Law / United States / 
West Virginia
Student data governance: duties of the Department of Education under the Student Data Accessibility, Transparency and Accountability Act
W. Va. Code sec. 18-2-5h(c)(1) to (7) and (9)
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Access restriction, Security, Contract terms, Disclosure, Governance
What it requires
- If you are the West Virginia Department of Education, create, publish and make publicly available a data inventory and dictionary or index of the data elements in the student data system, with definitions of the individual student data fields (section 18-2-5h(c)(1)).
- Publish policies and procedures to comply with relevant state and federal privacy laws, including FERPA, that restrict access to student and redacted data in the statewide longitudinal data system to the Department's authorized staff and contractors, district administrators, teachers and school personnel, students and their parents, and authorized staff of other West Virginia state agencies (section 18-2-5h(c)(2)(A)).
- Post inter-agency data-sharing agreements on the Department's website and notify parents of their right to opt out of sharing their child's data under the agreements (section 18-2-5h(c)(2)(B)).
- Use only aggregate data in public reports and in response to record requests (section 18-2-5h(c)(2)(C)).
- Develop criteria for approving research and data requests from state and local agencies, the Legislature, researchers working on behalf of the Department and the public, and keep the student data the Department maintains redacted (section 18-2-5h(c)(2)(D)).
- Notify students and parents of their student privacy rights under federal and state law (section 18-2-5h(c)(2)(E)).
- Unless otherwise provided by law, do not transfer confidential student information or redacted data that is confidential under the section to any federal, state or local agency or other person or entity, public or private, except in the cases the paragraph lists, among them a contract with an in-state or out-of-state contractor for state level reporting (section 18-2-5h(c)(3)).
- Develop a detailed data security plan covering guidelines for authenticating authorized access, privacy compliance standards, privacy and security audits, breach planning, notification and procedures, data retention and disposition policies, and data security policies including encryption and employee training (section 18-2-5h(c)(4)).
- Ensure routine and ongoing compliance with FERPA, other relevant privacy laws and policies, and the section's privacy and security policies, including by performing compliance audits (section 18-2-5h(c)(5)).
- Ensure that any contract with a private vendor that governs databases, assessments or instructional supports that include student or redacted data includes express provisions that safeguard privacy and security and include penalties for noncompliance (section 18-2-5h(c)(6)).
- Notify the Governor and the Legislature annually of new student data proposed for the student data system, changes to existing data collections, exceptions granted by the state board for the release or out-of-state transfer of student or redacted data, and the results of privacy compliance and security audits completed in the past year (section 18-2-5h(c)(7)).
- Before collecting new student data, state the purpose or reason and the legal authority for the collection, announce the proposal to the general public for a review and comment period of at least sixty days, and obtain state board approval (section 18-2-5h(c)(7)(A)).
- Prohibit the collection of confidential student information (section 18-2-5h(c)(9)).
These lines are LexLint's reading of the law's text.
What this law does
Section 18-2-5h(c)(1) requires the Department of Education to create, publish and make publicly available a data inventory and dictionary or index of data elements with definitions of individual student data fields in the student data system.
Section 18-2-5h(c)(2) requires policies and procedures to comply with relevant state and federal privacy laws, including the Family Educational Rights and Privacy Act, that restrict access to student and redacted data in the statewide longitudinal data system to the Department's authorized staff and contractors, district administrators, teachers and school personnel, students and their parents, and authorized staff of other West Virginia state agencies.
Section 18-2-5h(c)(2)(B) requires inter-agency data-sharing agreements to be posted on the Department website and parents to be notified of their right to opt out of sharing the child's data under the agreements.
The policies under section 18-2-5h(c)(2) must also cover the use of only aggregate data in public reports and in response to record requests, criteria for approving research and data requests with student data the Department maintains kept redacted, and notification to students and parents of their student privacy rights under federal and state law.
Section 18-2-5h(c)(3) bars the Department, unless otherwise provided by law, from transferring confidential student information or redacted data that is confidential under the section to any federal, state or local agency or other person or entity, public or private, except in the cases the paragraph lists.
One of the cases section 18-2-5h(c)(3) lists is a contract the Department enters into with an in-state or out-of-state contractor, for the purposes of state level reporting, that governs databases, assessments, student or redacted data, special education or instructional supports.
Section 18-2-5h(c)(4) requires a detailed data security plan that includes guidelines for authentication of authorized access, privacy compliance standards, privacy and security audits, breach planning, notification and procedures, data retention and disposition policies, and data security policies including electronic, physical and administrative safeguards.
Section 18-2-5h(c)(6) requires the Department to ensure that any contract that governs databases, assessments or instructional supports that include student or redacted data and is outsourced to a private vendor includes express provisions that safeguard privacy and security and include penalties for noncompliance.
Under section 18-2-5h(c)(7)(A), a proposal by the Department to collect new student data must include a statement of the purpose or reason and legal authority for the collection, and must be announced to the general public for a review and comment period of at least sixty days and approved by the state board before it becomes effective. Section 18-2-5h(c)(9) requires the Department to prohibit the collection of confidential student information.
The cross-reference in section 18-2-5h(c)(9) names subdivision ten of subsection (b), which defines directory information, while the definition of confidential student information is subdivision (11). Subsection (b)(11) defines confidential student information to include data relating to a person's Social Security number, religious affiliation, medical, psychological or behavioral diagnoses, criminal history, biometric information, genetic information and credit card numbers, among other items.
The Legislature created the section by House Bill 4316 of the 2014 Regular Session, effective ninety days from passage on . House Bill 4261 of the 2016 Regular Session, effective ninety days from passage on , amended the section and is summarized as prohibiting the sale or transfer of student data to vendors and other profit making entities.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .