Serves K-12 schools, in Ohio

Ohio Rev. Code Sec. 3319.326 · Read the law's page

• This binds a technology provider, a person who contracts with a school district to provide a school-issued device for student use and creates, receives or maintains education records under that contract; a county board of developmental disabilities, educational service center, information technology center, assessment provider, curriculum provider, or city, local, exempted village or joint vocational school district that enters into a service contract with a school district that includes issuing school-issued devices to students is not a technology provider, except as the term is used in division (G) of section 3319.326 (sections 3319.325(F) and 3319.326).
• Comply with Chapter 1347 of the Revised Code with regard to the collection, use and protection of data as if you were a school district (section 3319.326, opening paragraph).
• Treat education records you create, receive, maintain or disseminate under the school district contract as solely the property of the school district (section 3319.326(A)).
• If education records you maintain are subject to a breach of the security of the data, as described in section 1347.12 of the Revised Code, disclose to the school district, following discovery, all information necessary to fulfill the requirements of that section (section 3319.326(B)).
• Unless renewal of the contract is reasonably anticipated, destroy or return to the school district all education records created, received or maintained under the contract within ninety days of the contract's expiration (section 3319.326(C)).
• Do not sell, share or disseminate education records, except as section 3319.326 provides or as part of a valid delegation or assignment of your contract with the school district (section 3319.326(D)).
• Do not use education records for any commercial purpose, including marketing or advertising to a student or parent; providing the specific services the school district contracted for is not a commercial purpose, and aggregate information removed of any personally identifiable information may be used to improve, maintain, develop, support or diagnose your site, service or operation (section 3319.326(E)).
• Contract with the school district for appropriate security safeguards for education records, including a restriction on unauthorized access by your employees or contractors and a requirement that they be authorized to access education records only as necessary to fulfill their official duties (section 3319.326(F)).
• If you are a school district, not later than the first day of August of each school year give parents and students direct and timely notice, by mail, electronic mail or another direct form of communication, of any curriculum, testing or assessment technology provider contract affecting a student's education records, identifying each such provider with access to education records and the records affected, with information about contract inspection and contact information for a school department that takes questions, and give parents and students an opportunity to inspect a complete copy of any contract with a technology provider (section 3319.326(G)).

Ohio Rev. Code Sec. 3319.327 · Read the law's page

• This binds a school district and a technology provider, meaning a person who contracts with a school district to provide a school-issued device for student use and creates, receives, or maintains education records pursuant or incidental to its contract with the district (sections 3319.325(F) and 3319.327(A)).
• Do not electronically access or monitor the location-tracking features of a school-issued device, except in the circumstances division (B) of section 3319.327 lists (section 3319.327(A)(1)).
• Do not electronically access or monitor the audio or visual receiving, transmitting or recording feature of a school-issued device, except in the circumstances division (B) lists (section 3319.327(A)(2)).
• Do not electronically access or monitor student interactions with a school-issued device, including keystrokes and web-browsing activity, except in the circumstances division (B) lists (section 3319.327(A)(3)).
• The division (A) bar does not apply to activity limited to a noncommercial educational purpose for instruction, technical support or exam-proctoring by school district employees, student teachers, staff contracted by a district, a vendor or the department of education and workforce; activity permitted under a judicial warrant or subpoena unless state or federal law otherwise prohibits it; activity once you are notified or become aware that the device is missing or stolen; activity necessary to prevent or respond to a threat to life or safety and limited to that purpose; activity necessary to comply with federal or state law; and activity necessary to participate in federal or state funding programs (section 3319.327(B)).
• In any year that you elect to generally monitor a school-issued device for a division (B) circumstance, give the parents of the district's enrolled students written notice of that monitoring; the duty to give it rests on the school district (section 3319.327(C)(1)).
• Where a division (B)(2), (B)(3) or (B)(4) circumstance is triggered and the school district initiates responsive action, notify the student's parent within seventy-two hours of the access, with a written description of the triggering circumstance, the features of the device accessed and the threat, if any, unless the notice itself would pose a threat to life or safety (section 3319.327(C)(2) and (C)(3)).
• Where a school district contracts with a county board of developmental disabilities, educational service center, joint vocational school district, another school district or an information technology center for services that include general monitoring or access of school-issued devices, state in the contract which entity is responsible for giving the notice (section 3319.327(D)).
• Unless otherwise provided by law, do not release, or permit access to, educational support services data concerning any student attending a public school for any purpose (section 3319.327, paragraph after division (C)).

Ohio Rev. Code Sec. 3301.0714 · Read the law's page

• This binds the Department of Education and Workforce, which adopts the rules and guidelines for the statewide education management information system, the school districts, community schools and information technology centers that collect and report student data into it, and, under divisions (K) and (O), any person who handles that data (section 3301.0714(A), (D), (J), (K), (M) and (O)).
• If you are the Department of Education and Workforce, adopt rules for the statewide education management information system whose guidelines include standards that provide strict safeguards to protect the confidentiality of personally identifiable student data (section 3301.0714(A)(5)).
• If you are the Department of Education and Workforce, set guidelines that prohibit reporting a student's name, address and Social Security number to the department (section 3301.0714(D)(1)).
• If you are the Department of Education and Workforce, do not authorize school districts in the guidelines to request the Social Security numbers of individual students (section 3301.0714(D)(1)).
• If you are the Department of Education and Workforce, set guidelines that prohibit reporting personally identifiable information about any student to any other person, except for assigning the data verification code, unless the person is employed by the school district or the information technology center and is authorized by it to have access, or is employed by an entity with which the department contracts for the scoring or the development of state assessments (section 3301.0714(D)(1)).
• Except in the cases section 3301.0714(D)(2)(b)(ii) and the sections it lists allow, the department may not have access to information that would enable a data verification code to be matched to personally identifiable student data (section 3301.0714(D)(2)(b)(i)).
• If you are an information technology center or a school district, do not acquire, change or update your student administration software package for managing and reporting the data the department requires unless you convert to a student software package the department certifies (section 3301.0714(M)).
• Do not remove data from the education management information system for the purpose of releasing it to a person not entitled under law to have access to it; a person who does is subject to section 2913.42 of the Revised Code, which prohibits tampering with data (section 3301.0714(K)).
• Do not release or maintain any information about any student in violation of section 3301.0714; a violation is a misdemeanor of the fourth degree (section 3301.0714(O)).

Ohio Rev. Code Sec. 3301.941 · Read the law's page

• Do not release a student level data record, a data verification code or other personally identifiable information you receive in providing services through an early childhood program to any person, except as section 3319.321 of the Revised Code or the Family Educational Rights and Privacy Act of 1974 provides (section 3301.941).
• This binds the Department of Education and Workforce and each school or center providing services through a publicly funded early childhood program that receives a student level data record, a data verification code or other personally identifiable information; the section does not limit those schools or centers to public bodies (section 3301.941).

Ohio Rev. Code Sec. 3301.947 · Read the law's page

• The section is written without a named duty-bearer, so it binds anyone who collects or handles data in the course of the state testing under sections 3301.079, 3301.0710, 3301.0711 and 3301.0712 of the Revised Code, public or private (section 3301.947).
• Use data collected in the course of that testing for the sole purpose of measuring and improving the academic progress and needs of students, educators, school districts and schools (section 3301.947).
• In the course of that testing, do not collect, track, house with, report to or share with any entity, including the federal or state government, a student's or a student's family's Social Security numbers, religious affiliation, political party affiliation, voting history or biometric information (section 3301.947).

Ohio Rev. Code Sec. 3301.948 · Read the law's page

• This binds the Department of Education and Workforce, any school district, any school, and any third party under contract with the state, a school district or a school (section 3301.948).
• Do not provide student names and addresses to any multi-state consortium that offers summative assessments (section 3301.948).

Ohio Rev. Code Sec. 3313.96 · Read the law's page

• Operate any student or minor fingerprinting program for the sole purpose of providing a means by which a missing child might be located or identified (section 3313.96(C)).
• Do not require a student or minor to take part in the fingerprinting program, and enroll one only after the parent, guardian or legal custodian signs the authorization form (section 3313.96(C)(1) and (C)(2)).
• Give every fingerprint card to the parent, guardian or legal custodian after the fingerprinting, and do not retain a copy of a fingerprinting, because only the parent, guardian or legal custodian may hold one (section 3313.96(C)(4)).
• This binds a board of education, or the principal or chief administrative officer of a nonpublic school, that develops a student fingerprinting program, and its bar on keeping a copy reaches a law enforcement agency, a school, a school district and any other person (section 3313.96(C)).

Ohio Rev. Code Sec. 3319.321 · Read the law's page

• This binds any person, in the statute's words, and so reaches a vendor that holds or can reach the records of students attending a public school (section 3319.321(A), (B) and (F)).
• Do not release, or permit access to, the directory information concerning students attending a public school to any person or group for use in a profit-making plan or activity (section 3319.321(A)).
• Do not release, or permit access to, personally identifiable information other than directory information concerning a public school student without the written consent of the parent, guardian or custodian of a student under eighteen, or of a student eighteen or older, unless division (C), (E), (G) or (H) of the section permits it (section 3319.321(B)).
• When you receive information covered by section 3319.321 that has been released, other than directory information or information released under division (E), (G) or (H), take it on the condition that you will not permit any other party to have access to it without the written consent of the parent, guardian or custodian, or of a student eighteen or older (section 3319.321(B)(3)).
• Except as section 3319.321 provides, do not release or make available public school records for any other purpose (section 3319.321(C)).
• Do not release, or permit access to, information about the location of the school to which a student has transferred when the school that requested the student's records informs the sending school that the student is under the care of a shelter for victims of domestic violence (section 3319.321(F)).