H.B. 55 Privacy Compliance for Education Technology Vendors: transcript

Alright. Um, this should, um, seem very familiar. We talked about it during interim, but for those who were not on the interim, um, committee, we found out, um, that there was an audit that was done. And board member Earl is here to talk about some of the findings to do with that. Um, so maybe I'll let her do that first and then I'll explain the bill.

Hello, Jenny Earl, Utah State Board of Education, and I'm just sharing, um, we did A BYU. Uh, our BYU did a study, an audit of our, an audit as in evaluating, um, EdTech companies. Um, they took the EdTech companies, they, they treated them as if they were the student and then they observed the behavior or the trafficking that was going on. Um, specifically were they collecting data that was not listed in the exhibit exhibit B of the data privacy agreements? And then also was that going on and being shared with like, um, um, ad um, vendor or, um, organizations and different entities. So after they did their analysis, and they only took about a hundred of the 3000 or more, probably more EdTech apps that we're using currently, um, they found that there was quite a bit of variation. Sometimes it was as simple as, um, a subcontractor was sending it on and the the actual contractor was not the third party and entity was not aware of it. And sometimes it was a very deliberate, um, type of a thing. So, um, what else do you want me to hit with that? That's good. Yeah. So that's a kind of a summary of that. Yeah. Which drew attention to the need to do something. Yeah. So we found out over 50% of our vendors were giving unauthorized access to our students' data. And so this bill, um, would make them cancel the, or make the school districts and, um, charters cancel those contracts if, uh, within 30 days they weren't able to resolve the situation. And then also every time a data, uh, and then for the amendment, it's for these audits to be redone every time a contract is renewed or, um, if they update their data privacy. And so that was just, um, putting that in there that wasn't really a, a function before, if that makes sense. So I'm open myself to questions.

Okay. My name is Allie Terry. And, um, thank you for the opportunity to, to speak today. Um, I am here with the Child First Policy Center. I'm also a mom, and like every parent in this room, I take very seriously the responsibility to keep my children safe. I'm the co-founder of G-rated Schools of Movement focused on protecting kids' wellbeing and educational environments. But before any of that, I'm a parent who trusts that when my child logs into a school issued app or platform, their personal information is being treated with care, not quietly sold or misused behind the scenes. HB 55 matters because student data isn't abstract. It's our children's names, their learning struggles, their behaviors, their digital footprints often collected before they're old enough to understand what data even is. This past summer, which, um, Jenny Earl just, uh, referenced, but the results of this independent investigation done in partnership with the USBE Brigham Young University and Internet Safety Labs, uh, was published. And the results of this investigation were astounding. And I'm gonna just leave it at that since she just went over it. Um, but as parents, we don't get to opt out of caring about, about the data. Um, this bill doesn't create new rules out of thin air. It simply enforces the privacy laws that already exist. If a company wants to do business in Utah schools, that's fine, but if they violate student privacy, student privacy schools must have the ability to act quickly and decisively without fear of financial retaliation. What I appreciate most about HB 55 is that it puts children first in a very practical way. It gives schools clear authority, it protects parents' expectations, and it holds vendors accountable when trust is broken, while still allowing responsible ethical education technology to thrive. As a mom, I want to know that the system surrounding my children reflect the same care and responsibility I try to show them every day this bill helps make that true. On behalf of Utah Families and the Child First Policy Center, I strongly urge your support for HB 55. Thank you for putting children first.

Alright, Representative Peterson, I'd like to, um, move amendment one.

Yeah, I, this just is making it work with the data privacy team that the, um, USVE already has and just kind of spelling that out. So, okay. Thank you very much.

All right. Um, well I have it. I will, um, make a motion that we pass out house bill 55 as amended with a favorable recommendation.

I, I think as we sat through that education interim committee earlier this year, we were all really alarmed when we heard about how much our student data, uh, privacy had been violated by some of these vendors. And, and I really appreciate you taking on this issue because it's a little complicated in how you navigate some of this. So thank you for doing that. I appreciate you, uh, figuring out how this bill can be workable for our school districts, um, because we do still need vendors. Um, but, um, but also ensuring that our students have, uh, the privacy we expected that they did. So thank you. Thank

Alright. Yeah, you know, we already had federal and state law prohibiting the sharing of this data and so this just gives our school districts a little teeth to be able to cancel those contracts. So I would appreciate, uh, a yes vote. Thank you.

Would it be appropriate to ask for it to go into the consent calendar?

Um, it shouldn't have a note, have a fiscal note. No, We're just double checking. It's zero. Does not have a fiscal note.

If, if that's, you're a little tricky sometimes to be on the consent calendar, so, oh, it's up to you. If, if that's the motion the sponsor would like, I'm happy to make the motion, uh, that she goes on the consent calendar in the house.

Um, yeah, I guess I just assumed that if it was unanimous, it can go, but if there's any repercussions, then that

Then would that kill it or something? Or, So what happens? Go ahead,

So what happens is if you go on consent calendar, you know, you get so many minutes to just stand up and present your bill, but no one can ask you a question. And so sometimes the issue is, if it is a little complicated when people didn't get to ask a question, they might make a dis different decision on how they vote. So it's always that if you feel like it's clean enough and clear enough that you're gonna be able to do it in three minutes and people are gonna feel comfortable with that. If not, then, and, you know, people, you're, you think it might be helpful to have, allow people to ask questions whether they do or they don't. That's always the thing you have to weigh as the sponsor.

I feel confident I'll talk to people beforehand. Okay, thank you.

Then I'll leave my motion.

I will be so fast because most of you guys are on the interim committee. And this was, um, because of an audit that we did where we found that our vendors on our Chromebooks, uh, we're sharing third party, or we're sharing, um, student information with third parties. And so this bill makes it so that if they, um, once we detect a problem, if it is not fixed within 30 days, then the schools have to cancel the contracts because this is already federal and state law that they should not be sharing student information. So this just makes them, um, have a tool for the schools to feel like they can fall back on and say, you know, this is our policy. And then it also has the state board helping in a way that they've already identified that they'll be looking into and auditing some of this stuff.

Yes. Um, I had, we had put on an amendment after talking to the school board about, um, their involvement and it put a fiscal note on it. It was on the consent calendar, so we pulled it off. Um, and then we made another amendment to, to lower that down. But basically we were asking the school board, okay, how much can you do that is going to be what you're already doing as far as auditing these things? And we just stuck it in and, and to codify it.

You I'd be fast.

mcCal. Thank you representative. Er, this is my attempt to be efficient tonight. I noticed that the bill was unanimous in the house committee and on the house floor. Um, is there any opposition to this bill tonight?

No. I mean, it's just protecting privacy of our kids, so,

Okay. So I'm just good. Good. So I, I'm hoping there's not lots of opposition and not lots of public comment. I would be shocked if there's any, I did ask this, uh, school board member if she wanted to talk about the audit, but since we, you guys already know, I don't think that's necessary. Okay. That's all through quick.

Thank you representative. Er that's It. Thank you.

Thank you. I move this committee favorably recommend House Bill 55. And when you come back to me, I'm gonna waive my summation as well.

Madam Reading Clerk House Bill 55. Privacy compliance for education technology vendors by Representative Voxer. This bill was heard in education with the vote of 11 0 4.

Thank you Mr. Speaker. Motion to amend

Uh, what? Adopt. Adopt a Second Amendment. Second Amendment House. Bill 55.

Yes. Uh, colleagues, this bill was on the consent calendar, but we had adopted the First Amendment right as we were passing it out of committee and we realized that there was a fiscal note on it. So working with USBE, we have a new amendment that will make it so that there is no fiscal note. So I would appreciate the support.

Thank you. Um, over the summer we had an audit in education committee that showed that over 50% of our vendors, um, on our school computers were sharing student information with third parties. So this bill is a committee bill to make schools cancel the contract within 30 days. If the vendor can't fix the program once there's been a breach, um, or a sharing of data detected. And it also, um, makes it so there's no cancellation fees to the schools, but just gives them a little bit of a, a tool to push back against this breach of federal and state law.

Thank you Mr. Speaker. I appreciate the sponsor's Good work. This is, uh, I think a really important bill. Um, the idea that if we have a data privacy, uh, a vendor that's violating data privacy laws in the state of Utah, um, that somehow that could continue, this provides a, uh, pathway to address those concerns once we discover them. The, uh, in, by instructing the LEA to, um, by instructing the LEA to terminate the contract, if they're unwilling to violate, uh, unwilling to address the data policy violations, this is the right, this is the right policy for our students in the state. Thank you Mr. Speaker.

Thank you. I think the most important thing we can do to protect our students is to protect their information and not let third parties benefit off of them. So I'd appreciate the support. Thank you.

Uh, we, we talked about this bill yesterday and, uh, the other day. And, uh, the bill basically requires the termination of contracts with third party providers in certain circumstances involving a failure to comply with state and federal privacy laws. And so this is, this is the bill that basically, uh, dealt with with the privacy of student, uh, information. Uh, the audit that we looked at, it really over 50% of our vendors were sharing and selling student information. So vendors would have 30 days fix product, uh, the problem, and then the school board, uh, would implement an audit process. So with that, I, uh, am open to questions.

Senator Vickers. Baldry Aye. Lein Aye. Brammer Aye. Bus? Aye. Cullimore. Aye. Ms. Camilla Aye. Fillmore Aye. Grover Harper Pink Kins Aye. Ipson Aye. Johnson? Aye. Quan McKay Mikel. Aye. Milner Musman Aye. Owens Aye. Kay. I Pitcher Aye. Lum Aye. Rebi Aye. Sandal Stevenson Aye. Stratton Aye. Vickers Aye. Weiler Aye. Wilson Aye. Winterton Aye. President Adams Aye.