Law / United States / 
California
School safety programs: no biometric information or required real-time location tracking, and developer privacy and disclosure duties
Cal. Education Code section 32280.5
In force since .
A biometric privacy rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Disclosure
- Audit expectation
- none
What it requires
- The program duties below apply only to a web-based or app-based school safety program that a school implements under section 32280.5(a); the section encourages, and does not require, each public school, including a charter school, with 100 or more pupils to implement one by (section 32280.5(a)).
- If you operate a web-based or app-based school safety program that a school implements under section 32280.5(a), do not use biometric information in the program and do not require pupils or staff to use or install an app that provides real-time location tracking (section 32280.5(a)(7)(B)).
- If you operate such a program, let first responders connect to the schoolsite's surveillance system through it only when a designated schoolsite administrator or staff member has requested law enforcement assistance for a situation involving imminent danger of serious physical injury or death to a person on school property (section 32280.5(a)(5)(B)).
- Keep the program's schoolsite grid map, multilayered digital map, Wi-Fi connection information, hierarchy of those with responsibility duties (including their names, titles, photographs and contact information) and emergency procedures confidential, except as otherwise required to implement the section (section 32280.5(d)).
- If you develop a school safety program that a school implements, implement best practices to protect the security and data of all pupils and staff listed in the program, consult the department, and comply with the Student Online Personal Information Protection Act and the federal Family Educational Rights and Privacy Act (section 32280.5(b)(1) to (3)).
- If you develop a school safety program that a school implements, make your contract with the school and the best practices you follow publicly available (section 32280.5(b)(4) and (5)).
- If you are a school that implements such a program, ensure the program developers do these things (section 32280.5(b)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 32280.5 bars biometric information and required real-time location tracking in a school safety program and sets developer duties on security, contracts and best practices. It requires the program to archive the dates, times and comments of emergency practice drills as a program feature, which is a safety record and not a log of data processing, and names no retention period for it.
- Kind
- None
- As of
What this law does
Education Code section 32280.5(a) encourages each public school, including a charter school, with an enrollment of 100 pupils or more to implement by a web-based or app-based school safety program with the parameters the subdivision lists. One listed parameter, section 32280.5(a)(7)(B), is that the web-based or app-based school safety program shall not use biometric information or require pupils or staff to use or install an app that provides real-time location tracking.
Section 32280.5(b) provides that a school that implements such a program shall ensure that the program developers implement best practices to protect the security and data of all pupils and staff listed in the program, and that the developers consult the department and comply with the Student Online Personal Information Protection Act and the federal Family Educational Rights and Privacy Act.
Section 32280.5(b)(4) and (5) require the program developers to make the contract between the school and the developers, and the best practices the developers follow, publicly available.
Section 32280.5(a)(5)(B) lets first responders connect to a schoolsite's surveillance system through the program only when a designated schoolsite administrator or staff member requests law enforcement assistance for a situation involving imminent danger of serious physical injury or death to a person on school property.
Section 32280.5(d) requires the program's schoolsite grid map, multilayered digital map, Wi-Fi connection information, responsibility hierarchy, including the names, titles, photographs and contact information of those listed, and emergency procedures to be kept confidential, except as otherwise required for purposes of implementing the section, and exempts that information from disclosure under the California Public Records Act.
Section 32280.5(e)(1) gives biometric information the meaning it has in section 1798.140 of the Civil Code. Section 32280.5 was added by Statutes 2024, chapter 528 (AB 960), effective .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .