Student Data Transparency and Security Act: State Board of Education and Department of Education duties

The state board of education must create, publish, and make publicly available a data inventory and dictionary or index of data elements with definitions of individual student data fields used in the student data system. The state board must develop a detailed data security plan that includes privacy compliance standards, privacy and security audits, and security breach planning, notice, and procedures.

The state board must develop requirements that department contracts outsourced to vendors that affect databases, assessments, or instructional supports that include student personally identifiable information contain express privacy and security provisions, including that the information may be used only for the purpose specified in the contract and must be destroyed when no longer needed, a prohibition on further disclosure or commercial use outside the contract, and penalties for noncompliance that include termination of the contract.

The department must assign each student enrolled in a public school a unique student identifier that neither is nor includes the student's social security number. Unless state or federal law requires it, the department of education may not collect juvenile delinquency records, criminal records, medical and health records, student social security numbers, student biometric information, or information concerning the political affiliations or the beliefs or attitudes of students and their families.

The department may not sell, trade, gift, or monetize student personally identifiable information for commercial use or investment interests. Unless the state board approves otherwise, the department may not transfer student personally identifiable information to an agency or entity outside the state, except in the circumstances the section lists.

The department must publish and maintain on its website a list of the entities and individuals that hold student personally identifiable information under its contracts or agreements, and a copy of each contract or agreement. The department must ensure that the terms of each contract it enters into or renews with a school service contract provider require the provider, at a minimum, to comply with sections 22-16-108 to 22-16-110.

If a school service contract provider commits a material breach of a department contract that involves the misuse or unauthorized release of student personally identifiable information, the department must determine whether to terminate the contract under a state board policy that requires a public hearing.

The department may not enter into or renew a contract with a school service contract provider that refuses those terms or has substantially failed to comply with one or more of the requirements in sections 22-16-108 to 22-16-110.

Each contract or other agreement that the department enters into or renews that gives an individual or entity other than a contract provider access to or use of student personally identifiable information must require compliance with sections 22-16-109(1), (2), and (3)(b) and 22-16-110(1) and (3). The department must prepare and make available to local education providers sample contract language for use in contracting with school service contract providers.