Serves K-12 schools, in Pennsylvania

22 Pa. Code 14.106(g) · Read the law's page

• If you are a Pennsylvania agency (a school entity, approved private school, State-operated program or facility or other public or private organization providing educational services to children with disabilities, other than a charter school or cyber charter school) that coordinates with the National Instructional Materials Access Center (NIMAC), require the textbook publishers you buy from to deliver the contents of print instructional materials to the NIMAC in NIMAS format files on or before delivery of the print instructional materials to you (22 Pa. Code 14.106(g)).for a public body
• If you publish textbooks or other print instructional materials sold to a Pennsylvania agency that coordinates with the NIMAC, deliver the contents of the print instructional materials to the NIMAC in NIMAS format files on or before delivery to the agency, the term the agency must require of you (sec. 14.106(g)).

22 Pa. Code 711.45(g) · Read the law's page

• If you are a Pennsylvania charter school or cyber charter school that coordinates with the National Instructional Materials Access Center (NIMAC), require the textbook publishers you buy from to deliver the contents of print instructional materials to the NIMAC in NIMAS format files on or before delivery of the print instructional materials to you (22 Pa. Code 711.45(g)).for a public body
• If you publish textbooks or other print instructional materials sold to a Pennsylvania charter school or cyber charter school that coordinates with the NIMAC, deliver the contents of the print instructional materials to the NIMAC in NIMAS format files on or before delivery to the school, the term the school must require of you (sec. 711.45(g)).

Pa. H.B. 2785, sec. 807.2 (PN 4005) · Read the law's page

• House Bill 2785 (Printer's No. 4005) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
• If you are a school entity that contracts with a third party providing artificial intelligence-related technology, programs or platforms, require the contract to bind the third party to all applicable Federal and State privacy and security laws, including FERPA, the Children's Internet Protection Act and the Children's Online Privacy Protection Act (proposed section 807.2(a)(1)).
• If you are such a school entity, require the contract to prohibit the sale and rental of data containing personally identifiable information of a student or school employe, and its use or disclosure to train, refine or build foundation models (proposed section 807.2(a)(2) and (3)).
• If you are such a school entity, require the contract to bind you and the third party to security measures that reasonably prevent unauthorized collection, disclosure and retention of that data, and to prohibit collection of a student's biometric information through the technology except as the law requires (proposed section 807.2(a)(4) and (5)).
• If you are such a school entity, require the contract to set procedures for the third party to permanently delete all sensitive data within 90 days of contract termination or your request, and to notify you of a breach of the security of data (proposed section 807.2(a)(6) and (7)).
• If you are a third party providing artificial intelligence-related technology, programs or platforms procured by a school entity, report to the Department of Education your contact information, each school entity you serve, the name and a brief description of each artificial intelligence-related program, platform or other technology you provide, including whether it is explicitly designed for educational use and whether it uses generative artificial intelligence, synthetic content, artificial intelligence chatbots or other artificial intelligence systems, and an attestation that each meets the contract terms (proposed section 807.2(c)).

Pa. S.B. 378, sec. 526 (PN 1528) · Read the law's page

• Senate Bill 378 (Printer's No. 1528) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
• If you are an educational entity or a third party that maintains a student's data, provide the data to a requesting student, or to the parent or guardian of a student under 18, in a timely manner and in electronic form unless it is not kept electronically or cannot reasonably be made available (proposed section 526(a) and (b)).
• If you receive a request to correct inaccurate or incomplete student data, or to expunge information about an unsubstantiated accusation or an adjudicated matter in which the student was found not at fault or not guilty, make the changes and confirm them to the requester within 90 days (proposed section 526(c)).

Pa. S.B. 378, secs. 524, 525, 527 (PN 1528) · Read the law's page

• Senate Bill 378 (Printer's No. 1528) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
• If you contract with a public school district, charter school, regional charter school, cyber charter school, intermediate unit or area career and technical school, use personally identifiable student data received under the contract strictly to provide the contracted product or service, unless a student or the student's parent affirmatively chooses to disclose it for a secondary purpose (proposed section 527(a)).
• Do not use student data or information from an educational record obtained under that contract to conduct targeted marketing, to sell it, or to exchange it for goods, services or applications (proposed section 527(b)(1), (3) and (4)).
• Do not create a student profile from that data except as the contract with the educational entity allows or in furtherance of the educational entity's purposes (proposed section 527(b)(2)).
• Do not disclose student data or information from an educational record except as the chapter provides, and do not impede a student or parent from downloading, exporting or saving the student's data (proposed section 527(b)(5) and (6)).
• Do not collect a biometric identifier on a student, such as a retina or iris scan, fingerprint, voice print or facial geometry, except as required by law (proposed section 524).
• Do not release or use student data for targeted marketing unless the release is absolutely necessary for education progression (proposed section 525).

Pa. S.B. 378, secs. 541, 543 (PN 1528) · Read the law's page

• Senate Bill 378 (Printer's No. 1528) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
• If you are an educational entity, notify the chief data privacy officer within the Department of Education of a suspected or confirmed data breach or security compromise within 24 hours of becoming aware of it (proposed section 541(a)).
• If you are an educational entity, notify each affected student, and each affected student's parent or guardian if the student is under 18, within three business days of verification of an unauthorized release or compromise of student data (proposed section 541(b)).
• If you are a third party holding student data and a suspected or confirmed breach occurs, notify the contracting educational entity within 24 hours of becoming aware of it, take action to determine the scope of the data compromised, update the educational entity once the full scope is known, and take all reasonable steps to notify the affected individuals (proposed section 541(c)).