Current through Register Vol. 28, No. 3, September 1, 2024
4.1 The Department shall collect and maintain data, including Personally Identifiable Information, in compliance with its rights and obligations under federal and state laws.
4.2 The Department shall provide data, including Personally Identifiable Information, to implement applicable Research Agendas established by the P-20 Council.
4.3 When a Research Agenda is established by the P-20 Council which requires the use of Personally Identifiable Information from data collected and maintained or to be collected and maintained by the Department, a written agreement in the form prescribed by the Department shall be entered into.
4.3.1 If the Research Agenda is to conduct a study for or on behalf of school, school district or postsecondary institutions it must be for the purpose of: improving instruction; developing, validating, or administering predictive tests; or administering student aid programs. In the case of such a study, the written agreement shall, at a minimum, do the following:
4.3.1.1 Specify the purpose, scope and duration of the study and the information to be disclosed; and
4.3.1.2 Require the organization to: use Personally Identifiable Information only to meet the purpose(s) of the study; limit access to Personally Identifiable Information to those with legitimate interests; and destroy any Personally Identifiable Information upon completion of the study and specify the time period in which the information must be destroyed.
4.3.2 If the Research Agenda is to conduct an audit or evaluation of a Federal or State supported education program or to enforce or comply with Federal legal requirements that relate to those education programs, as defined by the Family Educational Rights and Privacy Act, 20 U.S.C. §
1232(g) and its implementing regulations at 34 CFR part 99, the written agreement shall, at a minimum, do the following:
4.3.2.1 Designate an authorized representative; and
4.3.2.2 Specify what Personally Identifiable Information will be disclosed and for what purpose, which purpose shall be one allowable under the provisions of the Family Educational Rights and Privacy Act, 20 U.S.C. §
1232(g) and its implementing regulations at 34 CFR part 99 ; and
4.3.2.3 Describe the activity to make clear it falls within an allowable purpose; and
4.3.2.4 Require the authorized representative to destroy Personally Identifiable Information upon completion of the evaluation and specify the time period in which the information must be destroyed; and
4.3.2.5 Include policies and procedures to protect Personally Identifiable Information from further disclosure and unauthorized use.
4.4 Any written agreement entered into under this regulation shall prohibit modification or amendment except by written agreement duly executed by the parties to that agreement.
