S.Amdt. 2101

SA 2101. Mr. ENZI submitted an amendment intended to be proposed to
amendment SA 2089 submitted by Mr. Alexander (for himself and Mrs.
Murray) to the bill S. 1177, to reauthorize the Elementary and
Secondary Education Act of 1965 to ensure that every child achieves;
which was ordered to lie on the table; as follows:

At the end of the bill, add the following:

SEC. 1020__. PROTECTION OF THE RIGHTS AND PRIVACY OF PARENTS
AND STUDENTS.

Section 444 of the General Education Provisions Act (20
U.S.C. 1232g) is amended--
(1) in subsection (a)(4)(A)(ii), by striking ``by an
educational agency or institution, or

[[Page S4795]]

by a person acting for such agency or institution'' and
inserting ``in any format by an educational agency or
institution, by a person or third party collecting or
maintaining such information through the active intervention,
facilitation, or authorization of such agency or institution,
or by a person or third party acting for such agency or
institution''; and
(2) in subsection (b)--
(A) in paragraph (1)--
(i) by striking subparagraph (A) and inserting the
following:
``(A)(i) employees and other school officials, including
teachers within the educational institution or local
educational agency, who have been determined by such agency
or institution to have legitimate educational interests,
including the educational interests of the child for whom
consent would otherwise be required; or
``(ii) a contractor, or an organization conducting a study
under subparagraph (F), if such contractor or organization--
``(I) performs an institutional service of function for
which the educational agency or institution would otherwise
use employees;
``(II) is under the direct control of the educational
agency or institution with respect to the use and maintenance
of education records;
``(III) limits internal access to education records to
those individuals who are determined to have legitimate
educational interests;
``(IV) does not use education records for any other
purposes than those explicitly authorized in the contract or
agreement;
``(V) does not disclose any personally identifiable
information to any other party--

``(aa) without the prior written consent of the parent of
the student; or
``(bb) unless required by law or court order, in which case
the party shall provide a notice of the required disclosure
to the educational agency or institution that provided the
information by not later than the date the disclosure is
required except when providing notice of the disclosure is
expressly prohibited by the law or court order;

``(VI) maintains reasonable administrative, technical, and
physical safeguards to protect the security, confidentiality,
and integrity of student personally identifiable information
in its custody;
``(VII) uses encryption technologies to protect data while
in motion or in its custody from unauthorized disclosure
using a technology or methodology specified by the Secretary
of Health and Human Services in the guidance issued on April
27, 2009 (74 Fed. Reg. 19006) under section 13402(h)(2) of
the American Recovery and Reinvestment Act of 2009 (42 U.S.C.
17932(h)(2));
``(VIII) has sufficient administrative and technical
procedures to monitor continuously the security of personally
identifiable information in the custody of the contractor or
organization;
``(IX) conducts a security audit annually and provides the
results of that audit to the educational agency or
institution from which the contractor, consultant, or other
party received education records;
``(X) provides the educational agency or institution with a
breach remediation plan acceptable to the educational agency
or institution prior to initial receipt of education records;
``(XI) reports all suspected security breaches to the
educational agency or institution that provided education
records as soon as possible, but not later than 48 hours,
after a suspected breach was known or would have been known
by exercising reasonable diligence;
``(XII) reports all actual security breaches to the
educational agency or institution that provided education
records as soon as possible, but no later than 24 hours after
an actual breach was known or would have been known by
exercising reasonable diligence;
``(XIII) in the event of a security breach or unauthorized
disclosure of personally identifiable information, pays all
costs and liabilities incurred by the educational agency or
institution providing the education record related to the
security breach or unauthorized disclosure, including the
costs of--

``(aa) responding to inquiries about the security breach or
unauthorized disclosure;
``(bb) notifying individuals, including parents of
students, whose personally identifiable information was held
by the contractor, consultant, or other party about the
breach or unauthorized disclosure;
``(cc) mitigating the effects of the breach or unauthorized
disclosure for such individuals; and
``(dd) investigating the cause or consequences of the
security breach or unauthorized disclosure; and

``(XIV) destroys or returns to the educational agency or
institution all personally identifiable information in its
custody upon request and at the termination of the contract
or agreement;'';
(ii) in subparagraph (C)(i), by inserting ``under the
direct control'' after ``authorized representatives''; and
(iii) by striking subparagraph (F) and inserting the
following:
``(F) organizations conducting studies for, or on behalf
of, educational agencies or institutions for the purpose of
developing, validating, or administering predictive tests,
administering student aid programs, and improving
instruction, if such studies are--
``(i) explicitly approved by the educational agencies or
institutions through a written agreement;
``(ii) conducted in such a manner as will not permit the
personal identification of students and their parents by
persons other than representatives of such organizations and
such information will be destroyed when no longer needed for
the purpose for which it is conducted; and
``(iii) consistent with subparagraph (A)(ii);'';
(B) in paragraph (3), by inserting ``administered by State
or local educational agencies or by an institution'' after
``Federally-supported education program''; and
(C) in paragraph (5), by inserting ``administered by a
State or local educational agency or by an institution''
after ``State supported education program''.
______