Colorado’s Student Data Privacy Laws

Staff Student Data Privacy Training J A N U A RY 8 , 2 0 1 8

Staff Student Data Privacy Training Last year, Colorado passed the Student Transparency and Security Act (HB - 16 - 1423). This new law requires greater scrutiny of online vendor terms of agreement, such as apps used in classrooms, that collect student data and greater transparency with the public as to which vendors are utilized by a school district and what data is being collected by students. What is the Student Transparency and Security Act? This new state law identifies new student data privacy requirements for school districts, schools and personnel. It requires all of us to become more aware of how apps, software and tools utilize and collect student data, and take precautions to protect this data. Additionally, it requires companies and developers to become more transparent on the use of that data.

Staff Student Data Privacy Training Definitions Two kinds of service providers School Service Contract Provider "School Service Contract Provider" or "Contract Provider" means an entity, other than a Public Education Entity or an Institution of Higher Education that enters into a formal, negotiated contract with a Public Education Entity to provide a School Service. [C.R.S. 22-16- 103 (8)] A Contract Provider is an entity that provides a School Service on a sustained and continuing basis for the term of the contract. That provider would be held to the terms of a formal, negotiated contract with a Public Education Entity. This contract must follow the school district s procurement processes and cannot be entered into with an employee that does not have signatory authority.

Staff Student Data Privacy Training School Service On-Demand Provider "School Service On-Demand Provider" or "On-Demand Provider" means an entity, other than a Public Education Entity, that provides a School Service on occasion to a Public Education Entity, subject to agreement by the Public Education Entity, or an employee of the Public Education Entity, to standard, non-negotiable terms and conditions of service established by the providing entity. [C.R.S. 22-16-103 (9)] Unlike a Contract Provider, either the LEP or an employee of a LEP can engage an On-Demand Provider for a School Services. For example, a teacher could download an app and click to agree with the vendor s Terms of Service. In addition, an On- Demand Provider can provide services only on an occasional, as-needed basis, or provide services just to a single classroom or teacher. These services could be covered by a non-negotiable Terms of Service or a click wrap agreement.

Staff Student Data Privacy Training Why is this important for me to know about? Technology tools and apps are making it possible for educators and students to collaborate, create, and share ideas more easily than ever. When schools and teachers use technology, students data including some personal information may be collected by educators and the companies that provide apps and online services. With this law, it will become mandatory for you to review what applications you are bringing into the classroom for safe data privacy practices. Additionally, for children 13 and younger, parental consent will be required for the use of apps, websites, and software that collect student data. https://youtu.be/97BkAqNtG9g

Staff Student Data Privacy Training Requesting approval for new software/apps We will be accepting requests for new software/apps twice a year, and will post a form on the staff website for requests. We understand there may be extenuating circumstances where a new software/app becomes available during the school year, and those requests will be evaluated on a case by case basis. On Demand Approval Process You have submitted to your Leads or Directors your software/app requests by grade level for parental approval. We have created a Parental Consent form that the Lead teachers will send out to parents to request their consent for student use of those applications in the classroom. It is our hope that all parents will return the forms in a timely manner but realistically, it will take time to get the approval forms back. Unfortunately, if you do not have parental consent for a student, that student cannot participate in using that software/app in the classroom. This only applies to software/apps where students need to log in with personally identifiable information.

Staff Student Data Privacy Training How will I be able to review apps and websites I use in my classroom to make sure I am conforming with the law? These are guidelines for consideration in proposing a request for new software/app.

Staff Student Data Privacy Training AA Approved Vendor w/DPA List vs. Approved Vendors List Approved Vendor w/DPA means that we have a paid negotiated contract with this vendor, and they have signed a student data privacy agreement with American Academy. They have agreed to protect our student s privacy in accordance with the new law. The Approved Vendors List is all software vendors used in our schools which may be on the Approved DPA List, AND MORE IMPORTANTLY the software/apps that need parental consent for use in the classroom. This is the list that you need to pay special attention to when considering use in the classroom. YOU CANNOT USE ANY SOFTWARE OR APP IN YOUR CLASSROOM THAT HAS NOT BEEN APPROVED BY OUR NEGOTIATED VENDOR LIST OR BY PARENTAL APPROVAL. AA Privacy and Protection of Confidential Student Information Policy http://www.aak8.org/apps/pages/aa-studentdataprivacy-about

Staff Student Data Privacy Training Where can I find all of this information Staff and parents can find this information on our website under the About tab and scrolling down to the Student Data Privacy section. http://www.aak8.org/apps/pages/aa-studentdataprivacy-about

QUESTIONS