CONFIDENTIALITY OF INFORMATION  
 
Authorities:  34 C.F.R. Parts 99, 300; Texas Education Code
 
 
 
FEDERAL AND STATE REQUIREMENTS CITATIONS
DEFINITIONS


P

Under the Family Educational Rights and Privacy Act and for the purposes of the RECORDS frameworks:



P
  • Educational agency or institution means any public or private agency or institution;
99.3

P
  • Biometric record means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting;
99.3

P
  • Personally identifiable information includes but is not limited to:
99.3

P
    • The student's name;   
99.3

P
    • The name of the student's parent or other family members;
99.3

P
    • The address of the student or student's family;
99.3

P
    • A personal identifier, such as the student’s social security number, student identification number, or biometric record;
99.3

P
    • Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;
99.3

P
    • Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
99.3

P
    • Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
99.3

SAFEGUARDS


P Each educational agency or institution must: 300.623

P
  • Protect the confidentiality of personally identifiable information at the collection, storage, disclosure, and destruction stages; and
300.623(a)

D
  • Maintain for public inspection, a current listing of the names and positions of those employees within the agency who may have access to personally identifiable information.
300.623(d)

P

One official at each educational agency or institution must assume responsibility for ensuring the confidentiality of any personally identifiable information.

300.623(b)

P

All persons collecting or using personally identifiable information must receive training or instruction regarding the state's policies and procedures to protect the confidentiality of any personally identifiable information collected, used, or maintained by the educational agency or institution.

300.623(c)

CONFIDENTIALITY OF PERSONALLY IDENTIFIABLE INFORMATION PROVIDED TO WEBSITES USED FOR SCHOOL PURPOSES


P Operator means, to the extent operating in this capacity, the operator of a website, online service, online application, or mobile application who has actual knowledge that the website, online service, online application, or mobile application is used primarily for a school purpose and was designed and marketed for a school purpose. TEC 32.151(3)

P Covered information means personally identifiable information or information that is linked to personally identifiable information, in any media or format, that is not publicly available and is: TEC 32.151(1)

P
  • Created by or provided to an operator by a student or the student's parent in the course of the student's or parent's use of the operator's website, online service, online application, or mobile application for a school purpose;
TEC 32.151(1)(A)

P
  • Created by or provided to an operator by an employee of a school district or school campus for a school purpose; or
TEC 32.151(1)(B)

P
  • Gathered by an operator through the operation of the operator's website, online service, online application, or mobile application for a school purpose and personally identifies a student, including the student's educational record, electronic mail, first and last name, home address, telephone number, electronic mail address, information that allows physical or online contact, discipline records, test results, special education data, juvenile delinquency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, student identifiers, search activity, photographs, voice recordings, or geological information.
TEC 32.151(1)(C)

P School purpose means a purpose that is directed by or customarily takes place at the direction of a school district, school campus, or teacher or assists in the administration of school activities, including instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or is otherwise for the use and benefit of the school. TEC 32.151(5)

P Targeted advertising means presenting an advertisement to a student in which the advertisement is selected for the student based on information obtained or inferred over time from the student's online behavior, usage of applications, or covered information.  The term does not include advertising to a student at an online location based on the student's visit to that location at that time, or in response to the student's request for information or feedback, without the retention of the student's online activities or requests over time for the purpose of targeting subsequent advertisements. TEC 32.151(6)

P An operator may not knowingly: TEC 32.152(a)

P
  • Engage in targeted advertising on any website, online service, online application, or mobile application if the target of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired through the use of the operator's website, online service, online application, or mobile application for a school purpose;
TEC 32.152(a)(1)

P
  • Use information, including persistent unique identifiers, created or gathered by the operator's website, online service, online application, or mobile application, to create a profile about a student unless the profile is created for a school purpose; or
TEC 32.152(a)(2)

P
  • Sell or rent any student's covered information, unless:
TEC 32.152(a)(3)

P
    • The purchase, merger, or any other type of acquisition of an operator by another entity, if the operator or successor entity complies regarding previously acquired student information; or
TEC 32.152(c)(1)

P
    • A national assessment provider if the provider secures the express affirmative consent of the student or the student's parent, given in response to clear and conspicuous notice, and if the information is used solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities.
TEC 32.152(c)(2)
TEC 32.153(b)
TEC 32.154(5)

P An operator may use or disclose, in compliance with the REDISCLOSURE OF RECORDS framework, covered information: TEC 32.153(a)
TEC 32.157
TEC 32.157(9)

P
  • To further a school purpose of the website, online service, online application, or mobile application and the recipient of the covered information does not further disclose the information unless the disclosure is to allow or improve operability and functionality of the operator's website, online service, online application, or mobile application;
TEC 32.153(a)(1)

P
  • To ensure legal and regulatory compliance;
TEC 32.153(a)(2)

P
  • To protect against liability;
TEC 32.153(a)(3)

P
  • To respond to or participate in the judicial process;
TEC 32.153(a)(4)

P
  • To protect the safety or integrity of users of the website, online service, online application or mobile application;
TEC 32.153(a)(5)(A)

P
  • To protect the security of the website, online service, online application, or mobile application;
TEC 32.153(a)(5)(B)

P
  • To satisfy a school, education, or employment purpose requested by the student or the student's parent and the information is not used or disclosed for any other purpose;
TEC 32.153(a)(6)

P
  • For a legitimate research purpose, a school purpose, or postsecondary educational purpose;
TEC 32.153(a)(7)

P
  • For a request by the local educational agency for a school purpose;
TEC 32.153(a)(8)

P
  • If a provision of federal or state law requires the operator to disclose the information;
TEC 32.153(c)

P
  • To a third party if the operator has contracted with the third party to provide a service for a school purpose for or on behalf of the operator.  The contract must prohibit the third party from using any covered information for any purpose other than providing the contracted service.  The operator must require the third party to implement and maintain reasonable procedures and practices designed to prevent disclosure of covered information;
TEC 32.153(d)

P
  • To recommend to a student additional services or content relating to an educational, learning, or employment opportunity within a website, online service, online application, or mobile application if the recommendation is not determined by payment or other consideration from a third party;
TEC 32.154(3)

P
  • For development and improvement of educational websites, online services, online applications, or mobile applications, if the covered information is not associated with an identified student;
TEC 32.154(2)

P
  • By authority of a law enforcement agency to obtain any information from an operator as authorized by law or under a court order;
TEC 32.157(1)

P
  • For adaptive learning or customized student learning purposes; or
TEC 32.157(2)

P
  • For maintaining, developing, supporting, improving, or diagnosing the operator's website, online service, online application, or mobile application.
TEC 32.153(e)
TEC 32.154

 
 
Last Updated: Wednesday, January 31, 2018