HB2017 creates a new section of the Virginia Code governing “student support agencies,” defined as nonprofit organizations registered with the Commonwealth that provide direct services to public school students, such as housing stabilization, case management, tutoring, mentoring, and summer enrichment. The bill establishes a statewide registration and oversight framework administered by the Department of Education, including required documentation, a public registry, model memoranda of understanding, consent forms, dispute-resolution procedures, and guidance on data security. It also directs the Department to create a grant program for smaller agencies to improve cybersecurity and to work with the Virginia Information Technologies Agency to provide training, encryption tools, and privacy-policy templates.
The bill imposes detailed privacy and security obligations on participating agencies. These include compliance with FERPA, annual notice to parents or adult students, maintenance of privacy and information-security policies, limits on collection and use of student personal information, restrictions on targeted advertising and profiling, retention and disposal rules, breach notification requirements, and annual compliance reporting to the Department. The Department must also conduct annual audits of a sample of registered agencies and may impose fines or remove agencies from the registry for serious violations. The bill expressly limits school-board liability for a student support agency’s noncompliance and sets phased implementation deadlines for the registry, grant program, cybersecurity support, and first audit.
The bill’s impact on state law would be to add a new regulatory regime for nonprofit student-support providers working with public schools and to formalize how student data may be shared between school boards and those providers. It would create new administrative duties for the Department of Education, new compliance obligations for nonprofit agencies, and new consent and data-handling requirements affecting parents, students age 18 or older, and school boards. It also creates enforcement tools, including audits, fines, and removal from the registry, and establishes a dedicated grant mechanism funded in part by penalties collected under the section.
The general sentiment reflected in the voting history appears mixed but not uniformly opposed. The bill advanced out of a subcommittee and the House Education Committee by clear margins, suggesting support for the concept of expanding student support services while adding privacy safeguards. At the same time, the later subcommittee action to lay the bill on the table indicates hesitation or unresolved concerns, likely about implementation, administrative burden, or the scope of the new regulatory structure.
The main points of contention likely center on student-data privacy, parental consent, and the burden placed on nonprofits and school divisions. Supporters would likely emphasize the need to help at-risk students and to set clear rules for data security and accountability, while critics may worry about the complexity of the registration and audit system, the costs of compliance, the handling of personally identifiable information, and whether the Department and school boards can administer the program effectively. The bill’s exceptions allowing certain educational uses of data and coordination with governmental entities may also draw scrutiny from privacy-focused stakeholders.
HB2017 would add § 22.1-289.01:1 to Title 22.1 of the Code of Virginia, creating a new statewide framework for nonprofit student support agencies serving public school students. It would require registration with the Department of Education, impose privacy, consent, retention, breach-notification, and security requirements, authorize audits and penalties, and direct the Department to develop a registry, model MOU, grant program, and cybersecurity support. It also affects school boards by regulating how they may share student information with these agencies and by limiting their liability for agency noncompliance.
The bill appears to have received cautious support in committee, with favorable votes to report it and move it to Appropriations, but also some resistance or uncertainty, as shown by a later subcommittee recommendation to lay it on the table. Overall, the discussion history suggests interest in the policy goal of supporting at-risk students, paired with concern about privacy, administrative complexity, and implementation costs.
Likely points of contention include the scope of student personal information that may be collected and shared, the requirement for parental or adult-student consent, and the compliance burden on small nonprofit agencies and school boards. Privacy advocates may focus on restrictions against targeted advertising, profiling, and unauthorized transfers, while supporters may argue the bill is necessary to protect students while enabling services such as tutoring, mentoring, and housing stabilization. The audit, fine, and registry-removal provisions may also be debated as either necessary enforcement tools or overly punitive measures.