Existing law establishes the California State University, under the administration of the Trustees of the California State University, the University of California, under the administration of the Regents of the University of California, the California Community Colleges, under the administration of the Board of Governors of the California Community Colleges, and independent institutions of higher education as the 4 segments of postsecondary education in the state.

Existing federal law establishes the Office for Civil Rights within the United States Department of Education and authorizes the office to collect and coordinate the collection of data necessary to ensure compliance with civil rights laws, as provided.

This bill would require the trustees, the governing board of a community college district, and an independent institution of higher education, and request the regents, (1) to notify to faculty, staff, and students if their personal information is shared with the United States Department of Educations Office for Civil Rights when the request for personal information is made as part of an investigative, compliance, or enforcement action, and (2) to only share personal information of faculty, staff, and students with the United States Department of Educations Office for Civil Rights if that sharing of personal information is required by federal or state law. The bill would require the notification to describe the specific types of personal information shared. By imposing new duties on community college districts, the bill would impose a state-mandated local program. The bill would make its provisions severable.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

SENATE COMMITTEE ON

Senator Sabrina Cervantes, Chair

2025 - 2026 Regular Session

SB 1101 (Pérez) - Postsecondary education: sharing personal information: notice

Bill Summary:

This bill requires the California State University (CSU), community college districts, and independent institutions of higher education, and requests the University of California (UC), to notify faculty, staff, and students if their personal information is shared with the U.S. Department of Education’s Office for Civil Rights (OCR) under specified circumstances.

Fiscal Impact:

• The CSU estimates ongoing General Fund costs of $1.7 million to $3.3 million to comply with the bill’s notification and compliance requirements across the system. This estimate assumes that each of CSU’s 22 campuses would require between 0.5 to 1.0 full-time equivalent (FTE) staff to manage the additional administrative workload, notification, tracking, and compliance activities. The CSU indicates it may incur additional, ongoing costs related to training and onboarding for compliance staff, development or modification of tracking systems, and coordination across campuses and the Chancellor’s office.
• The Chancellor’s Office estimates one-time Proposition 98 General Fund costs of between $16,000 and $24,000 per community college district, or $1.2 million to $1.7 million statewide, to develop and update the necessary policies, training, and technology systems to ensure all students, faculty, and staff are notified when their personal information is shared with the OCR.
• The UC estimates ongoing General Fund costs of $750,000 to $1.5 million systemwide to implement the bill’s requirements. This estimate assumes that each campus would need 0.5 to 1.0 FTEs. Additionally, the UC indicates that the bill’s broad definition of personal information would likely result in any production including names or other personally identifiable information requiring notice to individuals.

Background:

Federal law establishes the Federal Family Educational Rights and Privacy Act (FERPA) which sets requirements for the privacy of student education records and generally prohibits disclosure without student consent, except under specified circumstances, including compliance with a lawfully issued subpoena or in response to certain federal audits or evaluations. FERPA also requires institutions to notify students of a subpoena prior to compliance, unless otherwise directed.

Existing law establishes the California Consumer Privacy Act (CCPA) which grants California residents rights regarding the collection, use, and disclosure of personal information by businesses, including the right to know what information is collected and how it is shared. For purposes of the CCPA, “personal information” is defined to include information that identifies, relates to, or could reasonably be linked with a particular consumer or household and includes, but is not limited to, specific categories of information.

Proposed Law:

This bill requires the CSU Trustees, the governing board of a community college district, and an independent institution of higher education that is a Cal Grant qualifying institution and requests the UC Regents, to notify faculty, staff, and students if their personal information is shared with OCR when the request for personal information is made as part of an investigative, compliance, or enforcement action.

This bill provides that when requests for personal information are made by subpoena, the notification shall be made as soon as reasonably practicable before complying with the subpoena.

This bill requires that the notification include a description of the specific types of personal information shared, including, but not limited to, telephone numbers, email addresses, and physical addresses. It also limits the sharing of personal information with the OCR to that which is required by federal and state law.

This bill defines “personal information” to have the same meaning as defined in the CCPA. Additionally, the bill provides that its provisions are severable, as specified.

Staff Comments:

The OCR is responsible for enforcing federal civil rights laws in education, specifically laws that prohibit discrimination in programs or activities that receive federal assistance from the U.S. Department of Education. The OCR often requests access to institutional data to investigate and resolve allegations of discrimination. Recent requests for information from federal agencies have raised questions regarding whether institutions notify individuals when their personal information is shared in compliance with federal requests. This bill is intended to ensure that students, faculty, and staff are informed when their data is shared with OCR in an effort to support greater transparency regarding data-sharing practices.

According to the author, “The U.S. Department of Education’s Office for Civil Rights (OCR) enforces federal civil rights laws in education and may request personal information about students, faculty, and staff during investigations. Recent federal inquiries have raised concerns about transparency in how universities disclose such information, especially as the nature of investigations has shifted. While OCR investigations were once prompted by complaints from students or families alleging discrimination, the federal government is increasingly launching “directed investigations” without a formal complaint. These inquiries have focused on issues such as transgender athletes, gender neutral bathrooms, and initiatives viewed as discriminatory toward white students. They also include investigations, such as the California State University system’s association with a project that promotes diversity amongst students and broader allegations of antisemitism, including at University of California campuses. In several cases, federal authorities have issued subpoenas seeking employee information, including personal contact details which have prompted privacy concerns among faculty and students. SB 1101 establishes a clear transparency framework governing how institutions share personal information with OCR. It requires public higher education institutions, and requests the University of California, to notify individuals when their personal information is disclosed, including advance notice when responding to subpoenas, specifies the categories of information shared, and limits disclosure to circumstances required by law.”

-- END --

SENATE PRIVACY, DIGITAL TECHNOLOGIES, AND CONSUMER PROTECTION COMMITTEE

Senator Christopher Cabaldon, Chair

2025-2026 Regular Session

Bill No: SB 1101 (Author:Pérez)

Version: February 13, 2026

Hearing Date: April 20, 2026

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Postsecondary education: sharing personal information: notice

DIGEST

This bill requires the Trustees of the California State University (CSU), the governing board of a community college district, and other specified educational institutions, and requests the Regents of the University of California (UC), to notify faculty, staff, and students if their personal information is shared with the United States Department of Education’s Office for Civil Rights (OCR) when the request for personal information is made as part of an investigative, compliance, or enforcement action.

EXECUTIVE SUMMARY

The U.S. Department of Education (DOE) has been dramatically downsized under the current federal administration. This includes its Office for Civil Rights. Historically, OCR investigations were primarily started by complaints from students and families alleging discrimination. However, more recent investigations have arguably taken a more political tone. For instance, the DOE initiated an “End DEI” portal for parents, students, and teachers to submit reports of discrimination based on race or sex. Investigations have increasingly targeted efforts by schools to be more inclusive of transgender students. Recent incidents where California institutions of higher education have turned over the personal information of students and faculty to the federal government have caused concern and spurred lawsuits.

This bill requires specified educational institutions to notify faculty, staff, and students when their personal information is shared with OCR, as specified. Such sharing is limited by the bill to only that required by federal or state law. This bill is sponsored by the California Faculty Association and the UC Student Association. It is supported by various labor groups, including the American Federation of State, County, and Municipal Employees, AFL-CIO. No timely opposition was received by the Committee. This bill passed out of the Senate Education Committee on a 5 to 0 vote.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes, under the California Constitution, the University of California (UC) as a public trust to be administered by the Regents of the UC with full powers of organization and government, subject only to such legislative control as may be necessary to insure the security of its funds and compliance with the terms of the endowments of the university, and such competitive bidding procedures as may be made applicable to the university for construction contracts, selling real property, and purchasing materials, goods, and services. (Cal. Const. art. IX, § 9.)
2. Provides that statutes related to the UC, and most other aspects of the governance and operation of the UC are applicable only to the extent that the Regents of the UC make such provisions applicable. (Ed. Code § 67400.)
3. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
4. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)

This bill:

1. Requires the CSU Trustees, the governing board of a community college district, and an independent institution of higher education that is a Cal Grant qualifying institution, and requests the UC Regents, to notify faculty, staff, and students if their personal information is shared with OCR when the request for personal information is made as part of an investigative, compliance, or enforcement action.
2. Requires that when requests for personal information are made by subpoena, the notification be made as soon as reasonably practicable before complying with the subpoena.
3. Requires that the notification include a description of the specific types of personal information shared, including telephone numbers, email addresses, and physical addresses.
4. Limits the sharing of personal information with OCR to that which is required by federal or state law.
5. Provides that “personal information” has the same meaning as defined in the CCPA.
6. Includes a severability clause.

COMMENTS

1. Federal government data collection and the power of the states

Given the increasingly hostile federal administration to many of California’s stated values, the Legislature has passed a number of laws related to limiting the sharing of information with federal officials. In the immigration context, one of the first measures was AB 450 (Chiu, Ch. 492, Stats. 2017), which prohibited an employer from providing voluntary consent to an immigration officer to enter a non-public area of the workplace without being provided a judicial warrant. AB 450 also prohibited an employer from providing immigration officers voluntary consent to access, review, or obtain an employer’s employee records without a subpoena or judicial warrant, except in the context of a valid request to review I-9 employment eligibility verification forms and related records.

The same year that AB 450 was passed, the Legislature also passed the California Values Act (SB 54, De León, Ch. 495, Stats. 2017). SB 54 limited local law enforcement agencies’ sharing of inmate information with federal immigration agencies, and prohibited law enforcement agencies from using their resources for immigration enforcement or from cooperating in immigration enforcement activities.

In his second term, President Trump has utilized various federal agencies to collect information on Californians for various purposes. For instance, reports show that one new target of the federal government has been social media platforms:

The Department of Homeland Security is expanding its efforts to identify Americans who oppose Immigration and Customs Enforcement by sending tech companies legal requests for the names, email addresses, telephone numbers and other identifying data behind social media accounts that track or criticize the agency.

In recent months, Google, Reddit, Discord and Meta, which owns Facebook and Instagram, have received hundreds of administrative subpoenas from the Department of Homeland Security, according to four government officials and tech employees privy to the requests. They spoke on the condition of anonymity because they were not authorized to speak publicly.

Google, Meta and Reddit complied with some of the requests, the government officials said. In the subpoenas, the department asked the companies for identifying details of accounts that do not have a real person’s name attached and that have criticized ICE or pointed to the locations of ICE agents. The New York Times saw two subpoenas that were sent to Meta over the last six months.…

In September, for example, it sent Meta administrative subpoenas to identify the people behind Instagram accounts that posted about ICE raids in California, according to the A.C.L.U. The subpoenas were challenged in court, and the Department of Homeland Security withdrew the requests for information before a judge could rule.^[1]

The United States DOJ has engaged in a wide-ranging effort to extract state voter rolls:

[T]he Justice Department has demanded that nearly every state and Washington, DC, hand over election-related records and data, such as full copies of statewide voter registration lists and ballots from previous elections, as well as access to voting equipment. The federal government has sued 30 states and Washington, DC, for not complying.

The requests cover sensitive, private information such as driver’s license numbers and partial Social Security numbers. Its collection by the federal government raises serious privacy and security concerns and may violate state and federal laws.^[2]

One new target for the federal government has been California’s institutions of higher education. For example, the Equal Employment Opportunity Commission (EEOC) has been seeking the personal information of students, faculty and staff at a number of CSU schools:

Some California State University faculty members say they are worried about employee privacy protections and academic free speech after learning that the Trump administration is investigating alleged antisemitism across the 22-campus system.

CSU Chancellor Mildred García late last week alerted university employees that the federal Equal Employment Opportunity Commission (EEOC) had opened an investigation into the CSU and “has begun direct outreach to some faculty and staff members across the system to review allegations of antisemitism and to speak with them about their experiences on campus.”

The chancellor’s email came a day after a California State University, Los Angeles administrator separately notified faculty and staff that the EEOC had issued a subpoena requiring that campus to “produce personal phone numbers and email addresses for all employees.” The email, circulated on social media by a faculty group, followed a previous notification in August alerting employees that the university had provided the EEOC with “publicly available university contact information” in response to an EEOC request.^[3]

The UC system has also been requested to share information with federal agencies, causing concern among students and faculty:

UC Berkeley faced continued backlash Tuesday for its decision to disclose the names of 160 students, faculty and staff to Trump administration officials as part of an investigation into allegations the school fostered an atmosphere of antisemitism.

The disclosure of the names comes as the federal government continues to wage a campaign to upend elite institutions of higher education that it launched in the wake of campus protests over Israel’s war against Hamas. Among the schools in its crosshairs are UC campuses at Berkeley, San Francisco and Los Angeles. At UCLA, Trump officials have withheld more than $580 million in research funds and offered to release the money if the school pays $1 billion.…

In a statement, a UC Berkeley spokesperson said the university was directed by Milliken’s office to provide documents in response to the U.S. Department of Education’s Office of Civil Rights demand for records as part of its inquiry into how the university “handles complaints involving alleged incidents of antisemitism and/or discrimination.”

The documents were sent over a period of multiple months and people whose names were included were notified earlier this month. The spokesperson said the decision to alert the people was based on guidance from the school’s academic senate and “concerns from students that individuals be notified if their information is related to the federal government.”

Judith Butler, a professor in the Comparative Literature and Critical Theory department who said they were notified by Berkeley that their name was included in documents sent to Washington, raised the notion that other UC schools had done the same, but had not alerted people.^[4]

Six hundred university professors from around the world who have worked with faculty at UC institutions, and particularly UC Berkeley, signed onto an open letter deriding the handling of the matter:

We are aware that the University has an obligation to comply with federal investigations. However, we believe that universities also have obligations to their faculty and students, who undeniably have both academic and political rights. Indeed, to preserve their institutional autonomy, some University presidents in the US have refused to comply with federal demands that they consider illegitimate.

A spokesperson for the university is quoted saying: “We are committed to transparency.” However, transparency should work both ways. Whatever reason UC Berkeley might have for acquiescing in federal investigations instead of refusing to comply, it goes against the principle of transparency to notify people that their names have been forwarded to the administration without communicating the content and nature of the allegations to the persons thus exposed. This looks like a one-way mirror. One consequence is that the people thus denounced have not had a chance to dispute the information the university has collected.

Universities have a duty to fight for academic freedom. Of course, today, they are under attack. But this is precisely the moment when the defense of academic freedom is most necessary.

We have always admired those who, at Berkeley and elsewhere, fight for this fundamental liberty – not just free speech, but academic freedom. This is an essential value in democratic societies, all the more so when it is under threat.^[5]

1. Protecting the privacy of California’s higher education institutions

According to the author:

The U.S. Department of Education’s Office for Civil Rights (OCR) enforces federal civil rights laws in education and may request personal information about students, faculty, and staff during investigations. Recent federal inquiries have raised concerns about transparency in how universities disclose such information, especially as the nature of investigations has shifted. While OCR investigations were once prompted by complaints from students or families alleging discrimination, the federal government is increasingly launching “directed investigations” without a formal complaint. These inquiries have focused on issues such as transgender athletes, gender neutral bathrooms, and initiatives viewed as discriminatory toward white students. They also include investigations, such as the California State University system’s association with a project that promotes diversity amongst students and broader allegations of antisemitism, including at University of California campuses. In several cases, federal authorities have issued subpoenas seeking employee information, including personal contact details, which have prompted privacy concerns among faculty and students.

SB 1101 establishes a clear transparency framework governing how institutions share personal information with OCR. It requires public higher education institutions, and requests the University of California, to notify individuals when their personal information is disclosed, including advance notice when responding to subpoenas, specifies the categories of information shared, and limits disclosure to circumstances required by law.

This bill requires the stated educational institutions, and requests the UC system, to provide notice to any faculty, staff, or students if their personal information is shared with OCR when the request is made as part of an investigative, compliance, or enforcement action. If the requests are made by subpoena, notification must be made as soon as reasonably practicable before complying with the subpoena. The notification must include a description of the specific types of information shared. The schools are limited to sharing only that personal information that is required by federal or state law.

1. Stakeholder positions

The University of California Student Association, a co-sponsor of the bill, writes:

As part of these investigations, federal authorities have issued requests, including subpoenas, seeking employee information such as personal phone numbers and email addresses, as well as student and staff records. These requests quickly raised concerns about privacy and institutional transparency, prompting our students, faculty and staff impacted and civil rights groups wary of the federal administration using this information to pursue their right-wing agenda to argue that individuals should be notified when their personal information is shared with federal authorities.…

UC students and students across the state and country are the future of our workforce, society and democracy, and as advances in technology rapidly increase, SB 1101 takes significant steps towards ensuring that institutions are held accountable to how our information is being used and who is notified when that information is being shared.

Writing in support, the California State University Employees Union argues:

With the federal administration weaponizing the complaint processes at college campuses to pressure them into implementing more conservative, less inclusive policies, it is more crucial than ever to protect the privacy and rights of students and employees. Our members are dedicated to the success of all students, and maintaining accessible, diverse campuses with equitable policies is critical to that goal. SB 1101 creates a transparency framework with reasonable guardrails that will help protect students and employees and allow our universities to thrive.

SUPPORT

California Faculty Association (co-sponsor)

University of California Student Association (co-sponsor)
American Federation of State, County and Municipal Employees, AFL-CIO

California State University Employees Union (CSUEU)

CFT – a Union of Educators & Classified Professionals, AFT, AFL-CIO

Oakland Privacy

OPPOSITION

None received

RELATED LEGISLATION

SB 957 (Pérez, 2026) places requirements and restrictions on social media companies with respect to their handling of administrative subpoenas issued pursuant to the Immigration and Nationality Act. SB 957 requires social media platforms to provide notice to users whose information is being requested by such subpoenas. SB 957 is currently in the Senate Judiciary Committee.

AB 1542 (Ward, 2026) prohibits, pursuant to the CCPA, a business, service provider, or contractor from selling or sharing the sensitive personal information of a consumer to a third party. AB 1542 is currently in the Assembly Privacy and Consumer Protection Committee.

SB 54 (De León, Ch. 495, Stats. 2017) limited local law enforcement agencies’ sharing of inmate information with federal immigration agencies, and prohibited law enforcement agencies from using their resources for immigration enforcement or from cooperating in immigration enforcement activities. In addition, SB 54 required the Attorney General to publish various model policies regarding local entities’ involvement or cooperation with immigration enforcement.

AB 450 (Chiu, Ch. 492, Stats. 2017) prohibited an employer from providing voluntary consent to an immigration officer to enter a non-public area of the workplace without being provided a judicial warrant. AB 450 also prohibited an employer from providing immigration officers voluntary consent to access, review, or obtain an employer’s employee records without a subpoena or judicial warrant, except for in the context of a valid request to review I-9 employment eligibility verification forms and related records.

PRIOR VOTES:

Senate Education Committee (Ayes 5, Noes 0)

**************

1. Sheera Frenkel & Mike Isaac, Homeland Security Wants Social Media Sites to Expose Anti-ICE Accounts (February 13, 2026) The New York Times, https://www.nytimes.com/2026/02/13/technology/dhs-anti-ice-social-media.html. All internet citations are current as of April 9, 2026. ↑

2. Kaylie Martinez-Ochoa, Eileen O’Connor, & Patrick Berry, Tracker of Justice Department Requests for Voter Information (April 9, 2026) Brennan Center for Justice, https://www.brennancenter.org/our-work/research-reports/tracker-justice-department-requests-voter-information. ↑

3. Amy Dipierro, Faculty react anxiously to Trump administration antisemitism probe at CSU (September 30, 2025) EdSource, https://edsource.org/2025/faculty-react-anxiously-to-trump-administration-antisemitism-probe-at-csu/741769?amp=1. ↑

4. Eric He, UC takes heat for sharing student, faculty names with Trump administration (September 16, 2025) Politico, https://www.politico.com/news/2025/09/16/uc-faces-criticism-over-sharing-student-faculty-names-to-trump-administration-00567895. ↑

5. Open letter to James Milliken and Richard Lyons, https://www.politico.com/f/?id=00000199-5507-dc77-afbb-df8fad430001. ↑

SENATE COMMITTEE ON EDUCATION

Senator Sasha Renée Pérez, Chair

2025 - 2026 Regular

Bill No: Hearing Date: April 8, 2026

Subject: .

NOTE: This bill has been referred to the Committees on Education and Privacy, Digital Technologies, and Consumer Protection. A “do pass” motion should include referral to the Committee on Privacy, Digital Technologies, and Consumer Protection.

SUMMARY

This bill requires the California State University (CSU) Trustees, the governing board of a community college district (CCD), and a qualifying independent institution of higher education and requests the University of California (UC) Regents to notify faculty, staff, and students if their personal information, as defined, is shared with the U.S. Department of Education’s Office for Civil Rights (OCR) under the specified circumstances. It further limits the sharing of personal information of faculty, staff, and students with OCR to that which is required by federal and state law.

BACKGROUND

Existing law:

1. Establishes the UC as a public trust to be administered by the Regents and grants the Regents full powers of organization and governance subject only to legislative control as necessary to ensure the security of funds, compliance with terms of its endowments, and the statutory requirements around competitive bidding and contracts, sales of property, and the purchase of materials, goods, and services. (Article IX, Section 9(a) of the California Constitution)

2) Stipulates that no provision of the Donahue Higher Education Act shall apply to

the UC unless the UC Regents adopts the provision. (Education Code (EC) § 67400)

3) Establishes the CSU system, made of 22 campuses, and bestows upon the CSU Trustees, through the Board of Trustees, the power, duties, and functions with respect to the management, administration, and control of the CSU system. (EC §§ 66606 and 89030 et seq.)

4) Establishes the California Community Colleges (CCC) under the administration of the Board of Governors of the CCC as one of the segments of public postsecondary education in this state. The CCC shall be comprised of community college districts. (EC § 70900)

5) Defines “qualifying institution,” for purposes of the Cal Grant program, as a California institution that meets specified requirements, including accreditation, participation in federal financial aid programs, and satisfies cohort default and graduation rate requirements. An independent institution of higher education qualifies only if it satisfies these requirements. (EC § 69432.7 (l)(1))

6) Under federal law, establishes the Federal Family Educational Rights and Privacy Act (FERPA), which sets requirements for the privacy of student education records and generally prohibits disclosure without student consent, except under specified circumstances, including compliance with a lawfully issued subpoena or in response to certain federal audits or evaluations. FERPA also requires institutions to notify students of a subpoena prior to compliance, unless otherwise directed. (20 United States Code § 1232(g); Title 34 of the Code of Federal Regulations, Part 99)

7) Under the California Consumer Privacy Act (CCPA), grants California residents rights regarding the collection, use, and disclosure of personal information by businesses, including the right to know what information is collected and how it is shared. For purposes of the CCPA, “personal information” is defined to include information that identifies, relates to, or could reasonably be linked with a particular consumer or household and includes, but is not limited to, specific categories of information. (Civil Code Section 1798.140 (v))

ANALYSIS

This bill:

1. Requires, the CSU Trustees, the governing board of a community college district, and an independent institution of higher education that is a Cal Grant qualifying institution and requests the UC Regents to notify faculty, staff, and students if their personal information is shared with OCR when the request for personal information is made as part of an investigative, compliance, or enforcement action.
2. Requires that when requests for personal information are made by subpoena, the notification be made as soon as reasonably practicable before complying with the subpoena.
3. Requires that the notification include a description of the specific types of personal information shared, including, but not limited to, telephone numbers, email addresses, and physical addresses.
4. Limits the sharing of personal information with the OCR to that which is required by federal and state law.
5. Defines, for purposes of this bill, “personal information,” to have the same meaning as defined in the CCPA.
6. Provides that the provisions of this bill are severable, as specified.

STAFF COMMENTS

1. Need for the bill. According to the author, “The U.S. Department of Education’s Office for Civil Rights (OCR) enforces federal civil rights laws in education and may request personal information about students, faculty, and staff during investigations. Recent federal inquiries have raised concerns about transparency in how universities disclose such information, especially as the nature of investigations has shifted. While OCR investigations were once prompted by complaints from students or families alleging discrimination, the federal government is increasingly launching “directed investigations” without a formal complaint. These inquiries have focused on issues such as transgender athletes, gender neutral bathrooms, and initiatives viewed as discriminatory toward white students. They also include investigations, such as the California State University system’s association with a project that promotes diversity amongst students and broader allegations of antisemitism, including at University of California campuses. In several cases, federal authorities have issued subpoenas seeking employee information, including personal contact details which have prompted privacy concerns among faculty and students.

“SB 1101 establishes a clear transparency framework governing how institutions share personal information with OCR. It requires public higher education institutions, and requests the University of California, to notify individuals when their personal information is disclosed, including advance notice when responding to subpoenas, specifies the categories of information shared, and limits disclosure to circumstances required by law.”

1. Information sharing in federal civil rights investigations. This bill applies to requests made by OCR. The office is charged with enforcing federal civil rights laws in education, specifically laws that prohibit discrimination in programs or activities that receive federal assistance from the U.S. Department of Education. OCR often requests access to institutional data to investigate and resolve allegations of discrimination.

As mentioned in the author’s statement, recent requests for information from federal agencies have raised questions regarding whether, and under what circumstances, institutions notify individuals when their personal information is shared in compliance with federal requests. According to the California Faculty Association, the sponsors of the bill, last year, in response to a federal subpoena, CSU shared the personal phone numbers and email addresses of 2,600 Los Angeles campus employees with the Equal Employment Opportunity Commission. In addition, a recent (October 2025) UC statement reports that, in response to an investigation by the OCR, UC Berkeley provided unredacted records after determining it was legally required to do so under federal law. The files included names and, in some instances, contact details of complainants, respondents, and witnesses. Another example of the types of recent investigations initiated by OCR include an investigation into San Jose State University for suspected Title IX violation related to a transgender student athlete participation on the women’s volleyball team. Staff notes that OCR affirmed the violation and issued a proposed resolution agreement which CSU declined to enter into as it disagreed with OCR’s legal position.

This bill seeks to ensure students, faculty, and staff are informed when their data is shared with OCR, to support greater transparency regarding data-sharing practices. Moving forward, the author may wish to consider whether it is necessary to clarify how notification requirements are applied when confidentiality in OCR investigations is warranted.

1. Limits data sharing. This measure defines personal information to have the same meaning as defined by the CCPA, which establishes a broad definition of information that identifies, relates to, or could reasonably be linked to an individual. OCR may request various types of information while conducting an investigation or compliance review, including information related to students, employees, and other institutional data. These requests may not always take the form of a subpoena but can also be informal requests. Under FERPA, the primary federal law governing the privacy of student education records, generally permits but does not require institutions to share certain student information without consent with federal agencies for enforcement purposes. This bill further limits how information can be shared by restricting disclosure of personal information with OCR to only what is required by state or federal law.
2. Notification to impacted individuals. In addition to providing notice when information is shared, this bill requires providing notice as soon as practicable before complying with a subpoena. Notifications must include a description of the specific types of personal information shared as part of the request. Institutions may need to develop a method to identify impacted individuals and provide notification as prescribed in the bill.

SUPPORT

California Faculty Association (sponsor)

American Federation of State, County and Municipal Employees, AFL-CIO

California School Employees Association

California State University Employees Union

Oakland Privacy

Teamsters California

University of California Student Association

One Individual

OPPOSITION

None received

-- END --