Student Privacy Protection Act

Student Privacy Protection Act

Amends the Family Educational Rights and Privacy Act of 1974 (FERPA) to require educational agencies or institutions and state educational authorities to establish: (1) information security practices to protect students' education records and personally identifiable information, and (2) breach notification policies to notify parents of breaches or security violations.

Expands the definition of "education records" to include student records that are: (1) maintained electronically or digitally; (2) accessible or collected by service providers, contractors, or other parties; or (3) created by or for a state educational authority, without regard to whether the student attends a school under the jurisdiction of such state educational authority.

Allows educational agencies or institutions to disclose education records without parental consent to education service providers, contractors, or other parties to whom institutional services have been outsourced, provided that the party agrees to secure information from unauthorized access and be subject to penalties for violations.

Permits disclosure of education records without parental consent to authorized representatives of the Government Accountability Office, the Department of Education (ED), state or local educational authorities, or the Department of Justice (DOJ) for: (1) audits, evaluations, or enforcement of local, state, or federal laws; (2) audits or evaluations of locally supported, state supported, or federally supported education programs pursuant to local, state, or federal laws; or (3) enforcement of federal or state legal requirements related to such programs.

Removes restrictions on disclosures to state and local authorities to whom information is specifically allowed to be reported or disclosed pursuant to a state statute regarding the juvenile justice system.

Limits the types of studies that organizations may conduct with student records disclosed without parental consent to studies used to improve academic outcomes of students attending the educational agency or institution.

Establishes conditions under which college exam developers may release information collected during or based on the administration of an exam for college admissions, placements, credits, or scholarships.

Updates existing provisions concerning disclosures of: (1) disciplinary proceedings regarding crimes of violence or nonforcible sex offenses to specify that the provisions apply to institutions of higher education, and (2) registered sex offender information to make the provisions apply to educational agencies or institutions provided information under the Adam Walsh Child Protection and Safety Act of 2006.

Prohibits information gained through access to student education records from being used to market or advertise directly to students, but allows educational agencies or institutions or state educational authorities to contract with education service providers to use student information to market, advertise, or develop services for: (1) traditional school-sanctioned commemorative activities, such as official school pictures or class rings; (2) services to improve student academic outcomes; (3) sharing educational opportunities offered by the educational agency or institution or state educational authority; or (4) activities with parental consent.

Establishes fines that ED may impose on educational agencies or institutions or state educational authorities that fail to voluntarily comply with, or that substantially violate, education record requirements under FERPA. Requires ED, for violations by other parties, to: (1) refer the matter to the Federal Trade Commission or DOJ, and (2) prohibit such information from being accessed by those parties for a period of at least 5 but not more than 12 years.

Prohibits ED or education agencies from conducting surveys or data-gathering activities unless authorized by federal law.