# data[].attributes.body
Student's privacy has always been our top priority along with their safety in my school district. With the release of student's records one puts that student safety in risk. As a teacher, I believe information belonging to student's should not be released no matter if parent gave consent or not. Student's privacy involves any school personnel from principal, teacher, aide, substitute, janitors, and any other person from an educational facility. This is a topic that was chosen because of the much needed privacy and safety of the student.

# data[].attributes.body
Governing bodies differ between state and federal level. The governing bodies at the state level govern only their state. While federal governing bodies govern the nation. This is the same for accountability. When the state is accountable its only accountable for their state's actions while the federal is accountable for the nation's actions.
The governing body for the state of Texas who is in charge of protecting the student's records/privacy  is the Texas Education Agency (TEA). TEA is an agency who is in in charge of all public schools in Texas. As stated by TEA "The work of TEA and the entire public school system is driven by laws created by the Texas Legislature and the U.S. Congress and administrative rules adopted by the commissioner of education, the State Board of Education, and the State Board for Educator Certification (About TEA | Texas Education Agency, n.d.)."
The governing body at the federal level who is in charge of student's privacy/records is the U.S. Department of Education. The U.S. Department of Education states that any educational agency that receives funds "must adhere to federal privacy laws pertaining to education records of students (Forum Guide to Protecting the Privacy of Student Information: State and Local Education Agencies - 2.A. Privacy-Related Laws That Apply to Agencies and Schools, n.d.) ."

Reference:
About TEA | Texas Education Agency. (n.d.). https://tea.texas.gov/about-tea

Forum Guide to Protecting the Privacy of Student Information: State and Local Education Agencies - 2.A. Privacy-Related Laws That Apply to Agencies and Schools. (n.d.). https://nces.ed.gov/pubs2004/privacy/section_2a.asp

# data[].attributes.body
State Law: Parental Rights and Responsibilities (statute)
-schools are required to keep some records permanently
-schools should notify parents of release of directory information.
-schools should allow parents time to deny the right for the school to release any or all information of the student.
(Student Directory Information, 2005)

References:
Student Directory Information, Tex. Stat. § 26.013. (2005)

References:
Family Educational and Privacy Act, 20 U.S. Code 20 § 1232g

# data[].attributes.attachment_link.title
EDUCATION CODE CHAPTER 26. PARENTAL RIGHTS AND RESPONSIBILITIES

# data[].attributes.attachment_link.description
EDUCATION CODE TITLE 2. PUBLIC EDUCATION SUBTITLE E. STUDENTS AND PARENTS CHAPTER 26. PARENTAL RIGHTS AND RESPONSIBILITIES Sec. 26.001. PURPOSE. (a) Parents are partners with educators, administrators, and school district boards of trustees in their children's education. Parents shall be encouraged to actively participate in creating and implementing educational programs for their children.

# data[].attributes.body
Federal Law: Family Educational and Privacy Act
Family Educational and Privacy Act is an amendment which states that student's records are safe with the institution who created them. Any or all information that is requested must "Any educational agency or institution making public directory information shall give public notice of the categories of information which it has designated as such information with respect to each student attending the institution or agency and shall allow a reasonable period of time after such notice has been given for a parent to inform the institution or agency that any or all of the information designated should not be released without the parent’s prior consent (Family Educational and Privacy Act, 20 U.S. Code 20 § 1232g, n.d)

References:
Family Educational and Privacy Act, 20 U.S. Code 20 § 1232g

# data[].attributes.body
Parental Rights and Responsibilities (statute):
-schools are required to keep some records permanently
-schools should notify parents of release of directory information.
-schools should allow parents time to deny the right for the school to release any or all information of the student.
(Student Directory Information, 2005)

References:
Student Directory Information, Tex. Stat. § 26.013. (2005)

References:
Family Educational and Privacy Act, 20 U.S. Code 20 § 1232g

# data[].attributes.attachment_link.title
EDUCATION CODE CHAPTER 26. PARENTAL RIGHTS AND RESPONSIBILITIES

# data[].attributes.attachment_link.description
EDUCATION CODE TITLE 2. PUBLIC EDUCATION SUBTITLE E. STUDENTS AND PARENTS CHAPTER 26. PARENTAL RIGHTS AND RESPONSIBILITIES Sec. 26.001. PURPOSE. (a) Parents are partners with educators, administrators, and school district boards of trustees in their children's education. Parents shall be encouraged to actively participate in creating and implementing educational programs for their children.

# data[].attributes.body
Family Educational Rights and Privacy Act (Administrative Law):
FERPA is a " Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education (20 U.S.C. § 1232g, n.d)."
-parents and eligible students have the right to request for a school to correct student's records.
-parents and eligible students have the right to inspect and review student's records.
-"schools must have written permission from the parent or eligible student in order to release any information from a student's education record (20 U.S.C. § 1232g, n.d)."

"FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law (20 U.S.C. § 1232g, n.d)."

References:
20 U.S.C. § 1232g, n.d

# data[].attributes.attachment_link.readable_text
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."

Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.

Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law.

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

# data[].attributes.attachment_link.keywords[]
policy; privacy; academic records; technical assistance; parent rights; student rights; ferpa

# data[].attributes.attachment_link.title
Family Educational Rights and Privacy Act (FERPA)

# data[].attributes.attachment_link.description
Family Educational Rights and Privacy Act (FERPA) Home Page.

# data[].attributes.body
Family Educational Rights and Privacy Act (Federal Law):
FERPA is a " Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education (20 U.S.C. § 1232g, n.d)."
-parents and eligible students have the right to request for a school to correct student's records.
-parents and eligible students have the right to inspect and review student's records.
-"schools must have written permission from the parent or eligible student in order to release any information from a student's education record (20 U.S.C. § 1232g, n.d)."

"FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law (20 U.S.C. § 1232g, n.d)."

References:
20 U.S.C. § 1232g, n.d

# data[].attributes.attachment_link.readable_text
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."

Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.

Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law.

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

# data[].attributes.attachment_link.keywords[]
policy; privacy; academic records; technical assistance; parent rights; student rights; ferpa

# data[].attributes.attachment_link.title
Family Educational Rights and Privacy Act (FERPA)

# data[].attributes.attachment_link.description
Family Educational Rights and Privacy Act (FERPA) Home Page.

# data[].attributes.body
Family Educational Rights and Privacy Act (Federal Law):
FERPA is a " Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education (20 U.S.C. § 1232g, n.d)."
-parents and eligible students have the right to request for a school to correct student's records.
-parents and eligible students have the right to inspect and review student's records.
-"schools must have written permission from the parent or eligible student in order to release any information from a student's education record (20 U.S.C. § 1232g, n.d)."

"FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law (20 U.S.C. § 1232g, n.d)."

References:
20 U.S.C. § 1232g, n.d

# data[].attributes.attachment_link.readable_text
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."

Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.

Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law.

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

# data[].attributes.attachment_link.keywords[]
policy; privacy; academic records; technical assistance; parent rights; student rights; ferpa

# data[].attributes.attachment_link.title
Family Educational Rights and Privacy Act (FERPA)

# data[].attributes.attachment_link.description
Family Educational Rights and Privacy Act (FERPA) Home Page.

# data[].attributes.body
San Felipe Del Rio CISD student handbook is a policy that the district adopted based of FERPA. It states the rights parents and student's have in requesting and denying the right for student records to be released.

"These rights, as discussed here and at Objecting to the Release of Directory Information, are the right to:
- Inspect and review student records within 45 days after the day the school receives a request for access;
- Request an amendment to a student record the parent or eligible student believes is inaccurate, misleading, or otherwise in violation of FERPA;
- Provide written consent before the school discloses personally identifiable information from the student’s records, except to the extent that FERPA authorizes disclosure without consent; and
-File a complaint (https://studentprivacy.ed.gov/file-acomplaint with the U.S. Department of Education concerning failures by the school to comply with FERPA requirements (San Felipe Del Rio CISD Board Policy Manual, n.d.)"

References:
San Felipe Del Rio CISD Board Policy Manual - Policy Online. (n.d.). Retrieved November 5,

2022, from https://pol.tasb.org/PolicyOnline?key=1180

# data[].attributes.body
Some risk management strategies that can be used to prevent student's data be released are:
-"providing regular training, updating applications, or maintaining policies and procedures.
-All ongoing action and technology used to identify potential data breaches, loss, or malicious attacks. Detective measures could include hardware/software alerts, compliance monitoring, or threat detection applications.
-Corrective measures should include an incident response plan, corrective plan/actions, and recovery plan/actions.

A school responds to each of these measures using administrative controls, technological controls, or physical controls.

Administrative controls approach data security and privacy by limiting access to specific applications or types of data.

Technological controls include applications or hardware that monitors the school’s network for potential attacks or threats.

Physical security protects the physical infrastructure from unauthorized access (Taylor, 2021)."

References:
Taylor, A. (2021, March 4). How to Implement a Systemic Approach to Student Data Security and Privacy. TechLearningMagazine. https://www.techlearning.com/how-to/how-to-implement-a-systemic-approach-to-student-data-security-and-privacy

# data[].attributes.attachment_link.readable_text
Today, schools are continuously collecting data on the students they serve. This data can be a powerful tool for learning by assisting educators in benchmarking student success, identifying learning gaps, personalizing the learning experience, and more.

The electronic ecosystem schools have developed to accomplish this requires that staff collect, maintain, and support data across countless applications. To further complicate the situation, free or unmonitored applications collect student personal information outside the school's ecosystem. On top of this, hackers continuously test school networks and look for ways to capitalize on security flaws.

Schools have the enormous responsibility of caring for student data and personally identifiable information. Data security and privacy could be one of the most daunting technology tasks educators face, and as we increase the use of technology, the task becomes more challenging every day. This responsibility is bigger than any single school technology department.

School IT departments are working to prevent data theft through deliberate and malicious attacks, data loss through misuse or insufficient protection, and faulty practices in collecting, sharing, storing, and removing data. Combating this rapid evolution requires a commitment to continuous improvement and planning, but how do schools start this journey?

Here are a few ideas that help to support districts.

Review the Law, Standards, and District Policies, and Develop Networks

Data privacy laws are evolving and reflect current threats and knowledge. A district's first stop should be to review your current state laws and standards. There are many federal laws, such as the Family Educational Rights and Privacy Act (opens in new tab) (FERPA), Protection of Pupil Rights Amendment (opens in new tab) (PPRA), Health Insurance Portability and Accountability Act (opens in new tab) (HIPAA), Children's Internet Protection Act (opens in new tab) (CIPA), and Children's Online Privacy Protection Rule (opens in new tab) (COPPA).

If your state has not adopted a set of standards or laws that regulate student data, you may want to start with the National Institute of Standards and Technology (NIST) Framework (opens in new tab). NIST is the framework most states have adopted as the gold standard for data security and privacy. It is used by the government, military, and business.

You should also consider joining data security and privacy networks in your region, state, or nationally. Many of these groups send regular emails with updates on national trends and security alerts.

Start with the Big Question

It is essential to realize that student data and personal information is part of every aspect of education. Schools need to have regular conversations about data privacy. Start by asking the big questions using the 5Ws of data security and privacy. This includes:

What data are we collecting?

Why are we collecting this data?

Who is collecting and has access to this data?

When does this data get collected and destroyed?

Where is this data stored or used?

These simple questions can facilitate in-depth conversation about data in your organization and may ignite some level of healthy debate. These questions will also lead to the development of additional documents.

One vital record to start with is a software and data inventory. A software and data inventory should provide the school a list of software applications, the type of data held in that application, and a determination of each user's access rights.

(Image credit: Andrew Taylor)

A document such as this helps to uncover important information including where data is stored and who has access to that data. This information is valuable for onboarding and exiting users, for example. Schools should only be collecting the information they need, and users should only have access to the data they need to do their work.

Understand the Threat

To better understand data security and privacy, schools need to analyze the threats they face and the methods used to mitigate these threats. Potential threats have three general components, and districts can address each with specific measures. This includes:

Preventative measures: Any actions taken to minimize the risk of a data breach, loss, or malicious attack. Preventive measures could include providing regular training, updating applications, or maintaining policies and procedures.

Detective measures: All ongoing action and technology used to identify potential data breaches, loss, or malicious attacks. Detective measures could include hardware/software alerts, compliance monitoring, or threat detection applications.

Corrective measures: Any planning or action taken as a result of a specific threat. Corrective measures should include an incident response plan, corrective plan/actions, and recovery plan/actions.

A school responds to each of these measures using administrative controls, technological controls, or physical controls.

Administrative controls approach data security and privacy by limiting access to specific applications or types of data.

Technological controls include applications or hardware that monitors the school's network for potential attacks or threats.

Physical security protects the physical infrastructure from unauthorized access.

A crosswalk of measures and controls may help schools look holistically at their data security threat measures and controls.

(Image credit: Andrew Taylor)

Continuous Professional Learning

It may seem that data security and privacy is a technical problem, but it is much more expansive than this. It is an adaptive challenge that requires constant and continuous human support. It only takes one human intervention to prevent or cause a data breach, so ongoing learning and communication is a must for any organization. Staff training is not a one-time event but a regular reminder of data security and privacy best practices, policies, and procedures. Keeping these practices, policies, and procedures up to date with regular review and refinement will help fight evolving and new challenges.

A data breach, hack, or loss is no longer just a potential risk for an organization; it is inevitable. Preparing with a comprehensive Incident Response Plan and Team is essential. The team should understand the order of command, actions taken based on security threats, communication protocols, and post-activity reflection. Developing tabletop exercises that address your organization's most significant threats will help make the team ready for any incident.

Know Your Community Tolerance to Risk and Capacity

The continuous balance with technology in schools has always been usability vs. security. The more secure you make a network, the harder it becomes for users to do the work they need to do. No network is 100% safe, but schools must continually improve to address the need for security and privacy. Budget restraints, technical barriers, community support, institutional conditions, or other roadblocks may hinder your ability to manage all of your security concerns in the way you want.

Addressing privacy and security risks can be overwhelming. A tool, such as the Classical Risk Matrix, can help determine the impact of a threat on your organization by analyzing the likelihood of occurrence.

(Image credit: Andrew Taylor)

The Classical Risk Matrix considers the potential damage (neglectable, minor, moderate, critical, or catastrophic) this vulnerability provides to the probable occurrence (rare, unlikely, possible, likely, or certain). The greater the potential damage and the higher the likelihood of occurrence, the more significant the impact. The Classical Risk Matrix helps your team prioritize its work. For example, if a threat is certain to happen and would be catastrophic, it would rank high on the task list.

Understanding your organization's current risk level and your organization's risk tolerance will help you prioritize your plan and pathway forward. Making your school more secure is a journey, not a destination, and every journey starts with just one step. Make your first step today.

Andrew Taylor is Director of Technology and Professional Learning for Byram Hills School District (opens in new tab) in Armonk, N.Y.

# data[].attributes.attachment_link.title
How to Implement a Systemic Approach to Student Data Security and Privacy

# data[].attributes.attachment_link.description
Today, schools are continuously collecting data on the students they serve. This data can be a powerful tool for learning by assisting educators in benchmarking student success, identifying learning gaps, personalizing the learning experience, and more. The electronic ecosystem schools have developed to accomplish this requires that staff collect, maintain, and support data across countless applications.

# data[].attributes.body
SFDR-CISD Employee Handbook:
"Standard 3.1 The educator shall not reveal confidential information concerning students unless disclosure serves lawful professional purposes or is required by law (Ethical Conduct Towards Students, n.d.). "

This code of ethics relates to the issue of student's privacy because it mentions how an educator should not reveal any confidential information of the student. This relates to the topic because FERPA mentions how student's information should not be released without parent or eligible student permission.

References:
Ethical Conduct Towards Students. (n.d.). SFDRCISD Employee Handbook. Retrieved December 6, 2022, from https://www.sfdr-cisd.org/media/50wjyimy/employee-handbook-2022-2023-7-26-2022.pdf

# data[].attributes.body
A specific standard that relates to this issue is Standard 3.1 on our SFDR-CISD employee handbook. "The educator shall not reveal confidential information concerning students unless disclosure serves lawful professional purposes or is required by law (Ethical Conduct Towards Students, n.d.). " As a teacher we are required to adhere by the code of ethics.

References:
Ethical Conduct Towards Students. (n.d.). SFDRCISD Employee Handbook. Retrieved December 6, 2022, from https://www.sfdr-cisd.org/media/50wjyimy/employee-handbook-2022-2023-7-26-2022.pdf

# data[].attributes.headline
#11) Recommendations/ Best Practices for Compliance

# data[].attributes.subject
#11) Recommendations/ Best Practices for Compliance

# data[].attributes.body
The best practices/recommendations for student's privacy are:
-In your district or field have frequent trainings student safety
-Make sure your district blocks all malicious malware.
-Make sure your districts blocks unnecessary software
-Districts should notify when student's information should be released.
-Give parents sufficient time to deny the release of student's release.
- Make sure that student's information is released only to verified educational institutions.