Policy 3060 Implementation Procedures - Student Data Governance and Privacy

Process only the student data to which they have authorized access;

Use only authorized methods to process student data; and

Disclose student data only under authorized conditions, through authorized methods, and to authorized recipients.

Document the legal authority and specific purpose for creating and/or collecting student data;

Identify the minimum student data elements necessary to accomplish the specific purpose of creating and/or collecting the student data;

Limit the creation and/or collection of student data to the minimum information identified;

Take reasonable steps to monitor the continued relevance of the student data being created and/or collected; and

Provide parents with the ability to opt-out of any collection and/or sharing of their student’s data that does not align with the provisions specified in Section III.B. of the policy.

Coordinate with HCPSS executive leadership and departments/offices to manage and maintain the requirements of the student data governance and privacy program that are delineated in Section III.D. of the policy;

Measure the effectiveness and fidelity of the student data governance and privacy program in order to support continuous improvement efforts; and

Develop and implement continuous improvement efforts based on the measured effectiveness and fidelity of the data privacy program.

Publicizing the process for parents to opt out of the collection and/or sharing of their student’s data when the collection and/or sharing does not align with the provisions specified in Section III.B. of the policy.

Publicize a list of all current enterprise information systems, records management practices, contracts, grants, agreements, and digital tools that involve student data and the student data involved.

Document the student data that the enterprise information system or records management practice creates, collects, uses, maintains, and/or discloses;

Document the legal authority and specific purposes of the student data being created, collected, used, maintained, and/or disclosed by the enterprise information system or records management practice;

Document the nature and scope of legally authorized usages and disclosures of student data;

Document any relevant records retention schedules for the student data being maintained according to the Records and Information Disposition Schedules (RIDS); and

Document the procedure for individuals to opt-in/out, when applicable, of the creation, collection, use, maintenance, and/or disclosure of student data.

Determine the appropriate data privacy controls for an enterprise information system or records management practice that limit access to student data according to the least privilege methodology;

Implement data privacy controls for specific enterprise information systems or records management practices;

Manage and maintain a process to review the implementation of and efficacy of the data privacy controls; and

Make improvements to the data privacy controls as necessary.

Review its Data Privacy Incident Response Plan at least annually to revise and update the plan according to current nationally benchmarked best practices in risk management, data security, and data privacy;

Conduct an annual drill of the Data Privacy Incident Response Plan with all relevant HCPSS offices and departments, and modify the plan according to procedural gaps exposed through the drill process; and

Collaborate with HCPSS executive leadership and departments/offices to align the Data Privacy Incident Response Plan with the HCPSS Continuity of Operations Plan and Disaster Recovery Plan.

Convene to assess the potential data privacy incident;

Take coordinated action according to the Data Privacy Incident Response Plan;

Notify individuals affected according to the regulatory mandates of the Maryland data breach notification requirements; and

Use the lessons learned from the incident response to improve the processes of identifying, defending, detecting, responding to, and recovering from future potential incidents.

Coordinate with relevant HCPSS departments/offices to manage and maintain a contract, grant, and agreement review procedure;

Coordinate with relevant HCPSS departments/offices to identify contracts, grants, and agreements involving student data;

Coordinate with relevant HCPSS departments/offices to include contractual requirements that safeguard the privacy of student data in identified contracts and agreements; and

Coordinate with relevant HCPSS departments/offices to ensure that all contracts, grants, and agreements involving student data adhere to the Maryland Student Data Privacy Law.

Coordinate with relevant HCPSS departments/offices to manage and maintain a digital tool review procedure;

Coordinate with HCPSS relevant departments/offices to identify digital tools that involve student data; and

Coordinate with relevant HCPSS departments/offices to authorize only those digital tools that adhere to federal, State, and local data privacy laws and regulations.