SB424 Alabama 2013 Session

Summary

Primary Sponsor

Dick Brewbaker

Republican

Session

Regular Session 2013

Title

Student information, personally identifiable, prohibition against disclosure of

Summary

SB424 would tightly protect students' personally identifiable information by restricting its disclosure and use by schools and state entities, with consent required and enforcement and auditing mechanisms.

What This Bill Does

SB424 would prohibit the disclosure of personally identifiable student information to third parties without parental consent (or student consent for those 18 and older), except in limited cases such as legal requirements, court orders, contracts with safeguards and indemnification, approved research, state or federal audits, or health and safety emergencies. It would also ban using this information to develop commercial products or services. The Attorney General would enforce the act, and the State Auditor would regularly audit compliance. The bill defines what counts as personally identifiable information (including biometric data) and requires records of non-consensual disclosures to be maintained.

Who It Affects

• Students and their families would have stronger protections for their data; consent would be needed before sharing personally identifiable information, and the data includes names, addresses, IDs, biometric data, and other information that could identify a student.
• Schools, school districts, the Department of Education, public and private colleges and universities, and authorized contractors or researchers would need to follow strict data-sharing rules, implement safeguards, document disclosures, and could be penalized or audited for noncompliance.

Key Provisions

• Defines personally identifiable student information (PII) and biometric records, including name, parent's name, address, personal identifiers (such as SSN or student number), biometric data, date/place of birth, mother's maiden name, and any data that could identify a student.
• Prohibits disclosure of PII to third parties without consent, with exceptions for legal requirements, court orders, contracts performing administrative/technical/ transactional functions with safeguards and indemnification, approved research, state or federal audits/evaluations, and health or safety emergencies.
• Prohibits using PII to develop commercial products or services.
• Requires non-consensual disclosures to be recorded in the student's educational records.
• Requires disclosures for research or audits to be publicly posted with details about data types, recipients, purpose, duration, safeguards, and indemnification.
• Requires notification and consent forms to explain scope, risks, safeguards, and responsibility.
• Imposes penalties: violators may be barred from obtaining PII for at least five years.
• Gives the Attorney General enforcement authority and requires the State Auditor to conduct regular compliance audits.
• Effective date: the act becomes law on the first day of the third month after passage/approval.

AI-generated summary using openai/gpt-5-nano on Feb 25, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Education