Law / United States / 
Maryland
Maryland Longitudinal Data System Center: student data privacy compliance, de-identified and aggregate data only, and the Governing Board’s inventory, security plan and vendor contract terms
Md. Code Ann., Educ. §§ 24-702(c), 24-703 and 24-704
In force.
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Security, Retention, Breach notice
- Audit expectation
- periodic
What it requires
- If you are the Maryland Longitudinal Data System Center, ensure routine and ongoing compliance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies, including the required use of de-identified data in data research and reporting, the required disposition of information that is no longer needed, data security with the capacity for audit trails, regular audits for compliance with data privacy and security standards, and guidelines that prevent the reporting of other potentially identifying data (Educ. 24-703(f)(3)).
- Restrict direct access to data in the Maryland Longitudinal Data System to authorized staff of the Center, use only de-identified data in the Center’s analysis, research and reporting, and use only aggregate data in the release of data in reports and in response to data requests (Educ. 24-703(h)(1)-(3)).
- Do not report in any form data that may be identifiable based on the size or uniqueness of the population under consideration, and do not release or sell information that may not be disclosed under the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies (Educ. 24-703(h)(4)-(5)).
- If you are the Governing Board of the Center, before any individual data is incorporated into the system create an inventory of the individual student data proposed to be maintained in it and required to be reported by State and federal education mandates, develop and implement policies to comply with the federal Family Educational Rights and Privacy Act and any other required privacy measures, and develop a detailed data security and safeguarding plan covering authorized access and authentication, privacy compliance standards, privacy and security audits, breach notification and procedures, and data retention and disposition policies (Educ. 24-704(g)(6)).
- Ensure that any contract governing a database outsourced to a private vendor includes express provisions that safeguard privacy and security and include penalties for noncompliance (Educ. 24-704(g)(8)).
- Do not keep student data and workforce data linked in the Maryland Longitudinal Data System for longer than 20 years from the date of the person's latest attendance in any educational institution in the State (Educ. 24-702(c)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What record it asks for
Logging duty
Section 24-703(f)(3)(iii) requires the Center to provide data security, including the capacity for audit trails, and section 24-703(f)(3)(iv) requires regular audits for compliance with data privacy and security standards. The clause names an audit trail and no particular content, retention period or access right, so none is coded.
- Kind
- Explicit
- As of
- Provision
- Md. Code Ann., Educ. § 24-703(f)(3)(iii)
- Trigger
- personal_data_processing
What this law does
The Maryland Longitudinal Data System Center is an independent unit within State government. The Center serves as the central repository of student data and workforce data in the Maryland Longitudinal Data System. The Center must ensure routine and ongoing compliance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies, including the required use of de-identified data in data research and reporting.
Direct access to data in the system is restricted to authorized staff of the Center, and the Center may use only de-identified data in its analysis, research and reporting. The Center may use only aggregate data in the release of data in reports and in response to data requests. The Center may not report in any form data that may be identifiable based on the size or uniqueness of the population under consideration.
The Center may not release or sell information that may not be disclosed under the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies. Before any individual data is incorporated into the system, the Governing Board must create an inventory of the individual student data proposed to be maintained in the system and required to be reported by State and federal education mandates.
The Governing Board must also develop a detailed data security and safeguarding plan that includes privacy and security audits, breach notification and procedures, and data retention and disposition policies. The Governing Board must ensure that any contract governing a database outsourced to a private vendor includes express provisions that safeguard privacy and security and include penalties for noncompliance.
The linkage of student data and workforce data in the Maryland Longitudinal Data System is limited to no longer than 20 years from the date of the person's latest attendance in any educational institution in the State.
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .