Revised School Code, protection of pupil privacy

Section 1136 of the Revised School Code requires the superintendent of public instruction to ensure that the department complies, and the state budget director to ensure that CEPI complies, with the pupil privacy duties in subsection (1) (MCL 380.1136(1)). The department and CEPI may not sell any information that is part of a pupil's education records (MCL 380.1136(1)(a)).

By April 21, 2017, the department and CEPI each had to post on its website a notice of the information it collects for pupils' education records, including at least an inventory of all pupil data elements it collects and a description of each (MCL 380.1136(1)(b)). At least 30 days before collecting any pupil data element not already in that inventory, the department or CEPI must post a notice of the proposed additional elements and the reasons for the proposal (MCL 380.1136(1)(c)).

The department or CEPI may disclose information it collects or creates about a pupil only under a publicly available policy that clearly states the criteria for disclosure (MCL 380.1136(1)(d)). The department and CEPI must ensure that any contract with a vendor that allows the vendor access to education records contains express provisions requiring the vendor to protect the privacy of education records and express penalties for noncompliance (MCL 380.1136(1)(e)).

If the department or CEPI provides personally identifiable education-record information about a pupil to anyone other than the pupil's current or former school, district, authorizing body, preschool or postsecondary institution or the pupil's parent, it must, on a parent's written request and where the pupil is under 18 or a tax dependent, disclose the data fields disclosed, each recipient and the reason, within 30 days and without charge (MCL 380.1136(1)(f), (g)).

A school district, intermediate school district, public school academy, educational management organization or authorizing body may not sell or otherwise provide to a for-profit business entity any personally identifiable information that is part of a pupil's education records (MCL 380.1136(2)(a)).

That prohibition does not apply to providing the information to an educational management organization under a management agreement with a public school academy, as necessary for standardized testing, or as necessary to a person providing educational or educational support services to the pupil under a contract with the school district, intermediate school district, public school academy or educational management organization (MCL 380.1136(2)(a)(i) to (iii)).

An educational management organization that receives information that is part of a pupil's education records may not sell or otherwise provide it to any other person except as the section permits (MCL 380.1136(4)). On a parent's or legal guardian's written request, a school district, intermediate school district, public school academy or authorizing body must disclose the personally identifiable information it holds about the pupil as part of the pupil's education records (MCL 380.1136(2)(b)).

If it provides that information to any person, agency or organization, it must also disclose to the parent on written request the specific information disclosed, each recipient and the recipient's legitimate reason for obtaining it, subject to the exemptions in subsection (3) (MCL 380.1136(2)(c)). It must make that disclosure within 30 days after receiving the written request and without charge to the parent or legal guardian (MCL 380.1136(2)(d)).

The exemptions cover, among others, providing the information to the department or CEPI, to the parent, to an intermediate school district or authorizing body, with written consent of the parent or of a pupil aged 18 or older, under a court order or subpoena, for standardized testing, and directory information not opted out of (MCL 380.1136(3)).

Each school district, intermediate school district, public school academy or authorizing body must present a directory-information opt-out form to each pupil's parent or legal guardian within the first 30 days of the school year (MCL 380.1136(6)(c)).

The form must list the uses for which the body commonly would disclose a pupil's directory information and let a parent elect not to have the child's directory information disclosed for one or more of those uses, and the body must also make the form available on request at other times (MCL 380.1136(6)(a) to (c)).

If a parent or legal guardian signs and submits the opt-out form, the school district, intermediate school district, public school academy or authorizing body may not include the pupil's directory information in any of the uses opted out of (MCL 380.1136(6)(d)).

The department, CEPI, school districts, intermediate school districts, public school academies, educational management organizations and authorizing bodies may not disclose the confidential address of a pupil if the pupil or the pupil's parent or legal guardian has obtained an address confidentiality program participation card and the parent or legal guardian gives notice in the form and manner the department prescribes (MCL 380.1136(7)).

A pupil who is at least 18 or an emancipated minor may act on his or her own behalf in respect of the directory-information opt-out (MCL 380.1136(8)). Directory information and education records take their meanings from the federal regulation at 34 CFR 99.3 (MCL 380.1136(9)(d), (e)). Section 1136 was added by 2016 Act 367, effective March 22, 2017, and amended by 2020 Act 303, effective June 27, 2021.