Law / United States / 
New Hampshire
Student data governance: limits on disclosure of student personally identifiable data by schools and the department of education
In force.
A sensitive categories rule binding government bodies.
- Obligation class
- Prohibition, Disclosure, Reporting
- Audit expectation
- none
What it requires
- If you are a school, disclose student personally identifiable data about a student, on request, to the parent, foster parent or legal guardian of a student under the age of 18, or to the eligible student (RSA 189:67, I).
- If you are a school or the department of education, disclose to a testing entity only the student's name, unique pupil identifier and birth date, and only to identify the test taker (RSA 189:67, II).
- If you are a school or the department of education, do not disclose or permit the disclosure of student or teacher personally identifiable data, the unique pupil identifier or any other data listed in RSA 189:68, I to a testing entity performing test-data analysis, except as RSA 193-C:12 provides or when the data is collected in conjunction with the SAT or ACT used for the state assessment (RSA 189:67, III).
- If you are the department of education, do not disclose student personally identifiable data in the statewide longitudinal data system, or teacher personally identifiable data in other department data systems, to any person or entity except as RSA 193-E:5 provides or under a court order signed by a judge; you may disclose it to the school district in which the student resides or the teacher is employed (RSA 189:67, IV).
- Treat student personally identifiable data as confidential and privileged, and do not disclose it, directly or indirectly, as a result of administrative or judicial proceedings (RSA 189:67, V).
- If you are the department of education, report quarterly on your website the number of times you disclosed student personally identifiable data to anyone other than the student, the student's parents, foster parents or legal guardian and the school district, early childhood program or post-secondary institution in which the student was enrolled, with the name of each recipient and the legal basis for the disclosure (RSA 189:67, VI).
These lines are LexLint's reading of the law's text.
What record it asks for
Who may demand the log
Public
Logging duty
RSA 189:67, VI requires the department of education to report quarterly on its website the number of times it disclosed student personally identifiable data to anyone other than the student, the student's parents or guardian and the school district, early childhood program or post-secondary institution of enrollment, with the name of each recipient and the legal basis for the disclosure. The report is public, which is the reader coded. The section sets no retention period and no audit. The cited section states no territorial reach, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- RSA 189:67, VI (quarterly report of disclosures of student personally identifiable data)
- Trigger
- personal_data_processing
What this law does
A school must, on request, disclose student personally identifiable data about a student to the parent, foster parent or legal guardian of a student under 18, or to the eligible student. A school or the department of education may disclose to a testing entity the student's name, unique pupil identifier and birth date, for the sole purpose of identifying the test taker.
Except as RSA 193-C:12 provides or for data collected in conjunction with the SAT or ACT used for the state assessment, neither a school nor the department may disclose student or teacher personally identifiable data to a testing entity performing test-data analysis, and the testing entity may perform the analysis but may not connect the data to other student data.
The department may not disclose student personally identifiable data in the statewide longitudinal data system to any person or entity except as RSA 193-E:5 provides or under a court order signed by a judge, and may disclose it to the school district in which the student resides. Student personally identifiable data is confidential and privileged and may not be disclosed, directly or indirectly, as a result of administrative or judicial proceedings.
The department must report quarterly on its website how many times it disclosed such data to anyone other than the student, the student's parents or guardian and the school district, early childhood program or post-secondary institution in which the student was enrolled, with the name of each recipient and the legal basis for the disclosure.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .