Law / United States / 
Kansas
Student Data Privacy Act, disclosure of student data from a statewide longitudinal student data system
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Consent, Disclosure, Retention
- Audit expectation
- none
What it requires
- If you are an educational agency, disclose student data held in a statewide longitudinal student data system only as K.S.A. 72-6314 permits (section 72-6314(a)).
- Give each student's parent or legal guardian annual written notice that student data may be disclosed, have the parent or legal guardian sign it, and keep it on file with the district (section 72-6314(a)).
- Before disclosing student data to a service provider engaged to perform a function of instruction, assessment or longitudinal reporting, enter a data-sharing agreement that states the purpose, scope and duration, requires use solely for the specified purposes, requires compliance with the data access, use and security restrictions it describes, and requires destruction of the data when no longer necessary or on expiration, to National Institute of Standards and Technology (NIST) SP 800-88 standards (section 72-6314(c)).
- Disclose personally identifiable student data to any other governmental entity, or to an audit, evaluation or research organization, only with the written consent of the adult student or the parent or legal guardian of a minor, and otherwise disclose only aggregate data (section 72-6314(d)).
- Disclose a student's directory information only when you deem it necessary and the student's parent or legal guardian has consented in writing, except to an enhancement vendor that provides photography, class ring, yearbook publishing, memorabilia or substantially similar services (section 72-6314(e)(1) and (2)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The section requires annual written notice kept on file with the district and a data-sharing agreement for service providers. It names no log of disclosures, no audit and no reader of a record, and it states no territorial clause.
- Kind
- None
- As of
What this law does
Section 72-6314(a) provides that student data submitted to and maintained by a statewide longitudinal student data system shall only be disclosed by an educational agency in accordance with that section. An educational agency must give each student's parent or legal guardian annual written notice that student data may be disclosed, and the signed notice is maintained on file with the district.
Section 72-6314(b) permits disclosure at any time to authorized personnel of an educational agency or of the state board of regents who require it to perform their assigned duties, and to the student and the student's parent or legal guardian where the data pertains solely to that student.
Section 72-6314(c) permits disclosure to a service provider engaged to perform a function of instruction, assessment or longitudinal reporting only if a data-sharing agreement states the purpose, scope and duration of the agreement.
The data-sharing agreement must require the recipient to use the student data solely for the specified purposes, to comply with the data access, use and security restrictions it describes, and to destroy the data when no longer necessary or on expiration of the agreement, whichever occurs first.
A service provider engaged to perform a function of instruction may retain student transcripts as required by applicable laws and rules and regulations, and destruction must comply with the National Institute of Standards and Technology (NIST) SP 800-88 standards of data destruction. Section 72-6314(d)(1) permits disclosure to any other governmental entity, or to a public or private audit, evaluation or research organization, only as aggregate data.
Section 72-6314(d)(2) permits disclosure of personally identifiable student data if the adult student, or the parent or legal guardian of a minor, consents in writing.
Notwithstanding subsections (b) to (d), section 72-6314(e) lets an educational agency disclose a student's directory information when it deems the disclosure necessary and the student's parent or legal guardian has consented in writing, disclose directory information to an enhancement vendor that provides photography, class ring, yearbook publishing, memorabilia or substantially similar services, disclose student data to comply with a lawful subpoena or court order, and disclose student data that a postsecondary educational institution requires for application or admission where the student consents in writing.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .