Law / United States / 
West Virginia
State education data sharing compact: privacy and security duties for the longitudinal data system and for data shared with research organizations
W. Va. Code sec. 18B-1D-10(e) and (f)
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Security, Contract terms, Governance
What it requires
- If you are the West Virginia Higher Education Policy Commission, the Council for Community and Technical College Education or the State Board of Education, collect, use, maintain, disclose and share longitudinal education data in accordance with personal privacy laws, and develop security measures and procedures that protect personal information from release to unauthorized persons and from use for unauthorized purposes (section 18B-1D-10(e)(3)).
- Share data with a research organization only under an arrangement that privacy protection laws permit, that has prior approval from the state superintendent of schools or the relevant chancellor where that entity's data are used, that prohibits personal identification by anyone other than the organization's authorized representatives with legitimate interests, and that ensures the data are destroyed or returned when no longer needed (section 18B-1D-10(f)(1) to (4)).
- Put each such arrangement in a written agreement that specifies its purpose, scope and duration, limits the recipient's use of personally identifiable information from education records to the purposes it states, and describes the data access, use and security restrictions the recipient will undertake (section 18B-1D-10(f)(5)).
These lines are LexLint's reading of the law's text.
What this law does
Section 18B-1D-10 directs the commission, the council and the State Board of Education to enter into a state compact to develop and maintain a longitudinal education data system and to share educational information. The parties are the Higher Education Policy Commission, the Council for Community and Technical College Education and the State Board of Education.
Section 18B-1D-10(e)(3) requires them to collect, use, maintain, disclose and share data in accordance with personal privacy laws and to develop security measures and procedures that protect personal information from intentional or accidental release to unauthorized persons and from intentional or accidental use for unauthorized purposes.
A research organization is one qualified to perform educational research and protect the privacy of student data, seeking to perform research for a noncommercial purpose authorized by privacy protection laws, and agreeing to perform the research under a written agreement meeting the requirements of those laws and best research practices.
Under section 18B-1D-10(f), a data sharing arrangement with a research organization must be permitted by and undertaken in accordance with privacy protection laws, must have prior approval from the state superintendent of schools or the relevant chancellor where that entity's data are used, must prohibit the personal identification of any person by anyone other than the organization's authorized representatives with legitimate interests in the information, and must ensure the destruction or return of the data when no longer needed.
The arrangement must be performed under a written agreement that specifies its purpose, scope and duration, requires the recipient to use personally identifiable information from education records only for the purposes it states, and describes specific data access, use and security restrictions the recipient will undertake. House Bill 3340 of the 2009 Regular Session, passed on and in effect from passage, added the section.
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .