Protecting the Personal Data of Pupils in Arkansas

The Arkansas Student Online Personal Information Protection Act, otherwise known as HB 1961, is a student data privacy law that was passed in 2015. The law was amended two years later in 2017 in order to establish a statewide longitudinal student data system, among other things. As such, the law sets forth the requirements that online operators have in terms of safeguarding the personal information and privacy of students that are enrolled in K-12 education institutions within the state of Arkansas. Moreover, the law also lays out the specific data elements that are legally protected from unauthorized use, access, and disclosure.

How is covered information defined under the law?

Under the provisions of HB 1961, covered information is defined as “personally identifiable, information or materials regarding a public school student in this state, in any media or format, when the information is: A) Created or provided by a student or the student’s parent or guardian, to an operator in the course of the student’s, parent’s, or guardian’s use of the operator’s website, service, or application; (B) Created or provided by an employee or agent of a public school, school district, local education agency, or Department of Education to the operator for public school purposes; or (C) Gathered by an operator through the operation of the website, service, or application and personally identifies a student.”

What are the requirements of online operators under the law?

The Arkansas Student Online Personal Information Protection Act mandates that online operators within the state take the following steps and measures to ensure the safety of the covered personal information of K-12 students within the state:

• Online operators are forbidden from using the covered personal information of students to engage in targeted advertising or marketing.
• Online operators are forbidden from using the covered personal information of students to compile an online profile for said students, except in the furtherance of public school purposes.
• Online operators and their third-party service providers are forbidden from using the covered personal information of students for any purpose of then providing the services they were contracted to provide.
• Online operators are forbidden from renting or selling the covered personal information of students.
• Online operators are responsible for creating, implementing, and maintaining security practices and measures that are commensurate to the nature of the covered personal information of their respective students.
• Online operators are only permitted to disclose the covered personal information of students for purposes that are unrelated to the furtherance of their educational pursuits under certain circumstances. These circumstances include instances where an online operator discloses a student’s personal data for legitimate research purposes, as well as instances where an online operator uses a student’s personal data to demonstrate the effectiveness of their website or online service, among others.

What data elements are covered under the law?

Under the Arkansas Student Online Personal Information Protection Act, HB 1961, the data elements that are protected from unauthorized access, use, and dissemination include but are not limited to:

• First and last names.
• Email addresses.
• Home addresses.
• Telephone numbers.
• Discipline records.
• Test results.
• Special education data.
• Juvenile dependency records.
• Grades.
• Social security numbers.
• Socioeconomic information.
• Biometric identifiers.

Data and Transparency Panel

In accordance with amendments that were made to Arkansas HB 1961 in 2017, a data and transparency panel was established to study the ways in which educational institutions and regulators within the state could provide a more comprehensive level of privacy protection for students. Aside from the formation of a statewide longitudinal student data system, this panel was charged with determining and recommending the procedures necessary to implement a statewide data warehouse, as well as evaluating and identifying the data elements that should be included in such a warehouse, in addition to other numerous data and personal privacy protection matters.

While invasions of privacy have always been an area of concern for certain individuals within society, the nature of online communication has made these concerns much more apparent and widespread in recent years. With being said, the personal data that students disclose to online operators and third-party service providers during the course of their respective educational journeys must also be protected against misuse, as these data elements can be used for nefarious purposes, just as the unauthorized use of the personal information of adults can result in a data breach. To this point, HB 1961 provides students within the state with the legal protection needed to reduce and mitigate the adverse situations that can result from failing to safeguard personal information.