EdLaw
Wyoming — student data privacy and security (W.S. 21-2-202(a)(xxxiv), (xxxvii); 21-3-110(a)(xxxv))
The three Wyoming Education Code paragraphs that govern student data: the state superintendent’s duty, with the department of enterprise technology services, to develop a data privacy and security plan for department data that includes a prohibition on the sale or trade of student data to private entities (21-2-202(a)(xxxiv)); the duty to maintain guidelines for school districts on the collection, access, privacy, security and use of student data (21-2-202(a)(xxxvii)); and each board of trustees’ duty to adopt and enforce a student-data policy in accordance with those guidelines (21-3-110(a)(xxxv)).
W.S. 21-2-202. Duties of the state superintendent
- (a) In addition to any other duties assigned by law, the state superintendent shall:
[…]
- (xxxiv) With the department of enterprise technology services, establish criteria for the collection, storage, management and reporting of department of education data including, but not limited to teacher certification, statewide education accountability and assessment and the administration of the school finance system. In carrying out this paragraph, the state superintendent and the department of enterprise technology services shall develop a data privacy and security plan that includes:
- (A) Guidelines for authorizing access to student data, including authentication of authorized access;
- (B) Privacy compliance standards;
- (C) Privacy and security audits;
- (D) Breach planning, notification and procedures pertaining thereto;
- (E) Data retention and disposition policies;
- (F) Data security policies including electronic, physical and administrative safeguards such as data encryption and employee training;
- (G) Routine and ongoing compliance with the federal Family Educational Rights and Privacy Act (FERPA) and other privacy laws and policies;
- (H) Prohibition of the sale or trade of student data to private entities or organizations;
- (J) All personally identifiable student information being reported to the department of education or the department of enterprise technology by a student's Wyoming student record identification and locator number as issued by the department of education; and
- (K) Standards and protocols to remove personally identifiable information in order to provide for data collection and analysis without disclosing the identity of the student whose data is being collected and used.
[…]
- (xxxvii) In consultation with the department of enterprise technology, the department of audit and school districts, establish and maintain guidelines for school districts for the collection, access, privacy, security and use of student data by school districts. The guidelines shall, at a minimum, be in compliance with the federal Family Educational Rights and Privacy Act and other relevant federal and state laws and include the following:
- (A) Authorization and authentication mechanisms for accessing student data;
- (B) Administrative, physical and logical security safeguards, including employee training and data encryption;
- (C) Privacy and security compliance standards;
- (D) Processes for identification of and response to data security incidents, including breach notification and mitigation procedures;
- (E) Standards for retention and verified destruction of student data.
[…]
W.S. 21-3-110. Duties of boards of trustees
- (a) The board of trustees in each school district shall:
[…]
- (xxxv) Effective January 1, 2018, adopt and enforce a policy regarding the collection, access, privacy, security and use of student data in accordance with guidelines established by the state superintendent under W.S. 21-2-202(a)(xxxvii);
[…]