In what can be compared to a modern-day technology sprint, California’s legislature introduced and passed far-reaching privacy legislation - the California Consumer Privacy Act (CCPA) - in less than a week. The multi-year effort by privacy advocates, technology companies, network providers and others before introduction ended in the final push in the legislature was completed in the just six days.

This far-reaching legislation will have impact across many different business sectors when it goes into effect on January 1, 2020 requiring for-profit businesses, not just technology companies, to provide the consumer access to the personal information collected about her, the opportunity to delete the data, and to allow her the opportunity to opt-out of the sale of personal information to third parties (or, if under the age of 16, the ability to opt-in).

Much like the software development process, the California legislature has acknowledged the need to fix the “bugs” in the bill and will begin to take those up as soon as this August. One area where clarification is particularly needed is how this bill will impact a student’s personal information in the school.

Most education technology companies providing services to California schools are under contract with a school, extremely restricted in what they may do with the data, and subject to enforcement by both state and federal officials. Companies help schools maintain the data necessary for schools to meet state and federal reporting requirements such as attendance and learning performance.

While most schools are not subject to the requirement of this bill, it is unclear if and how their service providers will need to comply. Will the companies need to honor requests from 17-year-olds to delete a bad grade or delete the entire student records without the school’s knowledge? Or will companies need to follow the privacy-protective procedures set forth by existing laws like SOPIPA that require a company to delete a student’s covered information if the school requests the deletion? We’d urge the latter.

Sara Kloek is SIIA's Director for Education Policy.