Law / United States / 
Virginia
Students' personally identifiable information: Department of Education policies and notice to the parent of an unauthorized disclosure
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Breach notice, Governance
- Audit expectation
- none
What it requires
- If you are the Department of Education, develop and make publicly available on its website policies to ensure state and local compliance with the federal Family Educational Rights and Privacy Act and state law applicable to students' personally identifiable information, including policies for access to that information and for approving requests for student data from public and private entities and individuals for research (Va. Code Ann. 22.1-287.02(A)).
- If you are the Department of Education or a local school division, notify the parent of any student affected, as soon as practicable, when electronic records containing personally identifiable information are reasonably believed to have been disclosed in violation of the federal Family Educational Rights and Privacy Act or other federal or state law applicable to such information, except as section 32.1-127.1:05 or 18.2-186.6 of the Code of Virginia otherwise provides (Va. Code Ann. 22.1-287.02(B)).
- Include in that notice the date, estimated date or date range of the disclosure, the type of information that was or is reasonably believed to have been disclosed, and the remedial measures taken or planned in response (Va. Code Ann. 22.1-287.02(B)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 22.1-287.02 requires the Department of Education to publish policies and requires the Department or a local school division to notify the parent of an affected student, with the content of the notice. The section sets no duty to keep a record of the disclosure or of the notice.
- Kind
- None
- As of
What this law does
The Department of Education must develop and make publicly available on its website policies to ensure state and local compliance with the federal Family Educational Rights and Privacy Act and state law applicable to students' personally identifiable information, including policies for access to that information and for approving requests for student data for research.
When electronic records containing personally identifiable information are reasonably believed to have been disclosed in violation of that Act or other federal or state law applicable to such information, the Department of Education or the local school division must notify the parent of any affected student as soon as practicable, except as section 32.1-127.1:05 or 18.2-186.6 of the Code of Virginia otherwise provides.
The notice must include the date, estimated date, or date range of the disclosure, the type of information that was or is reasonably believed to have been disclosed, and the remedial measures taken or planned in response. Section 22.1-287.02 was added by Chapter 139 of the 2015 Acts of Assembly, which took effect on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .