§ 22-16-106 — Department - support for local education providers

Colorado § 22-16-106

• Jurisdiction: Colorado
• Title 22: Education
• Art.: Student Data Transparency and Security

Text

(1) The
department shall develop data security guidance that may be used by local
education providers. The department's data security guidance must include:

(a) Guidance for authorizing access to the student data system and to
student personally identifiable information, including guidance for authenticating
authorized access;

(b) Privacy compliance standards;

(c) Best practices for privacy and security audits;

(d) Security breach planning, notice, and procedures;

(e) Data retention and destruction procedures;

(f) Data collection and sharing procedures;

(g) Recommendations that any contracts that affect databases,
assessments, or instructional supports that include student personally identifiable
information and are outsourced to vendors include express provisions that
safeguard privacy and security and include penalties for noncompliance;

(h) Best security practices for privacy when using online education services,
including websites and applications;

(i) Guidance for contracts involving the outsourcing of educational services;

(j) Guidance for contracts involving online education services;

(k) Guidance for publishing a list of vendors that local education providers
contract with that hold student personally identifiable information;

(l) Consequences for security breaches; and

(m) Examples of staff training regarding the procedures.

(2) Based on the data security guidance adopted pursuant to subsection (1)
of this section, on or before March 1, 2017, the department shall create and make
available to local education providers a sample student information privacy and
protection policy. The department shall annually review the sample policy and
revise it as necessary to ensure that it remains current and adequate to protect the
privacy of student personally identifiable information in light of advances in data
technology and dissemination. At a minimum, the sample policy must include
protocols for:

(a) Creating and maintaining a student data index;

(b) Retaining and destroying student personally identifiable information;

(c) Using student personally identifiable information for purposes internal to
a local education provider;

(d) Preventing breaches in the security of student personally identifiable
information and for responding to any security breaches that occur;

(e) Contracting with school service contract providers and using school
services provided by school service on-demand providers;

(f) Disclosing student personally identifiable information to school service
contract providers, school service on-demand providers, or other third parties;

(g) Notifying parents regarding collection of, retention of, and access to
student personally identifiable information; and

(h) Providing training in student information security and privacy to
employees of a local education provider.

(3) The department shall prepare and make available to local education
providers sample contract language for use in contracting with school service
contract providers. The department shall update the sample contract language as
necessary to ensure that it remains current and adequate to protect the privacy of
student personally identifiable information in light of advances in data technology
and dissemination.

(4) The department shall identify and make available to local education
providers resources that the local education providers may use in training
employees with regard to student information security and privacy. At the request
of a local education provider, the department shall provide training related to
student information security and privacy.

(5) If the department receives notice that a local education provider has
ceased using a school service on-demand provider for reasons described in section
22-16-107 (3), the department shall post the notice on the department's website.
The department shall also post any written response from an on-demand provider
that the local education provider may submit. The department shall post the notices
and written responses for twenty-four months following the date received.

Legislative History

Source: L. 2016: Entire article added, (HB 16-1423), ch. 355, p. 1466, � 1, effective August 10.