Law / United States / 
Missouri
Student data accessibility, transparency, and accountability rule for the statewide longitudinal data system
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Disclosure, Security, Access restriction, Prohibition
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- If you are the Missouri Department of Elementary and Secondary Education, meet the duties that section 161.096.1 requires the State Board of Education's rule to mandate: make publicly available a data inventory and index of data elements, with definitions, of the individual student data fields in the student data system (subsection 1(1)).
- Restrict access to personally identifiable student data in the statewide longitudinal data system to the Department's authorized staff and contractors who need it, district administrators, teachers and school personnel who need it, students and parents for their own data, and authorized staff of other state agencies under interagency data sharing agreements (subsection 1(2)(a)).
- Do not transfer personally identifiable student data unless otherwise provided by law and authorized by the Department's policies (subsection 1(3)).
- Maintain a data security plan covering access authorization and authentication, privacy compliance standards, privacy and security audits, breach planning and notification, data retention and disposition, and electronic, physical and administrative safeguards such as encryption and employee training (subsection 1(4)).
- Ensure that any contract that governs databases, assessments or instructional supports that include student or redacted data and is outsourced to a private vendor includes express provisions that safeguard privacy and security, including provisions that prohibit the vendor from selling student data or using it in furtherance of advertising, with penalties for noncompliance, except to a local service provider, for the limited purpose authorized by the school or district, whose access to student data, if any, is limited to directory information (subsection 1(6)).
- Do not collect, and as a school district do not report, juvenile court delinquency records, criminal records, student biometric information, student political affiliation or student religion (subsection 3).
- If you request or receive student-level data from the Department, submit a written request and sign a memorandum of agreement with the Department that covers confidentiality, redisclosure, data access, storage and disposal, and its right to audit (5 CSR 20-700.100, subsection 3).
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
A civil penalty of up to $1,000 for a first violation of a rule under the section by an organization or entity other than a state agency, a school board, or an institution, up to $5,000 for a second violation involving the education records and privacy of the same student, and up to $10,000 for any subsequent one; each violation involving a different student record or a different student is a separate violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Missouri Attorney General
Settledness
- As of
- Open questions
- Does a vendor that holds student data under a district contract, rather than a Department contract, fall within the "organization or entity other than a state agency, a school board, or an institution" whose violation of a rule under section 161.096 draws a civil penalty?
What record it asks for
Logging duty
The section requires the rule to mandate a data inventory, access restrictions, a data security plan that includes privacy and security audits, and routine compliance audits by the Department. It names no log or record the Department must keep for production to another party, and the Attorney General may subpoena records relevant to an inquiry (subsection 6).
- Kind
- None
- As of
What this law does
The State Board of Education must promulgate a rule on student data accessibility, transparency, and accountability for the statewide longitudinal data system, and the rule must mandate that the Department of Elementary and Secondary Education carry out the duties the section lists. The Department must publish a data inventory and index of data elements, with definitions, of the individual student data fields in the student data system.
Access to personally identifiable student data in the statewide longitudinal data system is restricted to the Department's authorized staff and its contractors who need it, district administrators, teachers and school personnel who need it, students and parents for their own data, and authorized staff of other state agencies under interagency data sharing agreements.
The Department may not transfer personally identifiable student data unless otherwise provided by law and authorized by the policies adopted under the section. The Department's data security plan must cover access authorization and authentication, privacy compliance standards, privacy and security audits, breach planning and notification, data retention and disposition, and safeguards such as encryption and employee training.
A contract with a private vendor that governs databases, assessments, or instructional supports that include student data must carry express provisions that safeguard privacy and security, including provisions that prohibit the vendor from selling student data or using it in furtherance of advertising, with penalties for noncompliance, except to a local service provider, for the limited purpose authorized by the school or district, whose access to student data, if any, is limited to directory information.
The Department may not collect, and school districts may not report, juvenile court delinquency records, criminal records, student biometric information, student political affiliation, or student religion.
A violation of a rule under the section by an organization or entity other than a state agency, a school board, or an institution is punishable by a civil penalty of up to $1,000, rising to up to $5,000 for a second violation involving the education records and privacy of the same student and up to $10,000 for any later one. The rule the Board adopted, 5 CSR 20-700.100, reaches outside parties through its data request and agreement provisions.
The Attorney General may enforce the section by investigation and a civil action, seek civil penalties, and seek appropriate injunctive relief, including a prohibition on obtaining personally identifiable information for an appropriate time period.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .