Law / United States / 
Georgia
Student Data Privacy, Accessibility, and Transparency Act, Department of Education duties for the state data system
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Security, Reporting, Disclosure
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- Create, publish and make publicly available a data inventory and dictionary or index of data elements with definitions of the student personally identifiable data fields in the state data system (Code Section 20-2-664(1)).
- Develop, publish and make publicly available policies and procedures for the state data system that restrict access to student data to the listed authorized persons, prohibit publishing student data other than aggregate or de-identified data in public reports, and set criteria for approving research and data requests (Code Section 20-2-664(2)).
- Do not transfer student personally identifiable data to any federal, state or local agency or nongovernmental organization, unless otherwise provided by law or approved by the State Board of Education, except for disclosures incident to the actions the section lists (Code Section 20-2-664(3)).
- Develop a detailed data security plan for the state data system that covers access guidelines and authentication, privacy and security audits, plans for responding to security breaches including notifications and remediations, data retention and disposal, security training and safeguards, minimum aggregation standards, and guidance for local boards of education (Code Section 20-2-664(4)).
- Evaluate and update the data security plan at least annually to identify and address risks to the security of student personally identifiable data (Code Section 20-2-664(4)(G)).
- Notify the Governor and the General Assembly annually of new provisional student data collections, changes to existing collections, special approvals granted for release of student personally identifiable data, and the results of privacy compliance and security audits completed in the past year (Code Section 20-2-664(6)).
- Develop policies and procedures to ensure at least annual notifications to eligible students and parents or guardians regarding student privacy rights under federal and state law (Code Section 20-2-664(7)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Code Section 20-2-664 requires the department to publish a data inventory, to keep a security plan with privacy and security audits, breach response plans and retention and disposal policies, and to report audit results annually to the Governor and the General Assembly. It does not state what a log or record must contain, how long one must be kept, or who may demand one.
- Kind
- None
- As of
What this law does
The Department of Education must create, publish and make publicly available a data inventory and dictionary or index of data elements with definitions of the student personally identifiable data fields in the state data system. The department must develop, publish and make publicly available policies and procedures for the state data system to comply with the Act and other applicable state and federal data privacy and security laws, including the Family Educational Rights and Privacy Act.
Those policies must include prohibitions against publishing student data other than aggregate data or de-identified data in public reports. Unless otherwise provided by law or approved by the State Board of Education, the department may not transfer student personally identifiable data to any federal, state or local agency or nongovernmental organization, except for disclosures incident to the listed actions.
The department must develop a detailed data security plan for the state data system that includes privacy and security audits and plans for responding to security breaches, including notifications, remediations and related procedures. The security plan must include a process for evaluating and updating the plan at least on an annual basis to identify and address risks to the security of student personally identifiable data.
The department must notify the Governor and the General Assembly annually of matters relating to the state data system, including the results of any privacy compliance and security audits completed in the past year. The department must develop policies and procedures to ensure at least annual notifications to eligible students and parents or guardians regarding student privacy rights under federal and state law. The section took effect with the rest of Part I of Senate Bill 89 on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .