Law / United States / 
West Virginia
Student data governance under Policy 4350: data duties of county boards and schools
W. Va. Code St. R. sec. 126-94-4.3
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Access restriction, Security, Breach notice
What it requires
- If you are a West Virginia county board of education, a school or facility under the state board's supervision, or a charter public school, designate a county staff member as the data governance point of contact, the local expert on data privacy who keeps regular contact with the Department of Education (Policy 4350, section 126-94-4.3.a).
- Make student data accessible only to authorized parties with a legitimate educational interest; anyone authorized to enter or edit student data must be older than 18 and not currently enrolled as a pre-k to grade 12 student, and every party authorized to access student data on your behalf must have a current data access agreement on file (section 126-94-4.3.b.1).
- Keep rigorous protocols to secure electronic and physical records, including protocols for terminating access for parties who lose a legitimate educational interest, disclose student data, use it in unauthorized ways or otherwise violate student data rules (section 126-94-4.3.b.2).
- Give the annual notification of rights, and obtain consent from parents or eligible students before releasing information from education records where the rule requires it (section 126-94-4.3.b.3 and 4.3.b.4).
- Respond immediately to any data privacy or security incident or breach and report it to the appropriate authorities, including Department of Education staff responsible for data governance (section 126-94-4.3.b.5).
- Make sure staff know and follow the applicable data security and privacy policies, including Policy 2460, the Student Data Accessibility, Transparency and Accountability Act, FERPA and Policy 4350, and offer staff training on data collection, privacy and security (section 126-94-4.3.b and 4.3.d).
These lines are LexLint's reading of the law's text.
What this law does
Policy 4350, the West Virginia Board of Education's procedural rule on the collection, maintenance and disclosure of student data in the state's public schools, applies to county boards of education, schools and facilities under the board's supervision, and charter public schools.
Section 126-94-4.3 gives counties and schools primary responsibility for collecting, recording and protecting student data, and requires a staff member within each county to serve as the data governance point of contact.
Counties and schools must ensure that student data are accessible only to authorized parties with a legitimate educational interest, that anyone authorized to enter or edit student data is older than 18 and not currently enrolled as a pre-k to grade 12 student, and that every party authorized to access student data on their behalf has a current data access agreement on file.
They must keep rigorous protocols to secure electronic and physical records, including protocols for terminating access for parties who no longer have a legitimate educational interest, disclose student data or use it in unauthorized ways. They must immediately respond to any data privacy or security incident or breach and report it to the appropriate authorities, including the Department of Education staff responsible for data governance. The current version of the rule was filed on and took effect on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .