Section 380.1136 - Protection of pupil privacy(1) Subject to subsection (7), to protect pupil privacy, the superintendent of public instruction shall ensure that the department complies with all of the following and the state budget director shall ensure that CEPI complies with all of the following: (a) The department or CEPI shall not sell any information that is part of a pupil's education records.(b) By April 21, 2017, the department and CEPI each shall post on its website a notice of the information it collects for a pupil's education records. The notice must include at least an inventory of all pupil data elements collected by the department or CEPI and a description of each pupil data element.(c) At least 30 days before initiating the collection of any pupil data elements in addition to those already disclosed in the inventory under subdivision (b), the department or CEPI shall post on its website a notice of the additional pupil data elements it is proposing to collect and an explanation of the reasons for the proposal.(d) The department or CEPI shall not disclose any information concerning a pupil that is collected or created by the department or CEPI except in accordance with a policy adopted and made publicly available by the superintendent of public instruction or state budget director, as applicable, that clearly states the criteria for the disclosure of the information.(e) The department or CEPI shall ensure that any contract it has with a vendor that allows the vendor access to education records contains express provisions requiring the vendor to protect the privacy of education records and provides express penalties for noncompliance.(f) If the department or CEPI provides any personally identifiable information concerning a pupil that is collected or created by the department or CEPI as part of the pupil's education records to any person other than the school district, intermediate school district, public school academy, authorizing body, preschool, or postsecondary institution in which the pupil is currently or was formerly enrolled, or the pupil's parent or legal guardian, then the department or CEPI shall, if the pupil is under 18 years of age or claimed as a dependent on a parent's or legal guardian's federal income tax return, disclose to the pupil's parent or legal guardian upon his or her written request all of the following: (i) The specific data fields that were disclosed.(ii) The name and contact information of each person, agency, or organization to which the information has been disclosed.(iii) The reason for the disclosure.(g) The department or CEPI shall disclose the information under subdivision (f) within 30 days after receiving the written request and without charge to the parent or legal guardian. If the department or CEPI considers it necessary to make redacted copies of all or part of a pupil's education records in order to protect personally identifiable information of another pupil, the department or CEPI shall not charge the parent or legal guardian for the cost of making those copies.(2) Subject to subsection (7), to protect pupil privacy, the board of a school district or intermediate school district or board of directors of a public school academy shall ensure that the school district, intermediate school district, or public school academy complies with all of the following, and the governing board of an authorizing body shall ensure that the authorizing body complies with all of the following:(a) A school district, an intermediate school district, a public school academy, an educational management organization, or an authorizing body shall not sell or otherwise provide to a for-profit business entity any personally identifiable information that is part of a pupil's education records. This subdivision does not apply to any of the following situations:(i) For a pupil enrolled in a public school academy, if the public school academy has a management agreement with an educational management organization, the public school academy providing the information to that educational management organization.(ii) Providing the information as necessary for standardized testing that measures the pupil's academic progress and achievement.(iii) Providing the information as necessary to a person that is providing educational or educational support services to the pupil under a contract with the school district, intermediate school district, public school academy, or educational management organization.(b) Upon written request by a pupil's parent or legal guardian, a school district, an intermediate school district, a public school academy, or an authorizing body shall disclose to the parent or legal guardian any personally identifiable information concerning the pupil that is collected or created by the school district, intermediate school district, public school academy, or authorizing body as part of the pupil's education records.(c) Subject to the exemptions under subsection (3), if a school district, intermediate school district, public school academy, or authorizing body provides any information described in subdivision (b) to any person, agency, or organization, then the school district, intermediate school district, public school academy, or authorizing body shall disclose to the pupil's parent or legal guardian upon his or her written request all of the following:(i) The specific information that was disclosed.(ii) The name and contact information of each person, agency, or organization to which the information has been disclosed.(iii) The legitimate reason that the person, agency, or organization had in obtaining the information.(d) A school district, an intermediate school district, a public school academy, or an authorizing body shall disclose the information under subdivisions (b) and (c) within 30 days after receiving the written request and without charge to the parent or legal guardian. If the school district, intermediate school district, public school academy, or authorizing body considers it necessary to make redacted copies of all or part of a pupil's education records in order to protect personally identifiable information of another pupil, the school district, intermediate school district, public school academy, or authorizing body shall not charge the parent or legal guardian for the cost of those copies.(3) Subject to subsection (7), subsection (2)(c) does not apply to any of the following situations:(a) A school district, intermediate school district, public school academy, or authorizing body providing the information to the department or CEPI.(b) A school district, intermediate school district, public school academy, or authorizing body providing the information to the pupil's parent or legal guardian.(c) A public school academy providing the information to its authorizing body or to an educational management organization with which it has a management agreement.(d) A school district or public school academy providing the information to its intermediate school district or to another intermediate school district providing services to the school district or public school academy or its pupils pursuant to a written agreement.(e) An intermediate school district providing the information to a school district or public school academy in which the pupil is enrolled or to a school district or public school academy for which the intermediate school district is providing services pursuant to a written agreement.(f) An authorizing body providing the information to a public school academy in which the pupil is enrolled.(g) Providing the information to a person, agency, or organization with written consent from the pupil's parent or legal guardian or, if the pupil is at least age 18, the pupil.(h) Providing the information to a person, agency, or organization seeking or receiving records in accordance with an order, subpoena, or ex parte order issued by a court of competent jurisdiction.(i) Providing the information as necessary for standardized testing that measures the pupil's academic progress and achievement.(j) A school district, intermediate school district, public school academy, or authorizing body providing information that is covered by the opt-out form described in subsection (6), unless the pupil's parent or legal guardian or, if the pupil is at least age 18 or is an emancipated minor, the pupil has signed and submitted the opt-out form under subsection (6)(d).(4) Subject to subsection (7), if an educational management organization receives information that is part of a pupil's education records from any source as permitted under this section, the educational management organization shall not sell or otherwise provide the information to any other person except as provided under this section.(5) In addition to ensuring compliance with subsection (1), the superintendent of public instruction shall ensure that the department, and the state budget director shall ensure that CEPI, complies with all other applicable privacy law.(6) Subject to subsection (7), for the purposes of this section, each school district, intermediate school district, public school academy, or authorizing body shall do all of the following:(a) Develop a list of uses for which the school district, intermediate school district, public school academy, or authorizing body commonly would disclose a pupil's directory information. (b) Develop an opt-out form that lists all of the uses or instances under subdivision (a) and allows a parent or legal guardian to elect not to have his or her child's directory information disclosed for 1 or more of these uses.(c) Present the opt-out form under subdivision (b) to each pupil's parent or legal guardian within the first 30 days of the school year. A school district, intermediate school district, public school academy, or authorizing body also shall make the form available to a parent or legal guardian at other times upon request.(d) If an opt-out form under subdivision (b) is signed and submitted to the school district, intermediate school district, public school academy, or authorizing body by a pupil's parent or legal guardian, the school district, intermediate school district, public school academy, or authorizing body shall not include the pupil's directory information in any of the uses that have been opted out of in the opt-out form.(7) The department, CEPI, a school district, an intermediate school district, a public school academy, an educational management organization, or an authorizing body shall not disclose the confidential address of a pupil if the pupil or the pupil's parent or legal guardian has obtained a participation card issued by the department of the attorney general under the address confidentiality program act and the parent or legal guardian provides notice of the issuance of the participation card, in a form and manner prescribed by the department.(8) If a pupil is at least age 18 or is an emancipated minor, the pupil may act on his or her own behalf under subsection (6).(9) As used in this section:(a) "Authorizing body" means that term as defined in part 6a, 6c, or 6e or section 1311b, as applicable.(b) "CEPI" means the center for educational performance and information created under section 94a of the state school aid act of 1979, MCL 388.1694a.(c) "Confidential address" means that term as defined in the address confidentiality program act.(d) "Directory information" means that term as defined in 34 CFR 99.3.(e) "Education records" means that term as defined in 34 CFR 99.3.(f) "Educational management organization" means that term as defined in section 503c, 523c, or 553c, as applicable.(g) "Management agreement" means that term as defined in section 503c, 523c, or 553c, as applicable.(h) "Personally identifiable information" means that term as defined in 34 CFR 99.3.Amended by 2020, Act 303,s 1, eff. 6/27/2021.Added by 2016, Act 367,s 1, eff. 3/22/2017.