Law / United States / 
Massachusetts
Student Records regulations of the Board of Education: privacy, security and third-party access to student records
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Security, Consent, Governance, Retention, Data subject rights, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- If you are a public school, make the principal responsible for the privacy and security of all student records maintained in the school, and make the superintendent of schools responsible for student records not under a principal's supervision (603 CMR 23.05(1) and (2)).
- Keep student records physically secure, inform authorized school personnel of 603 CMR 23.00 and of M.G.L. c. 71, section 34H, educate them on the importance of information privacy and confidentiality, and ensure that any computerized system you employ is electronically secure (603 CMR 23.05(3)).
- Do not give a third party access to information in or from a student record without the specific, informed written consent of the eligible student or the parent, except as 603 CMR 23.07(4)(a) through (h) allows, and place a duplicate of each consent in the temporary record (603 CMR 23.07(4)).
- Release personally identifiable information from a student record to a third party only on the condition that the third party will not permit any other third party to have access without the written consent of the eligible student or parent, except for directory information (603 CMR 23.07(4)).
- Keep a log as part of each student's record of every person who obtained access, with the name, position and signature of the person releasing the information, the recipient and any affiliation, the date, the parts of the record reached and the purpose (603 CMR 23.07(1)).
- Limit the information added to a student record to information relevant to the educational needs of the student, and record with each entry in the temporary record the name, signature and position of its source and the date of entry (603 CMR 23.03).
- Destroy a student's temporary record no later than seven years after the student transfers, graduates or withdraws, give the eligible student and the parent written notice of the approximate date of destruction at that time, and keep the transcript for 60 years after graduation, transfer or withdrawal (603 CMR 23.06(1) and (3)).
- Give personnel of a service provider who work directly with a student under an agreement with the school committee, and data-processing or clerical staff employed under a school committee service contract, access only to the student record information they need to perform their duties (603 CMR 23.02, definition of authorized school personnel, paragraphs (a) and (b)).
- Give the eligible student or the parent access to the entire student record, wherever its parts are kept, as soon as practicable and within ten days after the initial request, and furnish copies on request for a fee no greater than the cost of reproduction (603 CMR 23.07(2)).
- Let the eligible student or the parent add information to the student record and request in writing the deletion or amendment of information in it, and have the principal render a written decision within one week after the conference or the receipt of the objection (603 CMR 23.08).
- Release directory information without consent only after giving public notice of the types of information you may release and a reasonable time for eligible students and parents to ask that it not be released (603 CMR 23.07(4)(a)).
- If you are a federal, state or local education official, or an authorized agent of one, with access to student records for the audit, evaluation or enforcement of education laws or programs, protect the data so that no one else can personally identify the students and their parents, and destroy personally identifiable data when it is no longer needed for that purpose, unless a law specifically authorizes collecting it (603 CMR 23.07(4)(d)).
- Delete the electronic and postal addresses and telephone numbers of the custodial parent's work and home from student records provided to a non-custodial parent, and mark those records as not to be used to enroll the student in another school (603 CMR 23.07(5)(e)).
- Remove the score of any group intelligence test from a student's record at the end of the school year in which the test was administered (603 CMR 23.06(4)).
- At least once every school year, publish and distribute to students and parents, in their primary language, a routine information letter on the standardized testing programs and research studies planned, the other routine information to be collected from students, and their rights under 603 CMR 23.00 (603 CMR 23.10(1)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Massachusetts Department of Elementary and Secondary Education, which may review compliance on a request or on its own initiative
What record it asks for
What the log must hold
Actor identity, Event time, Access record
Logging duty
Each student's record carries a log of every person who obtained access, with the date, the parts of the record reached and the purpose. The log is not required for inspection by authorized school personnel, for administrative office staff who add information or obtain access, or for school nurses inspecting the health record, unless information is to be deleted or released.
- Kind
- Explicit
- As of
- Provision
- 603 CMR 23.07(1)
- Trigger
- personal_data_processing
What this law does
The Board of Education's Student Records regulations govern the maintenance of student records by the public elementary and secondary schools of the Commonwealth. Under 603 CMR 23.05 the school principal is responsible for the privacy and security of all student records maintained in the school, and the superintendent of schools is responsible for the student records that are not under a principal's supervision.
The principal and superintendent must ensure that student records are kept physically secure and that any computerized systems employed are electronically secure. No third party may have access to information in or from a student record without the specific, informed written consent of the eligible student or the parent, subject to the exceptions in 603 CMR 23.07(4).
Personally identifiable information from a student record may be released to a third party only on the condition that the third party will not permit any other third party to have access without the written consent of the eligible student or parent, except for directory information. A log must be kept as part of each student's record showing every person who obtained access, the date, the parts of the record reached and the purpose of the access.
Personnel of a service provider who work directly with a student under an agreement with the school committee, and data-processing and clerical staff employed under a school committee service contract, are authorized school personnel with access only to the student record information required to perform their duties. The eligible student or the parent must be given access to the student record as soon as practicable and within ten days after the initial request.
The rights under 603 CMR 23.00 belong to the parent until the student reaches 14 years of age or enters the ninth grade, whichever comes first. The regulations were most recently amended by the Board of Education on , when it revised the definition of transcript in 603 CMR 23.02: the transcript's test data are no longer tied to the competency determination, and it now also carries any seal or award endorsed by the Department of Elementary and Secondary Education.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .