 alter1 or affect1 or exempt any person subject to the provisions of this ,act from complying with1 the laws of any ,state with respect to the treatment of covered information by operators of school services1 except to the extent that such laws are inconsistent with any provision of this ,act1 and then only to the extent of the inconsistency4 ,for purposes of this paragraph1 a law of a ,state is not inconsistent with this ,act if the protection such law affords any user of a school service is greater than the protection provided by this ,act4 7#b7 ,rule of construction ,any reference in this ,act to ,state law shall be considered also to refer to the law of a political subdivision of a ,state4 #f4 ,effective date ,this ,act shall take effect on the date that is #ah months after the date of the enactment of this ,act4