Prohibits the following from collecting, retaining, or using in any manner, student biometric information, unless it is necessary to implement an individualized education program or plan developed under section 504 of the rehabilitation act of 1973: (1) The superintendent of public instruction or an employee or contractor of the superintendent;

(2) An educational service district board, educational service district, employee, or contractor; and

(3) A school district board of directors, school, employee, or contractor.

Requires the K-12 data governance group to: (1) Develop a detailed data security plan and procedures to govern the use and maintenance of data systems; and

(2) Develop a model plan for school districts to use to safeguard personally identifiable student-level data at the school district level.

Requires the office of the superintendent of public instruction to grant parents and legal guardians access to certain student records.

Requires public agencies and organizations that possess personally identifiable student-level data to take special precautions to avoid accidental disclosure of the data.

Requires public agencies or organizations and private contractors or vendors, that are authorized to access student-level data, to adhere to all federal and state laws protecting student data and safeguarding the confidentiality and privacy of student records.