Law / United States / 
Pennsylvania
Postsecondary institution online reporting system for sexual harassment and sexual violence: limits on access to the data it collects
24 P.S. § 20-2003-J (Act 16 of 2019)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Access restriction, Disclosure, Governance
- Audit expectation
- none
What it requires
- If you are a postsecondary institution (an institution located in Pennsylvania that is authorized to grant an associate or higher academic degree), establish and maintain an online reporting system to receive complaints of sexual harassment and sexual violence from students and employees; the system must permit anonymous reports, and you may not refuse to investigate a report because it is anonymous (section 2003-J(a) and (b)).
- Give each student or employee who makes a report information about who will receive and have access to the reports filed, how the information gathered through the system will be used, and contact information for on-campus and off-campus organizations serving victims of sexual harassment and sexual violence (section 2003-J(c)).
- Post the system's policy on reports and investigations of sexual harassment and sexual violence prominently on the system and encourage individuals to review it (section 2003-J(d)).
- Limit access to the data collected, created or maintained through the system to only the data subject and to individuals with explicit authorization from the institution (section 2003-J(e)(1)).
- Limit each authorized individual's ability to enter, update, access, share or disseminate the data through role-based access that corresponds to the individual's official duties or training level and the institutional authorization that grants access (section 2003-J(e)(2)).
- Record in a data audit trail each action in which the data are entered, updated, accessed, shared or disseminated outside the institution (section 2003-J(e)(3)).
- Immediately and permanently revoke the authorization of an individual determined to have willfully entered, updated, accessed, shared or disseminated data in violation of the section (section 2003-J(e)(4)).
These lines are LexLint's reading of the law's text.
What record it asks for
What the log must hold
Access record
Logging duty
Section 2003-J(e)(3) requires that actions in which the data are entered, updated, accessed, shared or disseminated outside the postsecondary institution be recorded in a data audit trail. The section sets no retention period and names no reader of the audit trail.
- Kind
- Explicit
- As of
- Provision
- 24 P.S. § 20-2003-J(e)(3)
- Trigger
- personal_data_processing
What this law does
Section 2003-J of the Public School Code of 1949, added by Act 16 of 2019, requires a postsecondary institution to establish and maintain an online reporting system to receive complaints of sexual harassment and sexual violence from students and employees. Article XX-J defines a postsecondary institution as an institution located within this Commonwealth that is authorized to grant an associate or higher academic degree.
An institution may not fail or refuse to investigate a report because it is anonymous. Section 2003-J(c) requires the institution to tell each student or employee who makes a report who will receive and have access to the reports filed. Section 2003-J(e) requires the institution to limit access to the data collected, created or maintained through the system to only the data subject and to individuals with explicit authorization from the institution.
An authorized individual's ability to enter, update, access, share or disseminate the data must be limited through role-based access that corresponds to the official duties or training level of the individual and the institutional authorization that grants access for that purpose. Actions in which the data are entered, updated, accessed, shared or disseminated outside the institution must be recorded in a data audit trail.
An institution must immediately and permanently revoke the authorization of an individual determined to have willfully entered, updated, accessed, shared or disseminated data in violation of the section. Neither the institution nor an individual implementing, operating or working for the program may be compelled to produce a record except pursuant to a court order. Act 16 of 2019 was approved on . The addition of Article XX-J takes effect in 365 days, which is .
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .