Data Release Policies & Procedures Kansas State Department of Education NCES Forum July 2009 Kathy Gosa

Data Release Issues Releasing data is more than a legal concern Large number of requests Consistent treatment of requesters Consistent response to requests Tracking of where request is / what has been completed Ability to replicate the report over time or for another requester Concerns regarding recipients’ understanding of the data Concerns regarding Open Records, FERPA and personally identifiable data Not just a legal problem!!! These are some of the problems we’ve faced that are part of our Data Release process. Major issues: Requests for data came from many sources and could enter the agency in numerous ways We couldn’t evaluate how much work was being done to respond to requests – often redundant Requesters treated differently depending on how / who they asked No oversight in the quality of the data being provided No tracking so couldn’t tell where a request is Didn’t have a good feel for how much work was being done re Data Requests No awareness of whether the same question was being answered differently or if work was redundant Couldn’t re-use results Large number of requests – perception that we had hundreds – but couldn’t substantiate. Perception that many people spent a lot of time fulfilling, but we couldn’t substantiate. Inconsistent treatment of requests/requesters - Includes how the requester is communicated with, priority given the work No tracking of where request is / what has been completed No ability to replicate over time or for another requester. Concerns regarding FERPA and personally identifiable data The Problem – we couldn’t tell Who? …was asking for data and who was giving the answers. What? … specifically was the question – this was often left to the interpretation of the individual who received the request. Why? … was the data needed? … were responses to similar requests inconsistent? Where? … was the request at any given time? …was the data that was provided to a previous request? When? … would we respond to the request? … when did we have a request similar to this before? How Much? There was a perception that a huge number of requests were being received and processed, and a large amount of agency staff time was being used to do that work – but we had no data to back that up so could not evaluate how to best use our resources.

Data Requests & Data Governance Data Stewards and Programmers Data Manager / Coordinator Data Owner Data Governance Board Executive Leadership Data Request Review Board Data Stewards & Programmers Our DGB established the Data Request Review Board to address the issues that surround data requests. Definition of a Data Governance Program: The individuals and process with responsibility for establishing and enforcing policies and guidance involving data. Data Governance brought even more process around our treatment of data. Our Data Governance Board (made up of Data Owners) began discussing our problems with the volume of data requests that our agency received and the issues with responding to them. The Data Governance Board formed the Data Request Review Board to focus on and address this issues.

Data Request Review Board Membership Subgroup of DGB 5 Directors, including Legal Counsel Mission: implement processes for the provision of accurate, timely data and information to our internal and external customers while protecting personally identifiable student information and other confidential information. DRRB Process Monthly meetings Virtual meetings as needed Defined Workflow Tracking tools Mission of the Data Request Review Board  The mission of the Data Request Review Board (DRRB) is to implement processes for the provision of accurate, timely data and information to our internal and external customers while protecting personally identifiable student information and other confidential information.   Scope/Responsibilities and Goals/ Objectives of the Data Request Review Board  The DRRB was established to support the flow of data and information requests. Data Request Review Board member responsibilities* include: Establish, encourage, and enforce policies and procedures for responding to data and information requests. Provide and continually improve standard procedures for entering, prioritizing, and responding to data and information requests. Provide for training of KSDE staff to initiate and manage data requests. Prioritize requests as needed. Assignments of requests as needed. Review and determine the legality of responding to the request as needed. Report and escalate issues to the Data Governance Board as needed. Report denials by the DRRB to fulfill requests to the Data Governance Board. Review the flow and completion of requests.

Data Request Tracking Who’s asking? When did they ask? What do they want to know? Can we answer? Must we answer? Do we need a contract? Who has the answer? When is it needed? Who can do it? Who did it? How did they do it? Did it include PISI? When was it done? When was it sent? If at all possible we provided de-identified data.

Data Request Tracking Automated email reports Reports on demand

Data Request Workflow: from request to closeout Start tracking from the beginning Know who’s responsible for each step in the process Data Request Workflow: from request to closeout Determine up front if legal agreement is required. Archive in case you need it again (RECORDATION)

Data Request Policies Charging for requests Request Denial Consistent logic Request Denial Can’t violate Open Records Act Have We have had a DAUP ever since we began collecting individual student data in 2005. Focused on FERPA issues regarding research requests for identifiable student data. But there was no gate-keeper or policies to ensure it was applied consistently and evenly Other data requests were not tracked. samples of MOU / Contract addendaum / DAUP

For Personally Identifiable Student Information MOU / Contract Required: Customized from standard template List specific data elements requested/provided Includes stated purpose of research / evaluation and limits use to that purpose Specifies individuals who may have access and holds requester responsible for training and signed acknowledgement by those individuals Requires results to be provided to KSDE prior to publication Outlines required physical and access security requirements Specifies cell-size requirement for disclosure of summarized data Specifies data destruction requirements FERPA Addendum included

Releasing Federal Data & Public Reports Data Stewards review and sign off Content and consistency Public (aggregate) reports have cell size mask

Questions?