Florida Administrative Code
6 - DEPARTMENT OF EDUCATION
6A - State Board of Education
Chapter 6A-1 - FINANCE AND ADMINISTRATION
Section 6A-1.09550 - Student Online Personal Information Protection

(a) "Education records" means records that are directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of the agency or institution, as defined in 20 U.S.C. s. 1232g(a)(4).

(b) "Eligible student" means a student who has reached eighteen (18) years of age or is attending a postsecondary institution, at any age.

(c) "Institution" means any public school, center, or other entity that is part of Florida's education system under Sections 1000.04(2), (4), and (5), F.S.

(d) "Online educational service" means computer software, mobile applications (apps), and web-based tools that students or parents are required to use and access through the internet and as part of a school activity or function. Examples include online services that students or parents use to access class readings, assignments, or videos, to view learning progression, or to complete assignments. This does not include online services that students or parents may use in their personal capacity or to online services that districts or schools may use to which students or parents do not have access, such as a district student information system.

(e) "Parent" includes parents or guardians of students who are or have been in attendance at a school or institution as defined in paragraph (2)(c).

(f) "Personally identifiable information" or "PII" means information that can be used to distinguish or trace a student's identity either directly or indirectly through linkages with other information, as defined in 34 CFR § 99.3. PII includes, but is not limited to direct identifiers (such as a student's or other family member's name), indirect identifiers (such as a student's date of birth, place of birth, or mother's maiden name), and other personal identifiers (such as a student's social security number or Florida Education Identifier (FLEID) number). PII also includes information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

(g) "School Board or School District" means a Florida school district or district school board, charter school governing board, the Florida Virtual School (Section 1002.37, F.S.), the Florida School for the Deaf and the Blind (Section 1002.36, F.S.), and Developmental Research (Laboratory) Schools (Section 1002.32, F.S.).

(h) "Student" means any individual who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records.

(i) "Third-party vendor" or "Third-party service provider" means any entity, whether public or private, that provides services to a school board or institution through a contract or agreement. The term does not include the Florida Department of Education, the Department's contractors and subcontractors, or School Boards and School Districts as defined in paragraph (2)(g).

(a) For online educational services that students and parents are required to use, school districts and charter school governing boards must adopt policies to protect student PII from potential misuse and to protect students from data mining and targeted advertising. These policies must include, at a minimum, review and approval of any online educational service that students or their parents are required to use as part of a school activity or function. These policies must also include:

(b) For online educational services that students and parents are referred to as part of a school activity or function, but are not required to use, school districts and charter school governing boards must provide notice to parents and eligible students if such online services have not been reviewed and approved in accordance with paragraph (3)(a).

(a) All contracts or agreements executed by or on behalf of a school district or charter school with a third-party vendor or a third-party service provider must protect the privacy of education records and student PII contained therein. Any agreement that provides for the disclosure or use of student PII must:

(b) Contracts or agreements with a third-party vendor or third-party service provider may permit the disclosure of PII to the third party only where one or more of the following conditions has been met: