Note:  Combined with SB 89 LC 33 6152S 

SUMMARY:  LC 33  5959  LC 33 6110ERS  The "Student Data Privacy, Accessibility, and Transparency Act."  Requires the establishment and implementation  of policies and requirements with respect to the collection and disclosure of student data to ensure that student data are safeguarded and students' and parents' privacy is honored, respected, and protected.

REQUIREMENTS:

• The State Superintendent shall designate a Department of Education employee to serve as the chief information officer of the department to assume primary responsibility for data privacy and security policy. The employee shall:
  • establish department policies to assure the use of technologies does not erode privacy protections related to student data
  • ensure student data are handled in full compliance with all state and federal privacy laws
  • conduct a privacy impact statement on legislative proposals and initiatives of the department
  • ensure that state programs, policies, and procedures related to privacy are addressed
  • establish and operate within the department a Privacy Incident Response Program to respond to incidents
  • develop a complaints procedure
  • provide training to state and local education
  • entities on privacy protection
  • investigate issues of privacy compliance by the department and local boards of education and have the power to:
    • access all records and other materials available to the department related to student data
    • make investigations related to compliance 
• The Department of Education shall:
  • create and make available a data inventory of data elements with definitions of student personally identifiable data fields
  • develop and make available policies and procedures for the state data system to comply with all state and federal laws -- to include restrictions on granting access to student data in the state data system except to: 
    • students and parents
    • authorized school personnel and contractors working on their behalf
    • authorized Department of Education staff and contractors working on their behalf 
  • develop prohibitions against publishing student data other than aggregate data or personally unidentifiable data in public reports  
  • establish criteria for the approval of research and data requests
  • The Department is prohibited from the transfer of student personally identifiable data with certain exceptions: example - students transferring to another school or enrolling in a post secondary institution; federal agency requests; parental requests for such data
  • The Department shall develop a detailed data security plan for the state data system and develop guidance for local boards to implement effective security practices that are consistent with the state plan
  • The Department will make annual reports to the Governor and General Assembly which includes seeking approval before implementing new student data collections and announce to the public for feedback before implementing such collections
  • The Department will make annual notifications to students and parents regarding privacy rights; assist local boards with ensuring security when providing student data to parents and that such data are issued to authorized individuals; assist local boards with implementing technologies related to parental inspection/transmission of student data; develop complaint procedures when parents feel local boards have violated their rights related to data privacy
•  Local boards of education are not to report to the Department of Education the following student data:
  • juvenile delinquency or criminal records
  • medical and health records
  • political affiliation
  • voting history
  • income (unless related to assistance to low-income families)
  • religious affiliation or beliefs
• Entities that provide online or mobile services that is designed or marketed for K-12 school purposes (defined as 'operators') may not (with listed exceptions):
  • use student data to target advertising on the operator's site
  • use data to amass a profile about a student
  • sell or disclose a student's data
• Parents may inspect a child's education record; request student data included in such record and be provided an electronic copy; request corrections in the record 

EFFECTIVE DATE:  July 1, 2016 if approved by the General Assembly and Governor, unless in conflict with current contracts entered into by a state agency or local board of education; in such case upon expiration  of such contracts.