Schools that collect student biometric information must adopt policies for collecting, using, securing, encrypting, and destroying it, and they must get written permission before collection.
§100.8. Student biometric information; collection and use A. For the purposes of this Section, "biometric information" means the noninvasive electronic measurement and evaluation of any physical characteristics that are attributable to a single person, including fingerprint characteristics, eye characteristics, hand characteristics, vocal characteristics, facial characteristics, and any other physical characteristics used for the purpose of electronically identifying that person with a high degree of certainty. B. The governing authority of each public elementary and secondary school that collects biometric information from students shall develop, adopt, and implement policies governing the collection and use of such information that, at a minimum, shall: (1) Contain a full explanation of what type of biometric information will be collected, how it will be collected and stored, and the purposes for which such information will be used. (2) Require written permission from the student's parent or other legal guardian, or the student if he or she is eighteen years of age or older, prior to the collection of any biometric information. Such written permission shall be obtained on a form that is created for the express purpose of obtaining the required permission. The granting of permission shall not be included as a part of any form used for enrollment purposes or other form required by the school's governing authority for any other purpose. (3) Provide that any biometric information collected from a student shall be used only for identification or fraud prevention purposes. (4) Ensure that a student's biometric information shall not be disclosed to a third party without the written permission of the student's parent or other legal guardian, or the student if he or she has reached the age of eighteen, unless the disclosure is required by court order. (5) Provide for the secure storage, transmission, and protection of all biometric information from unauthorized disclosure. (6) Require that student biometric information be encrypted using an algorithmic process which transforms data into a form in which there is a low probability of assigning meaning to such information without use of a confidential process or key. (7) Ensure that the use of a student's biometric information is discontinued upon: (a) The student's graduation or withdrawal from school. (b) Receipt of a written request to discontinue use of such information from the student's parent or other legal guardian, or the student if he or she is eighteen years of age or older. (8) Require that all biometric information collected from a student shall be destroyed within thirty days after use of such information is discontinued. C. A student shall not be refused or denied any services due to the failure of the student's parent or other legal guardian, or the student if he or she is eighteen years of age or older, to provide written consent as provided in Subsection B of this Section. D. Any collection of student biometric information shall comply with all applicable state and federal law and requirements, including the Federal Family Educational Rights Privacy Act of 1974. Acts 2010, No. 498, §1, eff. June 24, 2010.