Student Data Accessibility, Transparency and Accountability Act of 2013: State Board of Education duties for the student data system

The Student Data Accessibility, Transparency and Accountability Act of 2013 directs the State Board of Education and the State Department of Education in running the Department's student data system. The Board must create, publish and make publicly available a data inventory and dictionary of the data elements in the student data system, including data the Department collects or maintains with no current purpose or reason.

Student data means data collected or reported at the individual student level and included in a student's educational record, and it includes assessment results, transcript information, grades, attendance, special education data and demographic data. Unless included in a student's educational record, student data does not include juvenile delinquency records, criminal records, medical and health records, a student's Social Security number or student biometric information.

The Board must publish policies and procedures to comply with the Family Educational Rights and Privacy Act that restrict access to student and de-identified data in the data system to authorized Department staff and contractors, district administrators, teachers and school personnel who require access, students and their parents, and authorized staff of other Oklahoma state agencies. Those policies must also provide for notifying students and parents of their rights under federal and state law.

Unless the Board approves otherwise, student data the Department maintains remains confidential. Unless the Board approves otherwise, the Department may not transfer confidential student or de-identified data outside Oklahoma, except in seven listed cases that include a contract with an out-of-state vendor governing databases, assessments, special education or instructional supports.

The Board must develop a data security plan that covers access authorization and authentication, privacy compliance standards, privacy and security audits, breach planning, notification and procedures, and data retention and disposition policies. The Board must ensure routine and ongoing compliance by the Department with FERPA, other relevant privacy laws and the privacy and security policies developed under the Act, including the performance of compliance audits.

The Board must ensure that contracts with private vendors that govern databases, assessments or instructional supports and include student or de-identified data contain express provisions that safeguard privacy and security and penalties for noncompliance. The Board must notify the Governor and the Legislature each year of any exceptions it granted to the release or out-of-state transfer of student or de-identified data and of the results of privacy compliance and security audits.

Those audit notifications may not include information that would itself pose a security threat to state or local student information systems by exposing vulnerabilities. Any new student data collection the Board proposes becomes a provisional requirement, which gives districts and their local data system vendors the opportunity to meet it, and it expires unless the Governor and the Legislature approve it by the end of the next legislative session.

The Board must adopt rules for the Department to implement the Act. The Act was enacted by House Bill 1989 of 2013 with an emergency effective date of July 1, 2013. It was amended by Laws 2015, chapter 33, and Laws 2021, chapter 66.