Contracts with third parties regarding educational technology

(a) FERPA requirements for third-party contracts Section 444 of the General Education Provisions Act (20 U.S.C. 1232g; commonly referred to as the ‘Family Educational Rights and Privacy Act of 1974’) as amended by sections 4, 5, and 6, is further amended by adding at the end the following: (m) Contracts with third parties regarding educational technology (1) Covered contracts In this subsection, the term covered contract means the privacy policy of any contract or agreement— (A) between an educational agency or institution and a third party; and (B) that pertains to educational technology (as defined in section 2 of the Learning Innovation and Family Empowerment with AI Act) that involves education records, or personally identifiable information contained therein, including directory information. (2) Requirements for contracts No funds shall be made available under any applicable program to any educational agency or institution unless such agency or institution— (A) makes publicly available, for a period of not less than 2 weeks prior to execution, each covered contract that the agency or institution is considering executing; (B) as part of each covered contract, requires the third party to certify that the third party will ensure student data privacy and comply with all applicable privacy laws regarding student data, including the consent requirements that apply to education records; and (C) as part of each covered contract, requires the third party to agree that the third party— (i) may be reported to the Secretary if an educational agency or institution, or a student, alleges that the third party is not in compliance with the requirements described in subparagraph (B); (ii) may be investigated by the Secretary to ascertain the veracity of such claim by an educational agency or institution or student; and (iii) if the Secretary determines, after such an investigation, that such third party is not in compliance with the requirements described in subparagraph (B), will be included on a publicly available list created by the Secretary of third parties that are not in compliance with such requirements for a period of 5 years after the determination by the Secretary, as described in section 7(c) of the Learning Innovation and Family Empowerment with AI Act. (3) Rule of construction Nothing in this subsection shall be construed to require that trade secrets or proprietary information of third parties be made public.. (b) Model privacy policies (1) In General The Secretary shall create a model student data privacy agreement for use by an educational agency or institution as part of a covered contract (as defined in section 444(m) of the General Education Provisions Act (20 U.S.C. 1232g(m)); commonly referred to as the ‘Family Educational Rights and Privacy Act of 1974’), as added by subsection (a). The model shall promote clarity and consistency in student data privacy protections as part of covered contracts. (2) Development of model form The Secretary and the Privacy Technical Assistance Center described in section 8 shall partner with educational agencies and institutions, education technology companies, parents, and relevant third parties to develop such a model agreement and may consider the Student Data Privacy Consortium’s National Data Privacy Agreement in developing such model. (c) Public online resource for privacy violations (1) Creation of Public Online Resource Not later than 2 years after the date of enactment of this Act, the Secretary shall develop and maintain a publicly accessible, machine-readable online resource listing third parties that— (A) have executed a covered contract (as defined in subsection (m) of section 444 of the General Education Provisions Act (20 U.S.C. 1232g(m)); commonly referred to as the ‘Family Educational Rights and Privacy Act of 1974’), as added by subsection (a); and (B) the Secretary has determined, in accordance with paragraph (2)(C) of such subsection, are in violation of the requirements described in paragraph (2)(B) of such subsection, regarding student data privacy in covered contracts. (2) Appeal (A) In General The Secretary shall establish a process whereby third parties that are included in the list described in paragraph (1) may appeal such listing. (B) Deadline for determination The Secretary shall issue a determination about an appeal not later than 6 months after an appeal has been submitted to the Secretary. (C) Limitation on additional appeals After a determination of an appeal under subparagraph (B), a third party shall not have another opportunity to appeal a determination under this subsection, unless there was a change in a Presidential administration between the date on which the third party submitted the initial request to appeal under this paragraph and the date on which such appeal determination under subparagraph (B) was made. (3) Period of time (A) In General Subject to paragraph (2), a third party shall remain on the list described in paragraph (1) for a period of 5 years after the date on which the third party was placed on that list, unless the violation is remediated in accordance with subparagraph (B). (B) Remediation A third party shall be removed from the list described in paragraph (1) when the Secretary determines that the third party is no longer in violation of the requirements of subsection (m) of section 444 of the General Education Provisions Act (20 U.S.C. 1232g(m), commonly referred to as the Family Educational Rights and Privacy Act of 1974), as added by section 7. The third party shall be removed from the list not later than 1 week after the date of such a determination. (d) Effective Date The amendment made by subsection (a) shall take effect 1 year after the date of enactment of this Act.