4 Student Data Principles. Supported by 32 Education Groups.

The Data Quality Campaign joined the Consortium for School Networking to set forth principles to guide student data regulation. The goal is to protect student data while doing no harm to schools. 4 points they all agree on:

  • Student data should be used to further and support student learning and success.
  • Students, families, and educators should have timely access to information collected about the student.
  • Students’ personal information should only be shared with service providers for legitimate educational purposes.
  • Everyone who has access to students’ personal information should be trained on how to effectively and ethically use, protect, and secure it.

The Consortium includes:

  1. Alliance for Excellent Education
  2. AASA: The School Superintendents Association
  3. American Association of Colleges for Teacher Education
  4. American Association of School Librarians
  5. Association of School Business Officials International
  6. Consortium for School Networking
  7. Council for the Accreditation of Educator Preparation
  8. Council of Chief State School Officers
  9. Data Quality Campaign
  10. Digital Promise
  11. Education Trust
  12. Educators 4 Excellence
  13. Foundation for Excellence in Education
  14. Institute for Higher Education Policy
  15. International Association for K12 Online Learning
  16. International Society for Technology in Education
  17. National Association of Secondary School Principals
  18. National Association of State Boards of Education
  19. National Association of State Directors of Teacher Education and Certification
  20. National Center for Learning Disabilities
  21. National Council on Teacher Quality
  22. National Education Association
  23. National Parent Teacher Association
  24. National School Boards Association
  25. PDK International
  26. SIF Association
  27. Stand for Children
  28. State Education Technology Directors Association
  29. State Higher Education Executive Officers Association
  30. StriveTogether
  31. StudentsFirst
  32. Thomas B. Fordham Institute

Education Week

Bill Filing: Protecting Student Data 8 Ways

Van Deaver has filed HB 2156 which the author says protects student data in 8 ways.

• Not sell student information;
• Not behaviorally target advertising;
• Use data for authorized education purposes only;
• Not change privacy policies without notice and choice;
• Enforce strict limits on data retention;
• Support parental access to, and correction of errors in, their children’s information;
• Provide comprehensive security standards; and,
• Be transparent about the collection and use of data. 

VanDeaver Press Release

Lege Trend: Re-defining Private Data in the Land of Lincoln

The Illinois Attorney General is working to expand the definition of what is private information that triggers data breach notifications.

She wants to include the following information:

  • email addresses
  • log-ins
  • passwords
  • Health insurance information
  •  biometric information
  • geolocation information

Her proposal doesn’t specify when the consumer and the Attorney General office must be notified. Instead,   businesses are granted flexibility by requiring that business take “reasonable steps” to protect information that it holds.   

S.B. 1833

 
 
 

 

40 Class Action Law Suits From Anthem Inc. Data Breach

Hailed as a victory for plaintiff’s lawyers, class actions are proceeding for data breaches at Target and Sony. Since the February breach at Anthem, more than 40 class action lawsuits have been filed. 

Legal experts say data breach cases move forward when the plaintiff can allege:

  • “Statutory damages, such as a particular state’s data-breach law, or
  • if there are known sales of stolen identities on the black market”
    National Law Journal

Lege Trend: Higher Health Care Data Privacy Standards

Connecticut’s  SB1024 applies higher data privacy standards on health care providers, by establishing regulations through the department of insurance. 

Which health care entities are affected?

  • health insurers
  • HMOs
  • “other entities licensed to do health insurance business in Connecticut,”
  • pharmacy benefits managers
  • third-party administrators that administer health benefits
  • utilization review companies

What are these health care businesses required to do?

  • encrypt health care data that it maintains

What personal information information are health care entities required to encrypt?

  •  individual’s first name or initial and last name in combination with one or more of the following:
  • Social Security number
  •  driver’s license number
  • address
  • or identifiable health information

The 2015 CT bill follows in the path of the New Jersey health care data privacy bill.  

Day Pitney 

 

Preeminent Data Security Attorney Supports State Regulation over Federal Regulation. 3 Ways Business Needs Flexibility in Data Security Legislation.

Theodore Kobus III, co-leader of the Privacy and Data Security Practice at Baker Hostetler, favors state regulation over one size fits all federal regulation of data security notification. 

He suggests the right template for data security is HIPAA’s approach. HIPPA has been functioning for more than 10 years and has no uniform standard for security.

Businesses need flexibility to respond to data breaches. The flexibility is necessary based on 3 factors:

  • size of the business
  • budget of the business
  • industry of the business. 

Inside Counsel