Law / United States / 
Arizona
Student level data: Department of Education confidentiality, data security plan, disclosure agreements and education database
A.R.S. secs. 15-1042, 15-1043 and 15-1045
In force.
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Security, Retention
- Audit expectation
- none
What it requires
- If you are the Department of Education, keep all student level data collected from school districts, career technical education districts and charter schools confidential and out of the public record; student level data does not include data elements on student behavior, discipline, criminal history, medical history, religious affiliation, personal physical descriptors or family information that the parent or guardian has not authorized or the law does not require (A.R.S. 15-1042(I) and (J)).
- Develop, publish and make publicly available policies and procedures to comply with the Family Educational Rights and Privacy Act, including a detailed data security plan covering access authorization, privacy compliance standards, privacy and security audits, security breach planning, notice and procedures, data retention and disposition policies, guidance, consequences for breaches and staff training (A.R.S. 15-1043(D)(1)).
- Ensure that each written agreement for disclosure of student level data meets the Family Educational Rights and Privacy Act's conditions for exceptions to written parental consent, specifies the purpose, scope and duration of the disclosure and the information disclosed, limits use and access to the stated purpose and to representatives with legitimate interests, and requires the organization to destroy all personally identifiable information when it is no longer needed and to specify the time period (A.R.S. 15-1043(D)(2)).
- Maintain the education database so that its use is limited to statutory obligations, personally identifiable information is confidential and not public record, proper security measures protect confidentiality and integrity, and data is secured from breaches and identity theft (A.R.S. 15-1045(B)).
- Use a unique pupil identifier in the education database that is not the pupil's social security number or any variation of it (A.R.S. 15-1045(C)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The Department of Education's data security plan includes privacy and security audits, but sections 15-1042, 15-1043 and 15-1045 name no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
All student level data the Department of Education collects from school districts, career technical education districts and charter schools under section 15-1042 is confidential and is not a public record. Student level data does not include data elements related to student behavior, discipline, criminal history, medical history, religious affiliation, personal physical descriptors or family information not authorized by the parent or guardian of the pupil or otherwise required by law.
The Department of Education must develop, publish and make publicly available policies and procedures to comply with the Family Educational Rights and Privacy Act, containing a detailed data security plan that covers privacy compliance standards, privacy and security audits, security breach planning, notice and procedures, and staff training.
Written agreements involving the disclosure of student level data must require the organization to destroy all personally identifiable information when it is no longer needed for the purposes of the disclosure, and to specify the time period in which it must be destroyed. The Department of Education must maintain its education database so that personally identifiable information is confidential and is not public record and so that data is secured from breaches and identity theft. The pupil identifier in the education database may not be the pupil's social security number or any variation of it.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .