Law / United States / 
Wyoming
Student data privacy and security plan and district student data guidelines (state superintendent)
Wyo. Stat. Ann. sec. 21-2-202(a)(xxxiv) and (xxxvii)
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Security, Governance, Prohibition
- Audit expectation
- none
What it requires
- If you are the state superintendent of public instruction, develop with the department of enterprise technology services a data privacy and security plan for department of education data that includes guidelines for authorizing access to student data, privacy compliance standards, privacy and security audits, breach planning and notification procedures, data retention and disposition policies data security policies with electronic, physical and administrative safeguards, routine and ongoing compliance with the federal Family Educational Rights and Privacy Act and other privacy laws and policies, the reporting of personally identifiable student information by the student's Wyoming student record identification and locator number, and standards and protocols to remove personally identifiable information so that data can be analyzed without disclosing a student's identity (Wyo. Stat. Ann. sec. 21-2-202(a)(xxxiv)).
- If you are the state superintendent of public instruction, include in that plan a prohibition of the sale or trade of student data to private entities or organizations (Wyo. Stat. Ann. sec. 21-2-202(a)(xxxiv)(H)).
- If you are the state superintendent of public instruction, establish and maintain, in consultation with the department of enterprise technology, the department of audit and school districts, guidelines for school districts on the collection, access, privacy, security and use of student data that comply with the federal Family Educational Rights and Privacy Act and cover access authorization, security safeguards, compliance standards, incident response and breach notification, and retention and verified destruction (Wyo. Stat. Ann. sec. 21-2-202(a)(xxxvii)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 21-2-202(a)(xxxiv) and (xxxvii) direct the state superintendent to develop a data privacy and security plan whose contents include privacy and security audits as a topic, and to establish guidelines for school districts. The text requires no log to be kept by any person, names no content fields and no person who may demand a record.
- Kind
- None
- As of
What this law does
The state superintendent must, with the department of enterprise technology services, establish criteria for the collection, storage, management and reporting of department of education data and develop a data privacy and security plan for it.
The plan must include guidelines for authorizing access to student data, privacy compliance standards, privacy and security audits, breach planning and notification procedures, data retention and disposition policies, and data security policies with electronic, physical and administrative safeguards such as data encryption and employee training, and routine and ongoing compliance with the federal Family Educational Rights and Privacy Act and other privacy laws and policies.
The plan must also include a prohibition of the sale or trade of student data to private entities or organizations. It must provide for all personally identifiable student information reported to the department of education or the department of enterprise technology to be reported by the student's Wyoming student record identification and locator number.
It must also set standards and protocols to remove personally identifiable information so that data can be collected and analyzed without disclosing the identity of the student whose data is collected and used. The state superintendent must also, in consultation with the department of enterprise technology, the department of audit and school districts, establish and maintain guidelines for school districts on the collection, access, privacy, security and use of student data.
The guidelines must comply with the federal Family Educational Rights and Privacy Act and other relevant federal and state laws and cover authorization and authentication mechanisms, administrative, physical and logical security safeguards, privacy and security compliance standards, processes for identifying and responding to data security incidents including breach notification and mitigation, and standards for retention and verified destruction of student data.
House Enrolled Act 14 of 2017 amended the plan paragraph and created the guidelines paragraph. That act took effect on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .