EdLaw
Kansas — Student Data Privacy Act (K.S.A. 72-6312 to 72-6320)
Kansas's student-records statute (L. 2014, ch. 124). It governs educational agencies' collection and disclosure of student data and reaches their contractors directly: disclosure of personally identifiable student data is permitted to a contractor only under the act's conditions, biometric data may not be collected without written consent, and a security breach or unauthorized disclosure triggers notification duties.
K.S.A. 72-6312. Student data privacy act; citation of act
K.S.A. 72-6312 through 72-6320, and amendments thereto, shall be known and may be cited as the student data privacy act.
K.S.A. 72-6313. Definitions
As used in K.S.A. 72-6312 through 72-6320, and amendments thereto:
(a) "Aggregate data" means data collected or reported at the group, cohort or institutional level and which contains no personally identifiable student data.
(b) "Biometric data" means one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual, such as fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics and handwriting.
(d) "Directory information" means a student's name, address, telephone listing, participation in officially recognized activities and sports, weight and height if the student is a member of an athletic team, and degrees, honors or awards received.
(f) "School district" means a unified school district organized and operated under the laws of this state.
(g) "Statewide longitudinal student data system" means any student data system maintained by the department, which assigns a state identification number for each student who attends an accredited public or private school in Kansas and uses the state identification number to collect student data.
- (1) State and national assessment results, including information on untested students;
- (2) course taking and completion, credits earned and other transcript information;
- (3) course grades and grade point average;
- (4) date of birth, grade level and expected date of graduation;
- (5) degree, diploma, credential attainment and other school exit information such as general education development and drop-out data;
- (6) attendance and mobility;
- (7) data required to calculate the federal four-year adjusted cohort graduation rate, including sufficient exit and drop-out information;
- (8) remediation;
- (9) special education data;
- (10) demographic data and program participation information; and
- (11) any other information included in a student's educational record.
(i) "Personally identifiable student data" means student data that, alone or in combination, is linked or linkable to a specific student and would allow a reasonable person to identify the student with reasonable certainty.
K.S.A. 72-6314. Disclosure of data; requirements for disclosure
(a) Any student data submitted to and maintained by a statewide longitudinal student data system shall only be disclosed by an educational agency in accordance with the provisions of this section. An educational agency shall provide annual written notice to each student's parent or legal guardian that student data may be disclosed in accordance with this section. Such notice shall be signed by the student's parent or legal guardian and maintained on file with the district.
- (1) The authorized personnel of an educational agency who require such disclosures to perform their assigned duties;
- (2) the authorized personnel of the state board of regents who require such disclosures to perform their assigned duties; and
- (3) the student and the parent or legal guardian of the student, provided the student data pertains solely to such student.
(c) Student data may be disclosed to the authorized personnel of any state agency not specified in subsection (b), or to a service provider of a state agency, educational agency or school who is engaged to perform a function of instruction, assessment or longitudinal reporting, provided there is a data-sharing agreement between the educational agency and such other state agency or service provider that provides the following:
- (1) The purpose, scope and duration of the data-sharing agreement;
- (2) that the recipient of the student data use such information solely for the purposes specified in the agreement;
- (3) that the recipient shall comply with data access, use and security restrictions that are specifically described in the agreement; and
- (4) that the student data shall be destroyed when no longer necessary for the purposes of the data-sharing agreement or upon expiration of the data-sharing agreement, whichever occurs first. Except that a service provider engaged to perform a function of instruction may retain student transcripts as required by applicable laws and rules and regulations. Destruction shall comply with the NISTSP800-88 standards of data destruction.
- (1) Except as otherwise provided in paragraph (2), student data may be disclosed to any governmental entity not specified in subsection (b) or (c), or to any public or private audit and evaluation or research organization, provided that only aggregate data is disclosed to such governmental entity or audit and evaluation or research organization.
- (2) Personally identifiable student data may be disclosed if the student, if an adult, or the parent or legal guardian of the student, if a minor, consents to such disclosure in writing.
(e) Notwithstanding the provisions of subsections (b), (c) and (d), an educational agency may disclose:
- (1) Directory information of a student when such agency deems such disclosure necessary and the disclosure of which has been consented to in writing by such student's parent or legal guardian;
- (2) directory information to an enhancement vendor that provides photography services, class ring services, yearbook publishing services, memorabilia services or other substantially similar services;
- (3) any information required to be disclosed pursuant to K.S.A. 65-101, 65-118 and 65-202, and amendments thereto, provided such information is disclosed in accordance with any provisions of such statutes regarding the confidentiality and disclosure of such information;
- (4) any student data in order to comply with any lawful subpoena or court order directing such disclosure; and
- (5) student data to a public or private postsecondary educational institution which is required by such postsecondary educational institution for the purposes of application or admission of a student to such postsecondary educational institution, provided that such disclosure is consented to in writing by such student.
K.S.A. 72-6315. Collection of biometric data prohibited
No school district shall collect biometric data from a student, or use any device or mechanism to assess a student's physiological or emotional state, unless the student, if an adult, or the parent or legal guardian of the student, if a minor, consents in writing.
K.S.A. 72-6316. Administration of certain nonacademic tests, questionnaires, surveys or examinations; written consent required; emergency exception
(a) A nonacademic test, questionnaire, survey or examination containing any questions about the personal and private attitudes, values, beliefs or practices of the student or the student's parents, guardians, family members, associates, friends or peers that is administered during the school day shall not be administered to any student enrolled in kindergarten or grades one through 12, unless the parent or guardian of the student:
- (1) Is notified in writing not more than four months in advance of the administration of such test, questionnaire, survey or examination that such test, questionnaire, survey or examination is to be administered. Such notification shall include:
- (A) A copy of the test, questionnaire, survey or examination that is to be administered;
- (B) information on how the parent or guardian may provide written consent to authorize the student to take such test, questionnaire, survey or examination;
- (C) the name of the company or entity that produces or provides the test, questionnaire, survey or examination to the school; and
- (D) whether the school will receive or maintain the resulting data and an explanation of how the school intends to use and maintain such data; and
- (2) gives written consent through a written or electronic signature to authorize the student to take the test, questionnaire, survey or examination or, in the event of an immediate need, gives verbal consent. Such written consent may only be accepted after a parent or guardian has received the notification required pursuant to paragraph (1) and had an opportunity to review the information contained in such notification. Written consent shall be provided separately for each individual test, questionnaire, survey or examination that is to be administered.
(b) Notwithstanding a parent or guardian's consent for a student to take any such test, questionnaire, survey or examination, a student shall have the right to refuse to take any such test, questionnaire, survey or examination at any time without limitation. Prior to the administration of any such test, questionnaire, survey or examination, each student shall be informed that such student has the right to refuse to take such test, questionnaire, survey or examination and that the student will not suffer any adverse consequences based on such refusal.
(c) Prior to the administration of any such test, questionnaire, survey or examination, a school district shall post and maintain a copy of such test, questionnaire, survey or examination on the school district website.
(d) No personally identifiable student data shall be collected through any such test, questionnaire, survey or examination.
(e) Except as provided in subsection (f), the provisions of this section shall apply to any test, questionnaire, survey or examination described in subsection (a) that is administered or proposed to be administered to any student by any employee of a school district, including, but not limited to, any administrator, teacher, counselor, social worker, psychologist or nurse.
(f) Notwithstanding the provisions of this section, if any school district employee becomes aware that a student may be at risk of suicide by a credible report from the student, the student's peers or another school district employee, the school personnel who are designated by the school to administer a suicide risk assessment or screening tool may administer such risk assessment or screening tool in accordance with the provisions of this subsection to determine whether the student could be at risk for suicide. Such designated school personnel may include, but is not limited to, any administrator, teacher, counselor, social worker, psychologist or nurse. Prior to the administration of any such risk assessment or screening tool, the designated school personnel shall verbally notify the parent or guardian before the administration of such risk assessment or screening tool and obtain the consent of the parent or guardian. If the designated school personnel is unable to verbally notify the parent or guardian of the student and obtain consent after reasonable attempts to do so, the designated school personnel may administer the risk assessment or screening tool without such consent. If a risk assessment or screening tool is administered without the parent or guardian's consent, as soon as contact with the parent or guardian is made, the designated school personnel shall notify the parent or guardian of the administration of such assessment or screening tool and provide to the parent or guardian all information obtained from the risk assessment or screening tool administered to the student.
K.S.A. 72-6317. Enforcement of act
The attorney general or any district attorney may enforce the provisions of K.S.A. 72-6312 through 72-6319, and amendments thereto, by bringing an action in a court of competent jurisdiction, and may seek injunctive relief to enjoin any educational agency, any employee or agent thereof, or any other entity in possession of student data from disclosing any student data in violation of the provisions of K.S.A. 72-6312 through 72-6319, and amendments thereto.
K.S.A. 72-6318. Security breach or unauthorized disclosure; notification, when
In the event of a security breach or unauthorized disclosure of student data or personally identifiable information of any student, whether by a school district, the department, the state board of education, state agency, or other entity or third party given access to student data or personally identifiable information of any student, the school district, department, state board of education, state agency, or other entity or third party shall immediately notify each affected student, if an adult, or the parent or legal guardian of the student, if a minor, of the breach or unauthorized disclosure and investigate the causes and consequences of the breach or unauthorized disclosure.
K.S.A. 72-6319. Publication of statewide longitudinal student data system categories of student data
The department shall annually publish on its website the categories of student data that are submitted to and maintained in any statewide longitudinal student data system. Publications required by this section shall be published with an easily identifiable link located on the department's website homepage.
K.S.A. 72-6320. Annual report to governor and legislature
On or before May 15, 2015, and each year thereafter, the state board shall submit to the governor and the legislature a written report. The report shall include, but not be limited to, the following information:
(a) Any categories of student data collected for the statewide longitudinal student data system that are not otherwise described as student data under K.S.A. 72-6313, and amendments thereto;
(b) any changes to existing data collections, which includes changes to federal reporting requirements by the secretary of the United States department of education;