Current through Register Vol. 63, No. 9, September 1, 2024
Any school district that plans to use a Radio Frequency
Identification Device (RFID) for the purpose of locating or tracking a student
or taking student attendance shall adopt a policy regarding the use of RFID.
The policy shall incorporate the standards outlined in this rule.
(1) Privacy and security standards:
(a) No personally identifiable information
may be stored on the RFID;
(b) The
RFID may not have a readable range of more than 10 feet;
(c) All data collected as part of a RFID
program shall be considered part of the student record and shall be retained in
accordance with state and federal student record laws and data privacy and
security standards;
(d) Data
collected as part of a RFID program shall be retained for no more than 72
hours, except records for the purpose of taking attendance; and
(e) RFID reader locations must be
conspicuously marked.
(2) Notification to parents and students:
(a) Districts that are beginning a RFID
program shall provide notice to parents and students at least 30 days before
the district implements use of the RFID program. The notification shall:
(A) Specify the purpose for the RFID program;
(B) Specify where the RFID readers
will be located;
(C) Outline the
expectations of participation in the program including any possible
disciplinary actions for not following the RFID program rules;
(D) Inform parents and students of the right
to not participate in the RFID program and how to opt out;
(E) Outline the procedure to not participate
in the RFID program; and
(F) Be
communicated in at least two formats, one of which shall be the school district
website, if available.
(b) Districts that have established RFID
programs shall provide a notice to parents and students annually at least 30
days prior to the first day of classes. The notification shall meet the
requirements outlined in paragraph (a) of this subsection.
(c) If the district expands the use of RFID
beyond the purpose specified in the notification requirement of paragraphs (a)
or (b) of this subsection, the district shall provide notice to parents and
students at least 30 days prior to the start of the new use of the RFID. The
notification shall meet the requirements outlined in paragraph (a) of this
subsection.
(3)
Notwithstanding subsection (3) of this rule, districts may create RFID programs
without notification if the district creates a form allowing parents to
voluntarily opt-in to a RFID program.
(a) The
form created under this section shall:
(A)
Require a parent signature or signature of a student if the student is 14 years
of age or older for consent to join the RFID program;
(B) Specify the purpose for the RFID program;
(C) Specify where the RFID readers
will be located;
(D) Outline the
expectations of participation in the program including any possible
disciplinary actions for not following the RFID program rules;
(E) Outline the procedures to discontinue
participation in the RFID program; and
(F) Expire one year from the date that the
form is signed by the parent.
(b) RFID programs administered under this
section shall not require any student to use RFID who does not have a consent
form on file.
(c) Districts
wishing to expand the RFID program to students without a valid consent form on
file must provide 30 day notification as outlined in section (3) of this rule.
(4) Parents or students
who are 14 years of age or older may provide notice in writing that they no
longer wish to participate in a RFID program as outlined in section (3) or (4)
of this rule. The district shall:
(a) Not ask
for the reason or justification for the request;
(b) Not impose a time restriction for a
request to be made;
(c) Ensure
that the request is completed within three school days; and
(d) Not initiate or continue any disciplinary
action against the student for not following the RFID program rules.
(5) As used in this rule:
(a) "Personally identifiable information"
means data that could potentially identify a specific individual.
(b) "RFID" means a Radio Frequency
Identification Device.
Stat. Auth.: ORS
339.890
Stat. Implemented: ORS
339.890
