HB267 Alabama 2016 Session

Summary

Primary Sponsor

Arnold MooneyRepresentative

Republican

Session

Regular Session 2016

Title

Education, Alabama Student and Parent Privacy Act, public school student and teacher information collection and disclosure limited to academic purposes, civil penalties for violations

Summary

HB267 would create the Alabama Student and Parent Privacy Protection Act to limit how public schools collect, store, and share student and teacher information to academic purposes, with civil penalties for violations.

What This Bill Does

It restricts local data collection to a defined list of data and requires written parental consent for data beyond that list. It bans collecting or using data for nonacademic purposes, including psychological data and predictive modeling, and prohibits selling personally identifiable information. It requires strong privacy protections, breach notifications, data destruction, and annual public disclosures, and it creates civil penalties and a private right of action for violations.

Who It Affects

• Students and their parents/guardians, who gain privacy protections, access rights to data, and a right to seek correction or removal of data.
• Local education agencies, schools, and outside vendors such as student information system providers, who must limit data collection, obtain consent for nonlisted data, implement security measures, and comply with reporting, breach response, and enforcement requirements.

Key Provisions

• Data collection and consent rules: Local schools may collect only a defined set of student data without parental consent; data beyond that list requires written consent; data such as medical, biometric, psychological data, and predictive modeling are restricted or prohibited; and personally identifiable information must be destroyed when appropriate, with aggregate data allowed to be transmitted to the state.
• Privacy protections and enforcement: Establishes security and privacy safeguards for data handlers, requires breach notification and remediation plans, prohibits data sale or secondary use by providers, mandates annual disclosures of data practices, and provides civil penalties and a private right of action for violations.

AI-generated summary using openai/gpt-5-nano on Feb 24, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Education