Regulating the Student Data System in the State of Colorado

Colorado HB 1294 is a student data privacy and protection law that was passed in 2014. In conjunction with HB 1423, which was enacted two years after HB 1294 in 2016, the two laws make up the student data protection framework within the state of Colorado. To this point, HB 1294 established a statewide longitudinal data system that could be used to store the personal information of students enrolled in k-12 education programs and institutions around the state. With this being said, the provision of the law set forth the steps and measures that educators are required to adhere to as it pertains to protecting the various data elements contained within the statewide student data system.

How is personally identifiable data defined under the law?

Under Colorado HB 1294, personally identifiable data is defined as “a dataset that is linked to a specific student or the student’s parent or legal guardian and that would allow a reasonable person in the school community, who does not have knowledge of the relevant circumstances, to identify the student, parent, or legal guardian with reasonable certainty.” Alternatively, the law defines aggregate data as “data collected and reported at the group, cohort, or institution level”, while the law defines as a data system as the “Colorado State Department of Education Student Data System.”

What are the duties of school districts under the law?

The Colorado State Board of Education or CDE for short has the following student data and privacy protections responsibilities under the sections and provisions of Colorado HB 1294:

• The CDE is responsible for creating and publishing a data inventory, dictionary, or index of data elements that will be collected from K-12 students within the state, as well as definitions for these data elements. Moreover, this information must be made publicly available.
• The CDE is responsible for creating and publishing protocols that can be used to govern the authorized use, access, and disclosure of student data on behalf of teachers, authorized staff, department contractors, school district administrators, and parents and their parents or guardians. This information must be made publicly available, and must also be in accordance with the provisions of the Family Educational Rights and Privacy Act or FERPA for short.
• The CDE is responsible for developing and implementing a detailed student data security plan including privacy compliance, audit, and security measures, as well as data breach planning and standards that can be used to regulate the retention and disposal of student data.
• The CDE is responsible for ensuring that all student data is destroyed once said data is no longer needed to achieve the purpose for which it was collected.
• The CDE is responsible for publishing user-friendly data in relation to all data-sharing agreements that are fostered between the CDE and the various educational institutions within the state.
• The CDE is responsible for providing educators, online operators, and other related school administrators and faculty members with the training and support needed to implement the provisions of the law in an effective and efficient manner.

What data elements are protected under the law?

The specific data elements concerning K-12 students enrolled in educational institutions within the state of Colorado that are legally protected from unauthorized access and disclosure under HB 1294 include but are not limited to:

• State-administered test results.
• Participation information.
• Courses taken and completed.
• Credits earned.
• Grade level and expected graduation date.
• Credential attainment.
• Attendance and mobility information.
• Special education data.
• Dates and places of birth.
• Social security numbers.
• Telephone numbers.
• Email addresses.
• Full names.
• Gender.
• Race.
• Ethnicity.

As the state of Colorado has taken major steps to protect the personal information and data of their respective citizens in recent years, perhaps best evidenced by the enactment of the Colorado Privacy Act last year, it is fitting that the state has also taken legislative measures to protect the privacy of K-12 students that are enrolled in educational institutions within the state. Through the provisions of both, HB 1294 and HB 1423, parents and guardians within the state of Colorado have a number of ways to ensure that the personal information their children disclose to their educators when looking to achieve their academic goals is being safeguarded from harm and misuse at all times.