Student Data Privacy Legislation in the State of Indiana

Indiana HB 1003 is a student data protection and personal privacy law that was enacted in 2014. The law was passed for the purpose of regulating various aspects of the state of Indiana’s educational system, ranging from job skills development to career training programs, as well as the grants and other related funding that is required to maintain such programs. Furthermore, the law also mandates that educators take a wide variety of steps to ensure that the personal information of students that are enrolled in K-12 educational institutions is safeguarded from unauthorized disclosure.

How is the term school corporation defined under the law?

Indiana HB 1003 defines a school corporation as a “local public school corporation established under state law. The term includes a school city, school town, metropolitan school district, consolidated school corporation, county school corporation, township school corporation, community school corporation, or united school corporation.” Alternatively, the law defines a charter school as “a public elementary school or secondary school established under this article that: (1) is nonsectarian and nonreligious; and (2) operates under a charter.”

What are the duties of educators under the law?

The data privacy and protection responsibilities that educators have under Indiana HB 1003 as it pertains to safeguarding the personal information of students that attend school corporations and charter schools around the state include:

• Educators must ensure that personal information obtained from K-12 students is used solely for educational purposes.
• Educators must not retain the personal information of students for any period of time longer than is necessary to achieve the purposes for which it was collected.
• Educators must develop and implement a data security plan that can be used to protect the privacy of their students. This data security plan must include the performance of regular compliance audits in accordance with applicable data privacy and security standards.
• Educators must refrain from collecting certain categories of personal data from students. These data elements include disciplinary records, juvenile dependency records, criminal records, and health and medical records.
• Educators must ensure that The Indiana workforce intelligence system network of knowledge or INK, the Indiana state-wide longitudinal data system, is protected from unauthorized access, use, and disclosure.

What categories of personal data are protected under the law?

The categories of personal data pertaining to K-12 students within the state of Indiana that are legally protected from unauthorized disclosure include but are not limited to:

• First and last names.
• Dates and places of birth.
• Mother’s maiden name.
• Biometric records.
• Telephone numbers.
• Email addresses.
• Home addresses.
• Photos.
• Audio and voice recordings.
• Geolocation data.
• Transcript data.
• Special education data.
• Food purchase.
• Religious information.
• Political information.

Redaction and student privacy

Automatic redaction software is an ideal way for educators within the state of Indiana to about protecting the personal privacy of their respective students. For example, educators will need to send emails containing student information in order to provide said students with postsecondary educational opportunities such as grants and scholarships. Conversely, legislation such as Indiana HB 1003 mandates that student data is protected at all times. With all this being said, an educator could utilize an automatic redaction software program to ensure that they can both use student data to help students advance their academic careers, while simultaneously ensuring that this data remains confidential.

While consumers may not be thinking about student data when considering the scope and impact of data privacy legislation in the U.S., students disclose their personal data just as any other adult around the world would. To this point, legislation is very much necessary to protect the various forms of personal data that students provide to their teachers, school administrators, and online operators on a daily basis. Within the state of Indiana, this legislation has taken the form of HB 1003, effectively giving parents within the state the peace of mind that the personal data of their school-aged children is being protected at all times.