Law / United States / 
North Carolina
Student data system security: State Board of Education duties
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Security, Contract terms, Disclosure
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- If you are the State Board of Education, create and make publicly available a data inventory and index of data elements, with definitions of individual student data fields in the student data system (G.S. 115C-402.5(b)(1)).
- Develop rules that restrict access to personally identifiable student data in the student data system to the individuals the section lists, and prohibit its transfer to anyone else unless permitted by law and authorized by those rules (G.S. 115C-402.5(b)(2) and (3)).
- Develop a detailed data security plan for the student data system covering access authorization, privacy compliance standards, privacy and security audits, breach planning, notification, and procedures, data retention and disposition policies, and data security policies including encryption and employee training (G.S. 115C-402.5(b)(4)).
- Ensure routine and ongoing compliance by the Department of Public Instruction with FERPA and with the privacy and security rules developed under the section, including compliance audits within the Department (G.S. 115C-402.5(b)(5)).
- Ensure that any contract for the student data system that includes de-identified or personally identifiable student data and is outsourced to a private contractor includes express provisions that safeguard privacy and security and include penalties for noncompliance (G.S. 115C-402.5(b)(6)).
- Notify the Governor and the General Assembly each year by October 1 of new student data included or proposed for inclusion in the student data system, and of changes to existing data collections (G.S. 115C-402.5(b)(7)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The State Board's data security plan must provide for privacy and security audits and for data retention and disposition policies, and the Board must ensure compliance audits within the Department of Public Instruction, which cannot run without records of access to and use of the student data system. The section names no log contents, no retention period for any record and no regulator access to a record.
- Kind
- Implicit
- As of
- Provision
- 115C-402.5(b)(4)c. and (b)(5) (privacy and security audits, and compliance audits within the Department of Public Instruction)
- Trigger
- personal_data_processing
What this law does
The student data system is the student information management system the State Board of Education and the Department of Public Instruction use as part of the Uniform Education Reporting Systems for collection and reporting of student data from local boards of education. The State Board of Education must create and make publicly available a data inventory and index of data elements with definitions of individual student data fields in the student data system.
The State Board must prohibit the transfer of personally identifiable student data in the student data system to anyone other than the individuals its access rules identify, unless otherwise permitted by law and authorized by rules adopted under the section.
The State Board must develop a detailed data security plan for the student data system that includes guidelines for authorizing access, privacy compliance standards, privacy and security audits, breach planning, notification, and procedures, data retention and disposition policies, and data security policies.
The State Board must ensure routine and ongoing compliance by the Department of Public Instruction with FERPA and with the privacy and security rules developed under the section, including compliance audits within the Department.
The State Board must ensure that contracts for the student data system that include de-identified or personally identifiable student data and are outsourced to private contractors include express provisions that safeguard privacy and security and include penalties for noncompliance. Session Law 2014-50 enacted the section and took effect when it became law. The Governor approved Session Law 2014-50 on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .