Protecting Student Data in the State of North Dakota

North Dakota’s SB 2326 is a student data privacy law that was enacted in 2015. SB 2326 was passed in order to govern and regulate the personal information that K-12 students within the state of North Dakota disclose the longitudinal data systems when seeking to advance their respective educational careers. As such, the law outlines the specific educators and school personnel that are permitted to access the personal information of students, as well as the procedures that must be followed when accessing this information. Moreover, the law also establishes the specific data elements concerning students within North Dakota that are legally protected from unauthorized access, use, and disclosure.

What are the duties of school districts under the law?

Some of the steps and precautions that school districts within the state of North Dakota are responsible for taking under North Dakota’s SB 2326 include:

• School districts are responsible for adopting policies that will govern the collection, use, and disclosure of the personal data of their respective students.
• The data protection policies of school districts must mandate that permission be granted to an individual on behalf of a particular school district prior to disclosing the personal information of a student.
• School districts are responsible for providing a copy of their data protection policies upon request.
• School district superintendents are responsible for compiling a list detailing all entities with whom personal student data is shared, by title, as well as all school personnel that will have access to such data.

Statewide longitudinal data system committee

In addition to the responsibilities that school districts have under North Dakota’s SB 2326, the law also established a statewide longitudinal data system committee, charged with overseeing and managing the various data elements that students within the state provide to their teachers, school service providers, and other related personnel. With this being said, the duties of the statewide longitudinal data system committee under North Dakota’s SB 2326 include but are not limited to:

• The statewide longitudinal data system committee is responsible for developing policies and rules that will govern the collection, access, storage, and sharing of the personal data contained within the system.
• The statewide longitudinal data system committee is responsible for creating a policy that can be followed in the event that a data breach occurs.
• The statewide longitudinal data system committee is responsible for creating terms that can be used to regulate the manner in which individuals outside of the scope of educational professionals may be authorized to access the data system.
• The statewide longitudinal data system committee is responsible for ensuring that all personnel that manages the data system receives annual training concerning the matters of data protection and personal privacy.

What data elements are protected under the law?

Some of the data elements pertaining to K-12 students that are legally protected under the provisions of North Dakota’s SB 2326 include:

• Student identification numbers.
• Social security numbers.
• Telephone numbers.
• Dates of attendance.
• Dates of birth.
• Participation information.
• The names of students and their family members.
• Mother’s maiden name.
• Student identification cards.
• Biometric records.
• Special education data.
• Email addresses.

Maintaining compliance with the law

As it relates to maintaining compliance with the law, the various educators, teachers, and other relevant professionals that work to provide children within the state of North Dakota with educational services will undoubtedly face instances where they must disclose this information for legitimate purposes. As such, one way in which professionals within North Dakota can maintain compliance with legislation such as SB 2326 is through the use of automatic redaction software. Using such software, educators can effectively use the personal information of their students to help them further their educational endeavors, while simultaneously redacting or obscuring any information that is not pertinent to such goals. In this way, these educators can prevent the personal data of their students from entering the wrong hands.

As many K-12 educational institutions around the country have turned to the use of longitudinal data systems to store and protect the personal information of their students, legislation is very much needed to ensure that the data contained within such systems is handled appropriately. In the context of the state of North Dakota, such legislation has taken the form of SB 2326, as the provisions of the law give parents and guardians the assurance that the personal data their children submit to their teachers will be protected from harm and misuse. More importantly, however, the law also ensures that this data can be used to help improve the educational futures of K-12 students within North Dakota.