Student data privacy, security and transparency.

ORIGINAL
House
Bill No
.
HB0008

ENROLLED ACT NO. 14,

HOUSE OF REPRESENTATIVES

SIXTY-FOURTH LEGISLATURE OF THE STATE OF WYOMING
2017 General Session

AN ACT relating to education; amending requirements of state data security plan to ensure privacy of student data collected; requiring policies for the collection, access, privacy, security and use of student data by school districts; accordingly requiring school districts to adopt and enforce policies for the collection, access, privacy, security and use of student data; and providing for an effective date.

Be It Enacted by the Legislature of the State of Wyoming:

Section 1
.

W.S. 21
‑
2
‑
202(
a)(xxxiv)(intro), (H), (J), by creating new subparagraph (K) and by creating a new paragraph (xxxvii) and 21
‑
3
‑
110(a) by creating
a
new paragraph (xxxv) are amen
ded to read:

21
‑
2
‑
202
.

Duties of the state superintendent.

(a)

In addition to any other duties assigned by law, the state superintendent shall:

(xxxiv)

With the department of enterprise technology services, establish criteria for the collection, storage, management and reporting of department of education data
related
including, but not limited
to teacher certification, statewide education accountability and assessment and the administration of the school finance system. In carrying out this paragraph, the state superintendent and the department of enterprise technology services shall develop a data
privacy and

security plan that includes:

(H)

Prohibition of the sale
or trade
of student data to private entities or organizations;
and

(J)

All personally identifiable student information being reported to the department of education or the department of enterprise technology by a student's Wyoming student record identification and locator number as issued by the department of education
;
.

and

(K)

Standards and protocols to remove personally identifiable information
in order
to
provide for
data collection and analysis without disclosing the identity of the student whose data is being collected and used.

(xxxvii)

In consultation with the department of enterprise technology, the department of audit and school districts, establish and maintain guidelines for school districts for the collection, access,
privacy,
security and use of student data by school districts. The guidelines shall, at a minimum, be in compliance with the federal Family Educational Rights and Privacy Act and other relevant federal and state laws and include the following:

(A)

Authorization and authentication mechanisms for accessing student data;

(B)

Administrative, physical and logical security safeguards, including employee training and data encryption;

(C)

Privacy and security compliance standards;

(D)

Processes for identification of and response to data security incidents, including breach notification and mitigation procedures;

(E)

Standards for retention and
verified
destruction of student data.

21
‑
3
‑
110
.

Duties of boards of trustees.

(a)

The board of trustees in each school district shall:

(xxxv)

Effective
January 1, 2018
, a
dopt and enforce a policy regarding the collection, access,
privacy,
security and use of student data in accordance with guidelines established by the state superintendent under W.S. 21
‑
2
‑
202(a)(xxxvii)
.

Section

2
.

T
his act is effective immediately upon completion of all acts necessary for a bill to become law as provided by Article 4, Section 8 of the Wyoming Constitution.

(END)

Speaker of the House

President of the Senate

Governor

TIME APPROVED: _________

DATE APPROVED: _________

I hereby certify that this act originated in the
House
.

Chief Clerk

1