1 PARCC Data Privacy & Security Policy December 2013

Background 2 In August 2013, PARCC began work to draft consortium data privacy & security policy with support from legal counsel The PARCC Governing Board adopted the policy on December 5, 2013 Policy reflects the input of state chiefs, state assessment directors and other SEA staff, including state legal counsel

The PARCC consortium’s Data Privacy and Security Policy is designed to ensure that PARCC and any PARCC contractors: Only have access to personally identifiable student information for specific purposes authorized by states needed to carry out assessment programs Implement specific stringent policies and procedures that protect the security of data Limit access to personally identifiable student information to only those contractors who need it for specific purposes authorized by states Ensure compliance with federal privacy laws, including FERPA 3 Purpose of the Policy

States retain responsibility for and control over their data. No data will be shared with anyone – including the federal government – without the states’ express permission. States must give permission to PARCC and contractors in order for them to access any personally identifiable information – and only for specific purposes defined by states. The policies and requirements apply not just to PARCC but to its PARCC contractors. 4 Guiding Principles

Establishes the purposes for which states would disclose PII to PARCC or PARCC contractors Establishes physical, administrative, and technical safeguards for management and control of risks– and accountability for any breaches of security Sets basic privacy protections and limits on access to PII that states provide to PARCC or PARCC contractors, such as access rules and electronic data encryption requirements Sets guidelines for the enforcement of this policy by PARCC and PARCC states, including disciplinary actions 5 Major Provisions of Proposed Data Privacy & Security Policy