Student Data Protection in the State of Colorado

Colorado’s Student Online Personal Information Protection Act or SOPIPA, otherwise known as HB 1423, is a student data protection law that was enacted in 2016. As stated in the law, HB 1423 was passed to “maximize trust in the use of student data in the elementary and secondary education system.” To this point, the law establishes the standards that educators and school service providers must abide by when handling the personal information of their students. Furthermore, the law also lays out the specific categories of personal information pertaining to students that are legally protected from unauthorized access, use, modification, destruction, and dissemination.

How is a school service defined under the law?

Colorado’s HB 1423 defines a school service to mean “an internet website, online service, online application, or mobile application that: (I) is designed and marketed primarily for use in a preschool, elementary school, or secondary school; (II) Is used at the direction of teachers or other employees of a local education provider; (III) And collects, maintains, or uses personally identifiable information.” Conversely, the law defines a school service contract provider to mean “an entity, other than a public education entity or institution of higher education, that enters into a formal negotiated contract with a public education entity to provide a school service.”

What are the duties of educators under the law?

Some of the responsibilities that educators and school service providers have under Colorado’s HB 1423 include:

• Educators and school service providers are responsible for developing and implementing privacy compliance standards, security policies, and data collection and retention procedures.
• Educators and school service providers are responsible for outlining plans, notices, and procedures that can be used to aid both students and their parents or guardians should a data breach occur. Moreover, educators and school service providers are also required to provide the necessary training needed to effectively maintain these procedures and policies.
• Contracts that are brokered between educators, school service providers, and other relevant third parties must be created in a manner that is in accordance with the provisions of the law.
• Educators and school service providers are forbidden from using the personal data of their students for the purposes of engaging in targeted advertising.
• Educators and school service providers are responsible for creating and maintaining a policy that will regulate the disclosure of the personal data of their respective students. For instance, should an individual desire to use the personal data of a student for legitimate research purposes, the individual in question must enter into a contract or agreement with the appropriate parties to ensure that the use of this information does not violate the law.

What data elements are protected under the law?

The data elements concerning K-12 students that are legally protected from unauthorized use and disclosure under Colorado’s HB 1423 include but are not limited to:

• Dates of birth.
• First and last names.
• State-administered test results.
• Participation information.
• Courses taken and completed.
• Credits earned.
• Credential attainment.
• Transcript information.
• Grade level.
• Expected graduation date.
• Special education data.
• Gender, race, and ethnicity information.
• Attendance and mobility information.

The rights of parents under the law

As it concerns the rights that parents have under Colorado’s HB 1423, the law provides parents with a number of rights as it relates to safeguarding the personal data of their children. Most notably, parents have the right to both inspect and maintain any personal information that their children have provided to educators and school service providers during the course of furthering their education. Additionally, parents also have the right to request a copy of their child’s personal information, in either paper or electronic form, as well as the right to file a complaint in regards to any inconsistencies with the personal information that their children have provided to an educator or school service provider and the manner in which such information has been used.

Colorado’s HB 1423 stands as the foremost legal means by which citizens of Colorado can go about protecting the personal data and privacy of their school-aged children. While the provisions, rights, and punishments set forth in student privacy legislation will undoubtedly vary from state to state, the ability for parents within Colorado to access the personal information of their children provides them with the power necessary to secure this information. With all this being said, parents of children who attend K-12 educational institutions within the state of Colorado can have the peace of mind that they will have an avenue for recourse should the personal data or privacy of their children be compromised or infringed upon.