Student Data Privacy Laws Every District Leader Should Know

Every app a teacher signs up for, every form sent home and every student account you create collects student data. Several federal and state laws decide what you can collect, who can see it and what happens when something goes wrong. Most district leaders know FERPA. Fewer can name the rest, and a couple of them have changed recently.

Here’s the short version.

FERPA is the foundation. It controls who can see a student’s education record and gives parents the right to review it. It’s getting more attention now that the Department of Justice has a role in enforcing it, and DOJ filed its first FERPA lawsuit against a district this year.

The Illinois School Student Records Act (ISSRA) is the state’s version, with some extra requirements of its own.

SOPPA is where Illinois districts feel the most day-to-day work: vendor agreements posted to your website, breach notices to parents within 30 days, and regular updates to what you publish.

COPPA puts obligations on companies whose services are used by children under 13. The FTC’s updated rule took full effect this April, so it’s a good year to ask your vendors how they’ve responded.

CIPA is tied to E-Rate and covers internet filtering and online safety education.

The Protection of Pupil Rights Amendment (PPRA) covers student surveys on sensitive topics. Illinois’s Mental Health and Developmental Disabilities Confidentiality Act applies to records kept by school psychologists, social workers and nurses. The Right to Privacy in the School Setting Act limits when you can ask for a student’s social media login. The Local Records Act controls when you can destroy records. Illinois also added limits this year on collecting and sharing students’ immigration-status information.

HIPAA and GDPR come up a lot, but they rarely apply to K-12 schools.

None of this requires everyone to become a privacy lawyer. It does help to know which law a question falls under, so you know where to look and who to call.

We keep a brief on all of these laws, with citations and what each requires. Download the Student Data Privacy Laws brief. If you’re working through SOPPA compliance or vetting vendors, LTC can help.