Data Security in a Digital World Louisiana and

Data Security in a Digital World Louisiana and PII Security S

Personally Identifiable Information (PII) Information that can be used to distinguish an individual Indirect PII Direct PII Information that can be combined with other information to identify a specific individual Information that relates specifically to an individual (SSN, Name, Date of Birth)

Timeline Data Sharing Agree ments Posted (1/1/15) Act 837 (2014) Act 677 (2014) No release of PII to outside parties (6/1/15)* Release of Secure ID (6/1/15)* * Modified by Act 228 (2015) No release of PII moved to 8/1/15 Act 228 (2015) Release of Secure ID moved to 8/1/15

2014 Legislative Session S Act 837 S S S S Prohibits LEAs from requiring the collection of non-academic data about students such as political affiliation, religious practices, or information. Restricts LEAs from sharing personally identifiable information (PII) about students with external entities, including LDE, starting June 1, 2015. The law provides limited exceptions: S LEAs may share students’ personally identifiable information with LDE if: S The parent has given written consent to share that information. S The state requires it for auditing, including enrollment counts. S LEAs may share PII with a private entity if they sign a data sharing agreement. Requires that all data sharing agreements be publicly posted. Defines PII as any two pieces of identifiable information. As such, first and last name are considered two pieces of identifiable information. Creation and release of Louisiana Secure ID for all students by June 1, 2015. All data sharing agreement with external vendors must be in place by June 1, 2015. Provides for up to $10, 000 fine and/or 3 years in prison for illegal release of each identity.

2014 Legislative Session S Act 677 S Requires public posting of : S All PII data transfer agreements by Jan. 1, 2015 S All new agreements must be posted within 10 days of signing S Profiles of each data recipient S List of all data transferred S Data Security Coordinator contact information S Process for filing a complaint

Act 837 Benefits S Codifies what is and isn’t PII S Mandates data and identity security S Provided for a unified identifier for students Disadvantages S Very narrow window to comply with all aspects of the law S Definition of PII very broad and amorphous S Was subject to broadly differing interpretations by districts S Made schools and districts inoperable due to restrictions

Act 677 Benefits S Provided for transparency in data transfers and agreements surrounding them Disadvantages S Extremely short time frame to comply S Required districts to renegotiate with vendors regarding data transfers S Required extensive legal counsel and time to negotiate with some recalcitrant vendors

2015 Legislative Session S Act 228 S Clarifies language and narrows the definition of release of PII under Acts 837 & 677. S Changes date for end of data sharing without data transfer agreement from June 1, 2015 to August 1, 2015 S Changes date of release of Louisiana Secure ID from June 1, 2015 to August 1, 2015

Act 228 Benefits S Redefined, narrowed, and clarified definition of PII and the restrictions on it S Moved dates for posting of data transfer agreements and issuance of Louisiana Secure ID to August 1, 2015 Disadvantages S None

Securing Data S Physical Security S Data Sharing S Secure ID S Data linkage S Consent

Physical Security S No access for unauthorized individuals S All data is secured in via encryption or physical barriers S No “shoulder surfing” S Workers only allowed to access data on department owned devices and no sharing of devices S Destruction of data S All data destroyed after use S All storage devices destroyed at end-of-life S Secure transmittal S No fax transmittal S s. FTP transfer only

Data Sharing S All vendors must sign and adhere to updated data sharing agreements S Data sharing agreements must comply with both federal and state laws S Data sharing agreements must publicly posted

Secure ID S All students issued a new state-wide Secure ID Number S No connection to any direct or indirect PII S Generated by state and issued to student at enrollment in public and non-public schools S Secure ID follows student throughout educational career, regardless of where they are enrolled

Data Linkage S In order for student records to be secure, Secure ID is not linked to state student records and PII is not linked to local student records S In order to link PII and Secure ID data, third party must do ID matchup S Prevents any one entity from having all of the pieces

Data Linkage Third Party Performs Data Linkage School District Submits Secure ID State Submits PII

Consent S All voluntary data sharing must be consented to by parent (or student of majority age) S Includes: S S S Transcripts to post-secondary institutions, scholarship, and financial aid programs All public news or publication entities including yearbook, school paper, graduation programs, etc. Data includes: S S Student name Photos Grade information Racial information Classification information

More Information http: //www. louisianabelieves. com/resources/library/datacenter/protecting-student-privacy

Questions