Law / United States / 
Idaho
SDATAA, access limits, confidentiality and aggregate-only release of student data in the state data system
Idaho Code § 33-133(3)(b)(i) to (iii), (v), (3)(g)(i)
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Access restriction, Prohibition, Disclosure, Retention
What it requires
- If you are the State Board of Education, adopt and publish policies that restrict access to student data in the student data system to the authorized staff of the Board and the State Department of Education and their vendors who require access to perform their assigned duties, school districts and their private vendors and public postsecondary staff who require access to perform their assigned duties, students and their parents or legal guardians, and the authorized staff of other state agencies as required by law or interagency data-sharing agreements, and report a summary of those agreements to the senate and house education committees by January 15 each year (Idaho Code 33-133(3)(b)(i)).
- Include only aggregate data in public reports and in responses to record requests (Idaho Code 33-133(3)(b)(ii)).
- Keep maintained student data confidential and release only aggregate data in response to research and data requests unless the State Board of Education approves otherwise, and treat any Board approval to release personally identifiable student data as subject to legislative approval before the release (Idaho Code 33-133(3)(b)(iii)).
- Provide for notification to students and parents regarding their rights under federal and state law (Idaho Code 33-133(3)(b)(v)).
- Delete, and stop collecting, any provisional student data collection that the governor and the legislature have not approved by the end of the next legislative session (Idaho Code 33-133(3)(g)(i)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Idaho State Board of Education and State Department of Education, either of which may bring a civil enforcement action under section 33-133 of the Idaho Code.
What this law does
Section 33-133 of the Idaho Code requires the State Board of Education to adopt and publish policies under which access to student data in the student data system is restricted to the authorized staff of the Board and the State Department of Education and their vendors who require access to perform their assigned duties, school districts and their private vendors and public postsecondary staff who require access to perform their assigned duties, students and their parents or legal guardians, and the authorized staff of other state agencies as required by law or defined by interagency data-sharing agreements.
The Board must summarize all such data-sharing agreements in a report submitted no later than January 15 of each year to the senate and house of representatives education committees. Public reports and responses to record requests may include aggregate data only. Aggregate data is data collected or reported at the group, cohort or institutional level, and it does not include personally identifiable information.
Unless the Board approves otherwise, student data maintained remains confidential and student data released in response to research and data requests may include only aggregate data, and any Board approval to release personally identifiable student data is subject to legislative approval before the release. The Board's policies must also provide for notification to students and parents regarding their rights under federal and state law.
A new student data collection the Board proposes becomes a provisional requirement, and a provisional collection that the governor and the legislature have not approved by the end of the next legislative session expires and must be deleted and no longer collected.
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .