Law / United States / 
Rhode Island
Rhode Island Integrated Data System Act: security, privacy and confidentiality of the statewide longitudinal data system that links education records
R.I. Gen. Laws secs. 42-165-3 to 42-165-7
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Security, Governance, Contract terms
- Audit expectation
- none
What it requires
- If you operate the Rhode Island integrated data system, transmit, store, enable access to, permit the use of and dispose of linked data in accordance with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the associated NIST 800-53 security controls commensurate with the data's sensitivity level, and with applicable state and federal privacy laws and state security policies (section 42-165-4(b)(1)).
- If you are the governing board, approve policies on how data requests will be managed in accordance with federal and state privacy law, and approve standards for the security, privacy, access to and confidentiality of the data, including policies to comply with the Family Educational Rights and Privacy Act (section 42-165-5(b)(1) and (3)).
- If you are a participating agency, transfer data to the integrated data system in accordance with the data security policies the board approves and with state and federal privacy laws and policies (section 42-165-6(a)).
- If you are the Rhode Island longitudinal data system center, implement the board's policies on the security, privacy, access to and confidentiality of the data, keep the information in the system secure and protect individual privacy, maintain insurance coverage, and enter into a contract or agreement to share data only if it incorporates adequate privacy and security protections, is approved in writing by the agency whose data is to be shared, and is allowable under state and federal privacy laws (section 42-165-7(b)(7), (8) and (10)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 42-165-4(b)(1) requires the system to handle linked data in accordance with the NIST Cybersecurity Framework and the associated NIST 800-53 security controls commensurate with data sensitivity level. The chapter itself names no log, contents, period or access for a regulator, and it names no audit of the system.
- Kind
- Implicit
- As of
- Provision
- R.I. Gen. Laws sec. 42-165-4(b)(1)
- Trigger
- personal_data_processing
What this law does
Section 42-165-4(b)(1) of the Rhode Island General Laws requires the Rhode Island integrated data system to transmit, store, enable access to, permit the use of, and dispose of linked data and information in accordance with the National Institute of Standards and Technology Cybersecurity Framework and the associated National Institute of Standards and Technology (NIST) 800-53 security controls commensurate with data sensitivity level, and in accordance with all applicable state and privacy laws and state security policies.
Section 42-165-3(6) of the Rhode Island General Laws defines the statewide longitudinal data system as an individual- or unit-level data system that links and integrates records from state datasets including early childhood and prekindergarten, through elementary, secondary, and postsecondary education, and into the workforce, from participating agencies and entities.
Section 42-165-3(2) of the Rhode Island General Laws defines a participating agency as the Rhode Island department of education, the office of the postsecondary commissioner, the Rhode Island department of labor and training, the executive office of health and human services, and any agency that has executed a memorandum of understanding for recurring participation in the Rhode Island longitudinal data system.
Section 42-165-3(5) of the Rhode Island General Laws defines state and federal privacy laws to include the federal Family Educational Rights and Privacy Act and its regulations, the Health Insurance Portability and Accountability Act, section 28-42-38 of the General Laws and 20 C.F.R. sec. 603.1 et seq.
Section 42-165-5(b)(1) and (3) of the Rhode Island General Laws require the governing board, in accordance with federal and state privacy law, to approve policies on how data requests will be managed, and to approve standards implemented by the center and the Ecosystem for the security, privacy, access to, and confidentiality of data, including policies to comply with the Family Educational Rights and Privacy Act.
Section 42-165-6(a) of the Rhode Island General Laws requires participating agencies to transfer data, as applicable, to the integrated data system in accordance with the data security policies the board approves and pursuant to the requirements of state and federal privacy laws and policies.
Section 42-165-7(b)(7) and (8) of the Rhode Island General Laws require the Rhode Island longitudinal data system center to implement the policies and procedures the board approves on the security, privacy, access to, and confidentiality of the data, to ensure that information in the longitudinal data system is kept secure and that individual privacy is protected, and to maintain insurance coverage.
Section 42-165-7(b)(10) of the Rhode Island General Laws allows the center to enter into contracts or other agreements with appropriate entities only if they incorporate adequate protections with respect to the privacy and security of any information to be shared, are approved in writing by the agency whose data or information is to be shared, and are allowable under applicable state and federal privacy laws.
Section 42-165-5(b)(9) of the Rhode Island General Laws provides that interagency data sharing under the chapter does not constitute a disclosure or release under any statutory or administrative law that governs the government information. Chapter 165 of title 42 of the Rhode Island General Laws was added by Public Law 2023, chapter 79, article 3, section 10, effective , and amended by Public Law 2025, chapter 278, article 3, section 26, effective .
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .