Utah Administrative Code
The Utah Administrative Code is the body of all effective administrative rules as compiled and organized by the Office of Administrative Rules (see Subsection 63G-3-102(5); see also Sections 63G-3-701 and 702).
NOTE: For a list of rules that have been made effective since July 1, 2018, please see the codification segue page.
NOTE TO RULEFILING AGENCIES: Use the RTF version for submitting rule changes.
R277. Education, Administration.
Rule R277-487. Public School Data Confidentiality and Disclosure.
As in effect on July 1, 2018
Table of Contents
- R277-487-1. Authority and Purpose.
- R277-487-2. Definitions.
- R277-487-3. Data Privacy and Security Policies.
- R277-487-4. Transparency.
- R277-487-5. Responsibilities of Chief Privacy Officer.
- R277-487-6. Prohibition of Public Education Data Use for Marketing.
- R277-487-7. Public Education Research Data.
- R277-487-8. Public Education Survey Data.
- R277-487-9. CACTUS Data.
- R277-487-10. Educator Evaluation Data.
- R277-487-11. Application to Third Party Contractors.
- R277-487-12. Annual Reports by Chief Privacy Officer.
- R277-487-13. Data Security and Privacy Training for Educators.
- Date of Enactment or Last Substantive Amendment
- Notice of Continuation
- Authorizing, Implemented, or Interpreted Law
(1) This rule is authorized by:
(a) Utah Constitution Article X, Section 3, which vests general control and supervision over public education in the Board;
(b) Section 53A-1-401, which allows the Board to make rules to execute the Board's duties and responsibilities under the Utah Constitution and state law;
(c) Subsection 53A-13-301(4), which directs that the Board may make rules to establish standards for public education employees, student aides, and volunteers in public schools regarding the confidentiality of student information and student records;
(d) Subsection 53A-8a-410(4), which directs that the Board may make rules to ensure the privacy and protection of individual evaluation data; and
(e) Section 53A-1-411, which directs the Board to establish procedures for administering or making available online surveys to obtain information about public education issues.
(2) The purpose of this rule is to:
(a) provide for appropriate review and disclosure of student performance data on state administered assessments as required by law;
(b) provide for adequate and appropriate review of student performance data on state administered assessments to professional education staff and parents of students;
(c) ensure the privacy of student performance data and personally identifiable student information, as directed by law;
(d) provide an online education survey conducted with public funds for Board review and approval; and
(e) provide for appropriate protection and maintenance of educator licensing data.
(1) "Association" has the same meaning as that term is defined in Subsection 53A-1-1601(3).
(2) "Chief Privacy Officer" means a Board employee designated by the Board as primarily responsible to:
(a) oversee and carry out the responsibilities of this rule; and
(b) direct the development of materials and training about student and public education employee privacy standards for the Board and LEAs, including:
(i) FERPA; and
(ii) the Utah Student Data Protection Act, Title 53A, Chapter 1, Part 14.
(3) "Classroom-level assessment data" means student scores on state-required tests, aggregated in groups of more than 10 students at the classroom level or, if appropriate, at the course level, without individual student identifiers of any kind.
(4) "Comprehensive Administration of Credentials for Teachers in Utah Schools" or "CACTUS" means the electronic file maintained and owned by the Board on all licensed Utah educators, which includes information such as:
(a) personal directory information;
(b) educational background;
(d) employment history; and
(e) a record of disciplinary action taken against the educator.
(5) "Confidentiality" refers to an obligation not to disclose or transmit information to unauthorized parties.
(6) "Data governance plan" has the same meaning as defined in Subsection 53A-1-1402(9).
(7) "Data security protections" means protections developed and initiated by the Superintendent that protect, monitor and secure student, public educator and public education employee data as outlined and identified in FERPA and Sections 63G-2-302 through 63G-2-305.
(8) "Disclosure" includes permitting access to, revealing, releasing, transferring, disseminating, or otherwise communicating all or any part of any individual record orally, in writing, electronically, or by any other communication method.
(9) "Enrollment verification data" includes:
(a) a student's birth certificate or other verification of age;
(b) verification of immunization or exemption from immunization form;
(c) proof of Utah public school residency;
(d) family income verification; or
(e) special education program information, including:
(i) an individualized education program;
(ii) a Section 504 accommodation plan; or
(iii) an English language learner plan.
(10) "FERPA" means the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. 1232g.
(11) "Information Technology Systems Security Plan" means a plan incorporating policies and process for:
(a) system administration;
(b) network security;
(c) application security;
(d) endpoint, server, and device security;
(e) identity, authentication, and access management;
(f) data protection and cryptography;
(g) monitoring, vulnerability, and patch management;
(h) high availability, disaster recovery, and physical protection;
(i) incident responses;
(j) acquisition and asset management; and
(k) policy, audit, and e-discovery training.
(12) "LEA" includes, for purposes of this rule, the Utah Schools for the Deaf and the Blind.
(13) "Metadata dictionary" has the same meaning as defined in Subsection 53A-1-1402(16).
(14) "Personally identifiable student data" has the same meaning as defined in Subsection 53A-1-1402(20).
(15) "Student data advisory groups" has the same meaning as described in Subsection 53A-1-1403(3).
(16) "Student data manager: means the individual at the LEA level who:
(a) is designated as the student data manager by an LEA under Section 53A-1-1404;
(b) authorizes and manages the sharing of student data;
(c) acts as the primary contact for the Chief Privacy Officer;
(d) maintains a list of persons with access to personally identifiable student information; and
(e) is in charge of providing annual LEA staff and volunteer training on data privacy.
(17)(a) "Student information" means materials, information, records and knowledge that an LEA possesses or maintains about individual students.
(b) Student information is broader than student records and personally identifiable student information and may include information or knowledge that school employees possess or learn in the course of their duties.
(18) "Student performance data" means data relating to student performance, including:
(a) data on state, local and national assessments;
(b) course-taking and completion;
(c) grade-point average;
(f) degree, diploma, or credential attainment; and
(g) enrollment and demographic data.
(19) "Third party contractor" has the same meaning as defined in Subsection 53A-1-1402(26).
(1) The Superintendent shall develop resource materials for LEAs to train employees, aides, and volunteers of an LEA regarding confidentiality of personally identifiable student information and student performance data.
(2) The Superintendent shall make the materials developed in accordance with Subsection (1) available to each LEA.
(3) An LEA or public school may not be a member of or pay dues to an association that is not in compliance with:
(b) Title 53A, Chapter 1, Part 14, Student Data Protection Act;
(c) Title 53A, Chapter 13, Part 3, Utah Family Educational Rights and Privacy Act; and
(d) this R277-487.
(4) An LEA shall comply with Title 53A, Chapter 1, Part 14, Student Data Protection Act.
(5) An LEA shall comply with Section 53A-13-303.
(6) An LEA is responsible for the collection, maintenance, and transmission of student data.
(7) An LEA shall ensure that school enrollment verification data, student performance data, and personally identifiable student information are collected, maintained, and transmitted:
(a) in a secure manner; and
(b) consistent with sound data collection and storage procedures, established by the LEA.
(8) An LEA may contract with a third party provider to collect, maintain, and have access to school enrollment verification data or other student data if:
(a) the third party contractor meets the definition of a school official under 34 CFR 99.31 (a)(1)(i)(B);
(b) the contract between the LEA and the third party contractor includes a provision that the data is the property of the student under Section 53A-1-1405; and
(c) the LEA monitors and maintains control of the data.
(9) If an LEA contracts with a third party contractor to collect and have access to the LEA's data as described in Subsection (6), the LEA shall notify a student and the student's parent or guardian in writing that the student's data is collected and maintained by the third party contractor.
(10) An LEA shall publicly post the LEA's definition of directory information and describe how a student data manager may share personally identifiable information that is directory information.
(11) By July 1 annually, an LEA shall enter all student data elements shared with third parties into the Board's metadata dictionary.
(12) An LEA shall report all unauthorized disclosures of student data by third parties to the Superintendent.
(13) An LEA shall provide the Superintendent with a copy or link to the LEA's data governance plan by October 1 annually.
(14) An LEA shall provide the Superintendent with a copy or link to the LEA's Information Technology Systems Security Plan by October 1 annually.
(15) All public education employees, aides, and volunteers in public schools shall become familiar with federal, state, and local laws regarding the confidentiality of student performance data and personally identifiable student information.
(16) All public education employees, aides, and volunteers shall maintain appropriate confidentiality pursuant to federal, state, local laws, and LEA policies created in accordance with this section, with regard to student performance data and personally identifiable student information.
(17) An employee, aide, or volunteer may not share, disclose, or disseminate passwords for electronic maintenance of:
(a) student performance data; or
(b) personally identifiable student information.
(18) A public education employee licensed under Section 53A-6-104 may only access or use student information and records if the public education employee accesses the student information or records consistent with the educator's obligations under R277-515.
(19) The Board may discipline a licensed educator in accordance with licensing discipline procedures if the educator violates this R277-487.
(20) An LEA shall annually provide a training regarding the confidentiality of student data to any employee with access to education records as defined in FERPA.
(21) A school employee shall annually submit a certified statement to the LEA's student data manager, which certifies that the school employee completed the LEA's required student privacy training and understands student privacy requirements.
(1) The Superintendent shall recommend policies for Board approval and model policies for LEAs regarding student data systems.
(2) A policy prepared in accordance with Subsection (1) shall include provisions regarding:
(a) accessibility by parents, students, and the public to student performance data;
(b) authorized purposes, uses, and disclosures of data maintained by the Superintendent or an LEA;
(c) the rights of parents and students regarding their personally identifiable information under state and federal law;
(d) parent, student, and public access to information about student data privacy and the security safeguards that protect the data from unauthorized access and use; and
(e) contact information for parents and students to request student and public school information from an LEA consistent with the law.
(1) The Chief Privacy Officer:
(a) may recommend legislation, as approved by the Board, for additional data security protections and the regulation of use of the data;
(b) shall supervise regular privacy and security compliance audits, following initiation by the Board;
(c) shall have responsibility for identification of threats to data security protections;
(d) shall develop and recommend policies to the Board and model policies for LEAs for:
(i) protection of personally identifiable student information;
(ii) consistent wiping or destruction of devices when devices are discarded by public education entities; and
(iii) appropriate responses to suspected or known breaches of data security protections;
(e) shall conduct training for Board staff and LEAs on student privacy; and
(f) shall develop and maintain a metadata dictionary as required by Section 53A-1-1403.
Data maintained by the state, a school district, school, or other public education agency or institution in the state, including data provided by contractors, may not be sold or used for marketing purposes, or targeted advertising as defined in Subsection 53A-1-1402(26) except with regard to authorized uses of directory information not obtained through a contract with an educational agency or institution.
(1) The Superintendent may provide limited or extensive data sets for research and analysis purposes to qualified researchers or organizations.
(2) The Superintendent shall use reasonable methods to qualify researchers or organizations to receive data, such as evidence that a research proposal has been approved by a federally recognized Institutional Review Board or "IRB."
(3) The Superintendent may post aggregate de-identified student assessment data to the Board website.
(4) The Superintendent shall ensure that personally identifiable student information is protected.
(5) The Superintendent:
(a) is not obligated to fill every request for data and shall establish procedures to determine which requests will be filled or to assign priorities to multiple requests;
(b) may give higher priority to requests that will help improve instruction in Utah's public schools; and
(c) may charge a fee to prepare data or to deliver data, particularly if the preparation requires original work.
(6) A researcher or organization shall provide a copy of the report or publication produced using Board data to the Superintendent at least 10 business days prior to the public release.
(7) Requests for data that disclose student information may only be provided in accordance with Section 53A-1-1409 and FERPA, incorporated herein by reference, and may include:
(a) student data that are de-identified, meaning that a reasonable person in the school community who does not have personal knowledge of the relevant circumstances could not identify student(s) with reasonable certainty;
(b) agreements with recipients of student data where recipients agree not to report or publish data in a manner that discloses students' identities; or
(c) release of student data, with appropriate binding agreements, for state or federal accountability or for the purpose of improving instruction to specific student subgroups.
(8) Recipients of Board research data shall sign a confidentiality agreement, if required by the Superintendent.
(9) Either the Board or the Superintendent may commission research or may approve research requests.
(10) Request for records under Title 63G, Chapter 2, Government Records Access and Management Act, are not subject to this Section R277-487-7.
(1) The Superintendent shall approve statewide education surveys administered with public funds through the Board or through a contract approved by the Board, as required under Section 53A-1-411.
(2) Data obtained from a statewide survey administered with public funds under Subsection (1) to the extent not subject to Section 53A-1-1405 are the property of the Board.
(3) The Superintendent shall make data obtained from a survey developed in accordance with Subsection (1) available only if the data is shared in such a manner as to protect the privacy of students and educators in accordance with federal and state law.
(1) The Board maintains information on all licensed Utah educators in CACTUS, including information classified as private, controlled, or protected under GRAMA.
(2) The Superintendent shall open a CACTUS file for a licensed Utah educator when the individual initiates a Board background check.
(3) Authorized Board staff may update CACTUS data as directed by the Superintendent.
(4) Authorized LEA staff may change demographic data and update data on educator assignments in CACTUS for the current school year only.
(5) A licensed individual may view his own personal data, but may not change or add data in CACTUS except under the following circumstances:
(a) A licensee may change the licensee's contact and demographic information at any time;
(b) An employing LEA may correct a current educator's assignment data on behalf of a licensee.
(c) A licensee may petition the Board for the purpose of correcting any errors in the licensee's CACTUS file.
(6) The Superintendent shall include an individual currently employed by a public or private school under a letter of authorization or as an intern in CACTUS.
(7) The Superintendent shall include an individual working in an LEA as a student teacher in CACTUS.
(8) The Superintendent shall provide training and ongoing support to authorized CACTUS users.
(9) For employment or assignment purposes only, authorized LEA staff members may:
(a) access data on individuals employed by the LEA; or
(b) view specific limited information on job applicants if the applicant has provided the LEA with a CACTUS identification number.
(10) CACTUS information belongs solely to the Board.
(g) The Superintendent may release data within CACTUS in accordance with the provisions of Title 63G, Chapter 2, Government Records Access and Management Act.
(1)(a) The Superintendent may provide classroom-level assessment data to administrators and teachers in accordance with federal and state privacy laws.
(b) School administrators shall share information requested by parents while ensuring the privacy of individual student information and educator evaluation data.
(2) Individual educator evaluation data shall be protected at the school, LEA and state levels and, if applicable, by the Board.
(3) An LEA shall designate employees who may have access to educator evaluation records.
(4) An LEA may not release or disclose student assessment information that reveals educator evaluation information or records.
(5) An LEA shall train employees in the confidential nature of employee evaluations and the importance of securing evaluations and records.
(1) The Board and LEAs shall set policies that govern a third party contractor's access to personally identifiable student data and public school enrollment verification data consistent with Section 53A-1-1401 et seq.
(2) An LEA may release student information and public school enrollment verification data to a third party contractor if:
(a) the release is allowed by, and released in accordance with, Section 53A-1-1409 and FERPA, incorporated herein by reference, and its implementing regulations; and
(b) the LEA complies with the requirements of Subsection R277-487-3(6).
(4) All Board contracts shall include sanctions for contractors or third party providers who violate provisions of state policies regarding unauthorized use and release of student and employee data.
(5) The Superintendent shall recommend that LEA policies include sanctions for contractors who violate provisions of federal or state privacy law and LEA policies regarding unauthorized use and release of student and employee data.
(1) The Chief Privacy Officer shall submit to the Board an annual report regarding student data.
(2) The public report shall include:
(a) information about the implementation of this rule;
(b) information about research studies begun or planned using student information and data;
(c) identification of significant threats to student data privacy and security;
(d) a summary of data system audits; and
(e) recommendations for further improvements specific to student data security and the systems that are necessary for accountability in Board rules or legislation.
(1) The Superintendent shall develop a student and data security and privacy training for educators.
(2) The Superintendent shall make the training developed in accordance with Subsection (1) available through UEN.
(3) Beginning in the 2018-19 school year, an educator shall complete the training developed in accordance with Subsection (1) as a condition of re-licensure.
students, records, confidentiality
July 10, 2017
November 14, 2014
Art X Sec 3; 53A-13-301(4); 53A-1-401; 53A-1-411; 53A-8a-410(4)
For questions regarding the content or application of rules under Title R277, please contact the promulgating agency (Education, Administration). A list of agencies with links to their homepages is available at https://www.utah.gov/government/agencylist.html.