Support for reviewing educational technology

(a) Privacy technical assistance center (1) Center established Not later than 6 months after the date of enactment of this Act, the Secretary shall establish and maintain a privacy technical assistance center (referred to in this section as the Center), to build the capacity of educational agencies and institutions, State educational agencies, and other entities, including education technology providers, to protect the privacy of students, families, educators, and other school professionals. (2) Covered requirements The Center shall help such agencies, institutions, and other entities understand and satisfy their responsibilities under Federal privacy laws, including section 444 of the General Education Provisions Act (20 U.S.C. 1232g, commonly referred to as the Family Educational Rights and Privacy Act of 1974) and section 445 of such Act (20 U.S.C. 1232h; commonly referred to as the Protection of Pupil Rights Amendment), and other Federal privacy laws applicable to education records and other confidential data, which are collectively referred to in this section as covered requirements. (b) Safe harbor provision (1) In General In carrying out the purpose described in subsection (a), the Center may approve 1 or more voluntary safe harbor programs that meet the criteria described in paragraph (2) (referred to in this section as an approved program) that are operated by an independent organization. Such approved programs may provide safe harbor benefits described in paragraph (4) for providers of educational technology that elect to participate in an approved program for the purpose of ensuring compliance with this Act and the covered requirements. (2) Criteria for approval To be an approved program, an organization shall— (A) provide standards and controls that are at least as protective of student privacy, parental rights, and data security as the covered requirements; (B) include mechanisms for initial certification, ongoing monitoring, and periodic independent assessments of participants; (C) require timely consumer- and school-facing remedies, including clear notice, accessible consent and opt-out pathways, and data minimization, retention, and security practices; (D) establish a process to receive, investigate, and resolve complaints from parents, eligible students, schools, and State educational agencies; and (E) provide for meaningful disciplinary measures, including suspension or termination from the approved program, for material noncompliance. (3) Application and approval (A) In General An operator of a prospective approved program shall submit to the Center an application describing how the program satisfies the requirements described in paragraph (2). (B) Time for approval The Center shall approve or deny such an application not later than 180 days after receipt of the application. (C) Publication of criteria and decisions The Center shall publish approval criteria and approval decisions relating to approved programs and prospective approved programs on a public website. (D) Conditions The Center may condition approval of a prospective approved program on modifications necessary to establish that participating providers of educational technology ensure parity with, or greater protection than, the covered requirements. (4) Effect of safe harbor Subject to paragraph (6), a provider of educational technology that is a participant in good standing in an approved program and in material compliance with that program’s requirements shall be presumed to satisfy the covered requirements with respect to the practices subject to that approved program, unless the Center determines, after notice and an opportunity to respond, that the approved program or participating provider of educational technology is materially deficient. (5) Maintenance of approved programs The Center may revoke or suspend an approved program’s approval upon a finding, after notice and opportunity to respond, that the program no longer satisfies the requirements of paragraph (2). Revocation or suspension shall be prospective and shall include reasonable wind-down provisions for participants. The Center shall provide written notice to the approved program not less than 30 days before revoking or suspending an approved program. (6) No limitation on enforcement Participation by a provider of educational technology in an approved program shall not preclude the Secretary from enforcing this Act or the covered requirements. Participation and material compliance with an approved program shall be an affirmative defense to alleged violations of the covered requirements with respect to the practices subject to that approved program. (7) Rule of construction Nothing in this subsection shall be construed to create a private right of action.