EdLaw
Ohio — technology providers and school-issued device monitoring (R.C. §§3319.325–3319.327)
Ohio's technology-provider regime: the definitions of "technology provider" and "educational record" (§3319.325), the provider's duties over student data including the prohibitions on sale and targeted advertising (§3319.326), and the restrictions on electronically monitoring a school-issued device (§3319.327).
§3319.325. Student data and technology provider definitions.
As used in sections 3319.325, 3319.326, and 3319.327 of the Revised Code:
(A) "Education records" has the same meaning as in the "Family Educational Rights and Privacy Act of 1974," 20 U.S.C. 1232g, and does not include any of the following:
- (1) Records of instructional, supervisory, and administrative personnel and educational personnel that are in the sole possession of the maker and are not accessible or revealed to any other person except a substitute teacher;
- (2) In the case of persons who are employed by a school district, records made and maintained in the normal course of business that relate exclusively to such person in that person's capacity as an employee and are not available for use for any other purpose;
- (3) Records on a student who is eighteen years of age or older, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in the person's professional or paraprofessional capacity, or assisting in that capacity, and that are made, maintained, or used only in connection with the provision of treatment to the student and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student's choice.
(B) "Educational support services data" means data on individuals collected, created, maintained, used, or disseminated relating to programs administered by a school district board of education or an entity under contract with a school district designed to eliminate disparities and advance equities in educational achievement for youth by coordinating services available to participants, regardless of the youth's involvement with other government services.
(C) "Information technology center" means an information technology center established under section 3301.075 of the Revised Code.
(D) "School-issued device" means hardware, software, devices, and accounts that a school district, acting independently or with a technology provider, provides to an individual student for dedicated student use.
(E) "Student" means an individual currently enrolled in a school district in any of grades kindergarten through twelve.
(F) "Technology provider" means a person who contracts with a school district to provide a school-issued device for student use and creates, receives, or maintains education records pursuant or incidental to its contract with the district.
Except as used in division (G) of section 3319.326 of the Revised Code, "technology provider" does not include a county board of developmental disabilities, educational service center, information technology center, assessment provider, curriculum provider, or city, local, exempted village, or joint vocational school district that enters into a service contract with a school district that includes issuing school-issued devices to students.
Last updated January 9, 2025 at 3:10 PM
§3319.326. Technology provider student data and educational records use.
A technology provider shall comply with Chapter 1347. of the Revised Code with regard to the collection, use, and protection of data as if it were a school district.
(A) Education records created, received, maintained, or disseminated by a technology provider pursuant or incidental to a contract with a school district are solely the property of the school district.
(B) If education records maintained by the technology provider are subject to a breach of the security of the data, as described in section 1347.12 of the Revised Code, the technology provider shall, following discovery of the breach, disclose to the school district all information necessary to fulfill the requirements of that section.
(C) Unless renewal of the contract is reasonably anticipated, within ninety days of the expiration of the contract, a technology provider shall destroy or return to the appropriate school district all education records created, received, or maintained pursuant or incidental to the contract.
(D) A technology provider shall not sell, share, or disseminate education records, except as provided by this section or as part of a valid delegation or assignment of its contract with a school district.
(E) A technology provider shall not use education records for any commercial purpose, including, but not limited to, marketing or advertising to a student or parent. A commercial purpose does not include providing the specific services contracted for by a school district. Nothing in this division prohibits the technology provider from using aggregate information removed of any personally identifiable information for improving, maintaining, developing, supporting, or diagnosing the provider's site, service, or operation.
(F) A contract between a technology provider and a school district shall ensure appropriate security safeguards for education records and include both of the following:
- (1) A restriction on unauthorized access by the technology provider's employees or contractors;
- (2) A requirement that the technology provider's employees or contractors may be authorized to access education records only as necessary to fulfill the official duties of the employee or contractor.
(G) Not later than the first day of August of each school year, each school district shall provide parents and students direct and timely notice, by mail, electronic mail, or other direct form of communication, of any curriculum, testing, or assessment technology provider contract affecting a student's education records. The notice shall do all of the following:
- (1) Identify each curriculum, testing, or assessment technology provider with access to education records;
- (2) Identify the education records affected by the curriculum, testing, or assessment technology provider contract;
- (3) Include information about the contract inspection and provide contact information for a school department to which a parent or student may direct questions or concerns regarding any program or activity that allows a curriculum, testing, or assessment technology provider access to a student's education records.
Each school district shall provide parents and students an opportunity to inspect a complete copy of any contract with a technology provider.
Last updated January 9, 2025 at 3:10 PM
§3319.327. Monitoring of school-issued devices.
(A) Except as described in division (B) of this section, a school district or technology provider shall not electronically access or monitor any of the following:
- (1) Location-tracking features of a school-issued device;
- (2) Audio or visual receiving, transmitting, or recording feature of a school-issued device;
- (3) Student interactions with a school-issued device, including, but not limited to, keystrokes and web-browsing activity.
- (1) The activity is limited to a noncommercial educational purpose for instruction, technical support, or exam-proctoring by school district employees, student teachers, staff contracted by a district, a vendor, or the department of education and workforce.
- (2) The activity is permitted under a judicial warrant or subpoena unless otherwise prohibited by state or federal law.
- (3) The school district or technology provider is notified or becomes aware that the device is missing or stolen.
- (4) The activity is necessary to prevent or respond to a threat to life or safety, and the access is limited to that purpose.
- (5) The activity is necessary to comply with federal or state law.
- (6) The activity is necessary to participate in federal or state funding programs.
- (1) In any year that a school district or technology provider elects to generally monitor a school-issued device for any of the circumstances described in division (B) of this section, the school district shall provide written notice of that monitoring to the parents of its enrolled students.
- (2) In the event that one of the circumstances described in division (B)(2) or (3) of this section is triggered and the school district initiates responsive action, the school district shall, within seventy-two hours of the access, notify the student's parent and provide a written description of the triggering circumstance, including which features of the device were accessed and a description of the threat, if any. This notice is not required at any time when the notice itself would pose a threat to life or safety.
- (3) In the event that one of the circumstances described in division (B)(4) of this section is triggered and the school district initiates action in response to division (B)(4) of this section or pursuant to section 2151.421, 3313.66, 3313.666, or 3313.669 of the Revised Code, the school district shall, within seventy-two hours of the access, notify the student's parent and provide a written description of the triggering circumstance, including which features of the device were accessed and a description of the threat, if any. This notice is not required at any time when the notice itself would pose a threat to life or safety.
Unless otherwise provided by law, no person shall release, or permit access to, educational support services data concerning any student attending a public school for any purpose.
Educational support services data shall be made available to the opportunities for Ohioans with disabilities agency established in section 3304.15 of the Revised Code in furtherance of that agency's duties and supports to individuals with disabilities as described in Chapter 3304. of the Revised Code.
(D) A contract entered into between a school district and a county board of developmental disabilities, educational service center, joint vocational school district, another school district, or an information technology center for services, including the general monitoring or access of school-issued devices, shall indicate which entity is responsible for providing notice under this section.
Last updated January 9, 2025 at 3:11 PM