Pennsylvania SB 378: An Act amending Title 24 (Education) of the Pennsylvania Consolidated Statutes, in preliminary provisions, providing for student data privacy and protection; conferring powers and imposing duties on the Department of Education; and imposing penalties.

Bill Text

PRIOR PRINTER'S NO. 240 PRINTER'S NO. 1528
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No. 378
Session of
2025
INTRODUCED BY PHILLIPS-HILL, BROOKS, FONTANA, LAUGHLIN, J. WARD,
STEFANO, DUSH AND MASTRIANO, FEBRUARY 26, 2025
SENATOR CULVER, EDUCATION, AS AMENDED, MARCH 23, 2026
AN ACT
Amending Title 24 (Education) of the Pennsylvania Consolidated
Statutes, in preliminary provisions, providing for student
data privacy and protection; conferring powers and imposing
duties on the Department of Education; and imposing
penalties.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Part I of Title 24 of the Pennsylvania
Consolidated Statutes is amended by adding a chapter to read:
CHAPTER 5
STUDENT DATA PRIVACY AND PROTECTION
Subchapter
A. General Provisions
B. Powers and Duties
C. Disclosure and Use of Information
D. Enforcement
SUBCHAPTER A
GENERAL PROVISIONS
Sec.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

501. Scope of chapter.
502. Legislative intent.
503. Findings and declarations.
504. Definitions.
505. Effect of chapter.
§ 501. Scope of chapter.
This chapter relates to student data privacy and protection.
§ 502. Legislative intent.
It is the intent of the General Assembly to ensure that:
(1) Only essential student data shall be collected.
(2) Student data shall be safeguarded.
(3) The privacy rights of students and their parents or
legal guardians shall be honored, respected and protected.
§ 503. Findings and declarations.
The General Assembly finds and declares as follows:
(1) Educational entities in this Commonwealth are
custodians of vast amounts of personally identifiable
information through their collection and maintenance of
student data.
(2) It is critically important to ensure that only
essential student data shall be collected and that personal
information shall be protected, safeguarded, kept private and
only accessed or used by appropriate authorized persons.
(3) The Commonwealth lacks a sufficient plan to ensure
adequate protection of student data.
(4) The Commonwealth lacks guarantees for the protection
of student data and the personally identifiable information
contained within that data.
(5) Given the vast personally identifiable student
information held, educational entities are prime targets for
20250SB0378PN1528 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

data and information poaching by identity thieves and other
hackers.
(6) In emergencies, certain information should be
readily available to school officials and emergency personnel
to assist students and their families.
§ 504. Definitions.
The following words and phrases when used in this chapter
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Aggregate student data." Student data collected by an
educational entity which:
(1) Is totaled and reported at the group, cohort,
school, school district, region or State level as determined
by the educational entity.
(2) Does not reveal personally identifiable student
data.
(3) Cannot reasonably be used to identify, contact,
single out or infer information about a student or device
used by a student.
"Biometric identifier." A measurable biological or
behavioral characteristic that can be used for automated
recognition of an individual. The following apply:
(1) The term includes any of the following:
(i) A retina or iris scan.
(ii) A fingerprint.
(iii) A human biological sample.
(iv) A scan of the hand.
(v) A voice print.
(vi) Facial geometry.
(2) The term does not include any of the following:
20250SB0378PN1528 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

(i) A physical description, including height,
weight, hair color or eye color.
(ii) A writing sample.
(iii) A written signature.
(iv) Demographic data.
"Data authorization." A written authorization by a student
or a student's parent or legal guardian if the student is under
18 years of age to collect or share the student's student data.
"Department." The Department of Education of the
Commonwealth.
"Educational entity." An organized education provider,
including a public school. A PUBLIC SCHOOL DISTRICT, CHARTER
SCHOOL, REGIONAL CHARTER SCHOOL, CYBER CHARTER SCHOOL,
INTERMEDIATE UNIT OR AREA CAREER AND TECHNICAL SCHOOL. The term
does not include an institution of higher education.
"Educational record." Student data or other student
information created and maintained by an educational entity or a
third party.
"Institution of higher education." Any of the following:
(1) A community college operating under Article XIX-A of
the act of March 10, 1949 (P.L.30, No.14), known as the
Public School Code of 1949.
(2) A State-owned institution.
(3) A State-related institution.
(4) Any other institution that is designated as State-
related by the Commonwealth.
(5) An accredited private or independent college or
university.
(6) A private licensed school as defined in the