Law / United States / 
Delaware
Data Governance: Department of Education agreements for research, audit and evaluation uses of students' personally identifiable information
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Contract terms, Disclosure, Retention, Governance
What it requires
- If you are the Delaware Department of Education, collect and maintain data, including personally identifiable information, in compliance with your rights and obligations under federal and state laws (section 4.1).
- Provide data, including personally identifiable information, to implement the research agendas the P-20 Council establishes (section 4.2).
- When a P-20 Council research agenda requires personally identifiable information you collect and maintain, enter a written agreement in the form you prescribe (section 4.3).
- For a study for or on behalf of a school, school district or postsecondary institution, which must be for improving instruction, developing, validating or administering predictive tests, or administering student aid programs, make the written agreement specify the purpose, scope and duration of the study and the information to be disclosed, and require the organization to use personally identifiable information only for the study's purpose, limit access to it to those with legitimate interests, and destroy it on completion of the study within a period the agreement specifies (section 4.3.1).
- For an audit or evaluation of a federal or state supported education program, or to enforce or comply with federal legal requirements relating to those programs, make the written agreement designate an authorized representative, specify what personally identifiable information will be disclosed and for which purpose the Family Educational Rights and Privacy Act allows, describe the activity so that it clearly falls within an allowable purpose, require the authorized representative to destroy the information on completion within a period the agreement specifies, and include policies and procedures to protect it from further disclosure and unauthorized use (section 4.3.2).
- Make every written agreement under the regulation prohibit its modification or amendment except by a written agreement the parties duly execute (section 4.4).
These lines are LexLint's reading of the law's text.
What this law does
Regulation 294 of title 14 of the Delaware Administrative Code, the Department of Education's data governance regulation, sets the criteria and process for interagency data governance and for the conduct of evaluations, audits and studies under sections 121, 122 and 4111 of title 14 of the Delaware Code. The longitudinal data system the Department develops and administers is governed by the Delaware P-20 Council Data Governance Handbook.
The Department must collect and maintain data, including personally identifiable information, in compliance with its rights and obligations under federal and state laws, and must provide data, including personally identifiable information, to implement the research agendas the P-20 Council establishes. When a P-20 Council research agenda requires personally identifiable information the Department collects and maintains, a written agreement in the form the Department prescribes must be entered.
A study for or on behalf of a school, school district or postsecondary institution must be for improving instruction, developing, validating or administering predictive tests, or administering student aid programs, and its written agreement must specify the purpose, scope and duration of the study and the information to be disclosed, and require the organization to use personally identifiable information only for the study's purpose, limit access to it to those with legitimate interests, and destroy it on completion of the study within a period the agreement specifies.
For an audit or evaluation of a federal or state supported education program, or to enforce or comply with federal legal requirements relating to those programs, the written agreement must designate an authorized representative, specify the personally identifiable information to be disclosed and a purpose the Family Educational Rights and Privacy Act allows, describe the activity so that it clearly falls within an allowable purpose, require the authorized representative to destroy the information on completion within a period the agreement specifies, and include policies and procedures to protect it from further disclosure and unauthorized use.
Every written agreement entered under the regulation must prohibit its modification or amendment except by a written agreement the parties duly execute.
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .