Policy 3060 – Student Data Governance and Privacy

Processed lawfully and in a transparent manner in relation to the student;

Collected for specified, explicit and legitimate purposes, and not further processed in a manner that is incompatible with those purposes;

Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;

Accurate and, where necessary, kept up to date;

Processed in a manner that provides for the appropriate privacy of the student data, including protection against unauthorized or unlawful processing and using appropriate technical or organizational data privacy controls; and

Processed according to the appropriate standards and procedures indicated in HCPSS Policy 3050 Records Management and HCPSS Policy 3040 Technology Security.

At the consent of the student/parent for one or more specific purposes;

Necessary for the performance of an HCPSS approved and Family Educational Rights and Privacy Act (FERPA) compliant contract, grant, or agreement to provide an essential service or function including, but not limited to, the student information system, the learning management system, and the library media system;

Necessary for compliance with a legal obligation to which the HCPSS is subject;

Necessary in order to protect the safety of an individual student;

Necessary for the exercise of the official authority vested in the HCPSS, including compliance with the Maryland State Department of Education (MSDE) regulations pertaining to student education records as specified in COMAR and compliance with the United States Department of Education regulations pertaining to school system reporting and accountability as specified in the Every Student Succeeds Act (ESSA); or

Allowed under FERPA.

Limiting the student data shared to the minimum necessary to fulfill the purpose of the contract, grant, or agreement;

Mandating that student data are processed only for specified purposes;

Prohibiting disclosure of student data to an additional party;

Prohibiting processing of student data for commercial gain beyond that of the specified contractual purpose;

Mandating the reasonable administrative, technical, and physical safeguards of student data;

Mandating the maintenance of a data breach incident response plan and data breach notification process; and

Permitting a technical and/or administrative review by HCPSS to monitor compliance with the contractual agreements.

Manage and maintain a method to collect and respond to parent inquiries about student data governance and privacy practices;

Manage and maintain a method for engaging with offices throughout the HCPSS to encourage the use of digital technologies and data governance strategies that sustain and/or enhance student data privacy;

Maintain and publicize an inventory of the student data elements the HCPSS collects with an explanation and/or legal or regulatory authority;

Maintain and publicize an inventory of the contracts, grants, agreements, and digital tools that involve student data;

Conduct data privacy assessments of enterprise information systems and records management practices that involve student data;

Incorporate data privacy controls that apply the least privilege methodology into enterprise information systems and records management practices that process student data;

Maintain a Data Privacy Incident Response Plan that includes Maryland breach notification requirements and identifies the critical response team;

Respond to potential student data privacy incidents by convening the critical response team and taking action according to the Data Privacy Incident Response Plan;

Review public releases of student data in order to ensure data is de-identified;

Review internal requests for access to student data in order to incorporate appropriate student data privacy controls and disclosure avoidance techniques;

Review HCPSS responses to external research and data sharing requests in order to incorporate appropriate student data privacy controls for all approved requests;

Review contracts, grants, and agreements in order to incorporate appropriate student data privacy requirements;

Review digital tools and authorize only those digital tools that adhere to federal, State, and local student data privacy laws and regulations;

Conduct annual training and/or notification for all HCPSS employees, contractors, and volunteers on student data privacy policies, procedures, and practices; and

Report biannually to the Board on activities that impact student data privacy, including parental inquiries, data privacy controls, and relevant legislative and regulatory changes.

Following all approved data governance and privacy controls; and

Using only contracted essential digital tools or authorized supplemental digital tools with students for HCPSS-sanctioned activities.

Biological Parent — A natural parent whose parental rights have not been terminated.

Adoptive Parent — A parent who has legally adopted the student and whose parental rights have not been terminated.

Custodian — A person or an agency appointed by the court as the legal custodian of the student and granted parental rights and responsibilities.

Guardian — A person who has been placed by the court in charge of the affairs of the student and granted parental rights and responsibilities.

Caregiver — An adult resident of Howard County who exercises care, custody, or control over the student but who is neither the biological parent nor legal guardian as long as the person satisfies the requirements of the Education Article §7-101(c) (Informal Kinship Care) or has been issued a U.S. Department of Health and Human Services’ Office of Refugee Resettlement (ORR) Verification of Release form entering into a custodial arrangement with the federal government.

Foster Parent — An adult approved to care for a child who has been placed in their home by a state agency or a licensed child placement agency as provided by the Family Law Article, §5-507.