15.1-07-25.3. Protection of student data - School district policy.

1. The board of a school district shall adopt a policy regarding the protection of student data.

2. The policy must: a. Require that permission be obtained from the board before student data is shared with an individual who is not a school district employee or any other entity. This provision does not apply to sharing data with a student's parent or as otherwise authorized by law. b. Permit a school district to share student data with the state entity managing a student information system if the school district and the state entity have entered a data sharing agreement, subject to federal and state privacy laws. The data sharing agreement must include a clause that designates the department as an authorized representative of the school district under the Family Educational Rights and Privacy Act of 1974 [20 U.S.C. 1232G] and title 34 Code of Federal Regulations part 99 for purposes of the statewide longitudinal data system.

3. The policy must require the school district superintendent to compile: a. A list of individuals with whom and entities with which student data is shared; and b. A list, by title, of school district personnel who have access to student data.

4. A school district shall make copies of the policy available upon request.