Student Data Privacy: National Trends and Wyoming’s Role Mackenzie Williams Senior Assistant Attorney General Wyoming Attorney General’s Office

Hierarchy of Authority United States Constitution United States Statutory Law (U.S. Code) Wyoming Constitution Wyoming Statutory Law Wyoming Agency Rules (If Any)

Terms and Foundation Personally Identifiable Information (PII) Education Records General Public Records Principles

Federal Law FERPA: Federal Education Records and Privacy Act IDEA Primary Goals: Access to Records and Confidentiality of Records Applies to Education Entities Consequences for Violation Support: Privacy Technical Assistance Center Not administered by the Wyoming Department of Education A Note about HIPPA IDEA Federal Privacy Act: Does not apply

Some FERPA Details When may information be disclosed without consent? (34 CFR § 99.31) School officials (may include contractors) for legitimate educational needs For enrollment or transfer To various parties for audit or evaluation of programs For financial aid Juvenile justice purposes Research (anonymized) Accreditation Responding to subpoena or court order Health or safety emergency Directory information To child welfare agencies (DFS) if the child is in state custody

National Trends Lots of Activity. In 2014, 110 bills on student data privacy in 36 states. Wyoming was one. In 2015, 184 bills in 46 states. Wyoming was one. Several goals of legislation and other activities: Governing how third-party providers use student data Directly by legislating activities Indirectly by governing contracts with third-party providers Support for districts Parental opt-in/-out Address concerns of commercializing student data Transparency

Wyoming Developments (From 2014) 2014 Enrolled Act 66: Requires the Superintendent to develop guidelines for districts to use on the subject of data use (more later) Note that 2014 Senate File 36 did something similar, but did not pass 2015 House Bill 164: Prevented schools from sharing any PII without parental consent. Excluded Title I reporting. Failed. 2016 Senate File 14: Outlawed and criminalized school officials from asking students for access to student digital information accounts. Failed. 2016 House Enrolled Act 25 (Wyo. Stat. Ann. § 16-3-202): Excludes student- to-student or student-to-outside party communications in the custody of a school from the definition of a public record under the Public Records Act.

Wyoming Developments (From 2014) 2016 Senate Enrolled Act 18 (Wyo. Stat. Ann. § 9-21-101): Requires that government agencies establish data policies containing the following: Descriptions of data being stored Authorization and authentication mechanisms for data access Descriptions of security safeguards including staff training Policies describing privacy processes Descriptions of how the agency will handle breaches, including notification of affected individuals Descriptions of data destruction and transmission mechanisms

Wyoming Law Public Records Act Default: public records are available to the public. Categories: May deny inspection, shall deny inspection Education records are “shall withhold”: “School district records containing information relating to the biography, family, physiology, religion, academic achievement and physical or mental ability of any student except to the person in interest or the officials duly elected and appointed to supervise him.” Wyo. Stat. Ann. § 16-3-203(c)(viii). Also, Public Records Act prohibits disclosure where contrary to federal law, i.e., FERPA

Wyoming Law Duties of the Superintendent of Public Instruction Develop criteria for the collection, storage, management, and reporting of various kinds of data Includes guidelines for access, privacy audits, breach planning and procedures, and more Collect data necessary to administer the school finance system On the State Board of Education’s behalf, collect data for accreditation, which may include student data Collect information for the Wyoming Accountability in Education Act, including student data Collect data to monitor district compliance with the IDEA and investigate complaints District duties: must have policies

Questions? Mackenzie Williams Senior Assistant Attorney General, Civil Division Wyoming Attorney General’s Office mackenzie.williams@wyo.gov 307-777-7886