West Virginia’s Steady Course on Student Data Privacy
February 2016
Amelia Vance
Republished courtesy of the National Association of State Boards of Education©
State policymakers in 47 states introduced almost 300 education data privacy bills in 2014 and 2015, and 33 states passed new laws over the last three years. Before this flurry of legislation began, West Virginia’s Board of Education (WVBE) had already become a leader in ensuring that the privacy of student data was protected while allowing for the innovative use of data to help students succeed.
Amid the earliest alarming headlines about data security breaches at major companies and the perils of data mining in education, West Virginia policymakers enacted laws and regulations that strengthen data privacy but also recognize the potential of data collection to improve student outcomes. In 2013, West Virginia was one of just a few states that were already reviewing their data privacy policies. The board passed a resolution in November 2013 to establish broad privacy protections for students:
- personally identifiable information (PII) cannot be shared with an entity outside West Virginia;
- contracts with companies that call for processing personally identifiable data must require its protection;
- contractors that violate PII protection mandates will not receive future contracts from the state;
- contractors can use data only for accomplishing the work stipulated in their contracts, and that data must be destroyed immediately after the work products are delivered to the state; and
- contracts must specify that violations of the PII language constitute a breach of contract for which the contractor will be held accountable.
Shortly after the board passed that resolution, the legislature also acted. West Virginia’s exemplary Student Data Accessibility, Transparency, and Accountability Act, also known as the Student DATA Act, passed in 2014. Its core components include the appointment of a state data governance officer, new transparency provisions, and increased authority for the state board of education. Moreover, West Virginia set a high bar for best practice in collaboration between the state board and the state legislature.
Data Governance
The Student DATA Act called for appointment of a chief privacy officer, known in West Virginia as the data governance manager. This manager reports to the West Virginia Department of Education’s (WVDE) chief information officer and has primary responsibility for ensuring compliance with rules for collection, usage, access, and disclosure. Vesting authority for privacy policy in a single official helps to centralize and coordinate efforts across departments and districts. A number of “data stewards”—staff members who work in WVDE offices around the state—assist the data governance manager. The stewards provide annual privacy policy training for WVDE staff and ensure the accuracy of data entered into West Virginia’s data system.
A dedicated education data staff reduces errors that can cost the state time and money to correct later, and their specialized training reduces the probability that privacy violations will occur when the staff handles sensitive student data.
Supporting Districts
No student data privacy law or policy can be successful without training and capacity building. WVDE has played a large supporting role in helping districts comply with the Student DATA Act. WVDE offers in-person trainings and webinars for districts that request it, covering topics such as the Family Educational Rights and Privacy Act (FERPA) and student data privacy in general. The department has also been experimenting with online training.1 ZoomWV, the state’s education data webpage, has a data privacy page that provides links to districts and the general public on state policies and data governance.
Data System Security
To reduce the risk of security breaches, WVDE restricts who can access and use the student data stored in its state longitudinal data system. Staff can access only the data they need to do their jobs.
One West Virginia Board of Education member, Dr. William “Bill” White, emphasized in a presentation at the 2015 SXSWedu conference that West Virginia strives to collect only the data necessary to answer specific questions of policymakers, districts, and teachers. For example, policymakers may want to know whether students are college and career ready, districts may want to know how they compare with other districts, and teachers may want to know how their students compare with similar students in other schools. If schools and states collect only necessary data, then there are fewer data points to protect.
Transparency Provisions
The Student DATA Act requires the WVBE to develop guidance for school districts on notifying students and parents of their privacy rights under federal and state law. Its provisions increase the transparency of student data policies and practices. For example, the act creates a 60-day review period for new student data elements that WVDE proposes to collect, during which the public may give feedback. Approval of new elements ultimately rests with the state board.
The department also created a publicly available list that defines all elements of student data that the department collects. Most entries explain what data are being collected and why. These measures are essential to increasing public trust in data collection.
But transparency and public trust do not depend solely on policy. Dr. White observed that having state board members attend public forums to answer community members’ questions was just as important as passing protection policies and developing security measures.
State Board Authority
The Student DATA Act cemented the critical role of the state board on this issue. The WVBE gained the authority to develop guidance for school districts covering parental access to student data, data security, and disclosure restrictions. It also received broad authority to adopt rules to ensure the effective implementation of the act.
Working with the Legislature
Proper communication with the legislature is essential to the success of any data policy. West Virginia policymakers have taken a wide range of stances on data collection, with some acknowledging the essential role data collection can play in education and others calling for outright bans. Others were somewhere in the middle. All legislators ought to hear directly from those best positioned to be informative, including members of state boards of education. Lawmakers want to know the purposes for which data are and are not being used. The WVBE discovered that the best strategy for satisfying this need is frequent and open communication.
The Student DATA Act stipulates that WVDE will annually inform the governor and the state legislature of any new student data it plans to collect, changes to federal data reporting requirements, and the results of privacy compliance and security audits completed in the previous year. Even if states choose not to legally require collaboration between boards and legislative or executive officials, West Virginia provides a model for informal cooperation: WVBE invited legislators and their staffs to attend board hearings and committee meetings. Even when legislators did not accept, the invitation signaled a willingness to listen and work together to improve policy. The legislators that did attend became more informed. Just as important, better laws and rules can result from this collaboration.
What's Next for West Virginia
West Virginia has become a role model for other states in student data privacy. It is continuously improving its practices. The West Virginia Higher Education Policy Commission is leading development of a cross-agency data system that could, for example, connect information about student experiences to workforce data to determine how education—from preschool through college—benefi ts children later in life. Such connections can enable the state to target initiatives or policy areas for improvement. WVDE is a key participant in that data system, which was required by legislative action in 2010, and often leads the partnership’s discussions about how best to protect student privacy.
“In West Virginia, we take student data privacy very seriously,” said Sterling Beane, the WVDE’s chief information officer. “I am happy that the West Virginia State Board of Education, the West Virginia legislature, and the Department of Education have worked cooperatively to enact code, policy, and procedures that represent those core beliefs and values.”
The state board plays a crucial role in ensuring the privacy and security of student data, one that has been strengthened by its partnership with the state legislature. With the authority granted them by the Student DATA Act, it will continue to have a hand in how education data can be used to benefit the students of West Virginia.
Resources
West Virginia Department of Education. “Data Privacy,” https://wvde.state.wv.us/zoomwv/data-privacy.html.
West Virginia Department of Education. “Data Access & Management Guidance,” http://static.k12.wv.us/tt/2014/ datamanagement_guidance%20FINAL%201-21-14.pdf.
West Virginia Student Data Accessibility, Transparency and Accountability Act, http://www.legis.state.wv.us/WVCODE/ ChapterEntire.cfm?chap=18&art=2§ion=5H#02.
West Virginia Data Dashboard, http://zoomwv.k12.wv.us/.
Glen Flint, Scott Summers, Amelia Vance, and Dr. William White. “How to Create a Data Privacy Policy.” Presentation at SXSWedu 2015, March 2015, http://www.nasbe.org/ wp-content/uploads/SXSWedu-NASBE-Presentation-Final. pdf.
Note
1. One tool West Virginia uses to facilitate online training is Office Mix, a plug-in for Microsoft Powerpoint, that allows WVDE to create videos of their slide presentations.
