Data Governance Plan
This policy is designed to ensure only authorized disclosure of confidential and personally identifiable information. It applies to all employees, volunteers, board members, and contractors of Utah International Charter School. It will be updated regularly to conform with best practices for protection of data.
Student Data Manager
The board of trustees of Utah International appoints a student data manager, typically the principal, with the following responsibilities:
- Authorize and manage the sharing of personally identifiable student or staff information outside of the school.
- Act as the primary local point of contact for the state student data officer.
- May share personally identifiable student information as follows:
- with the student and the minor student’s parent or legal guardian.
- when required by federal or state law.
- in an aggregate form with appropriate data redaction techniques
- for a school official at a school where the student has transferred or is planning to transfer
- with an authorized caseworker or other representative of the Department of Human Services or Juvenile Court.
- in response to a subpeona issued by a court
- directory information
- Create and maintain a list of all UI staff, volunteers and contractors who have access to personally identifiable student data.
- Ensure and document annual training on data privacy to all employees and volunteers.
- Maintain the meta-data dictionary for Utah International, which lists the contractors with whom Utah International shares student or staff data necessary for an education purpose.
Training and Assurances
All UI employees, board members, and volunteers with access or potential access to confidential or personally identifiable student or staff information must read, sign and adhere to the non-disclosure agreement and participate in annual data privacy training .
In accordance with FERPA, Utah International will provide adult students (18 and older) and the parents of minor students with access to the student’s records upon request in a timely fashion, not to exceed 10 business days, excluding information about other students and letters of recommendation if the student has waived access.
UI will share student information with school officials who have a legitimate educational interest in the information (usually the transfer of a UI student to a new school), and will document all such record requests.
Third party contractors may have access to students’ personally identifiable information if the contractor is designated as a school official as defined in FERPA and listed in the Meta-Data Dictionary. All third party contractors must be compliant with Utah’s Student Data Protection Act.
Utah International will disclose personally identifiable student information to government entities for legally-required reporting, audit, or evaluation purposes only.
Utah International will follow industry best practices and our own technology security policy to protect information and data, and will promptly notify adult students and the parents of minor students in the event of a breach.
Record Retention and Expungement
Utah International will retain and dispose of student records in accordance with Section 63G-2-604, 53A-1-1407, and shall comply with active retention schedules for student records per Utah Division of Archive and Record Services.
The following records may not be expunged: grades, transcripts, a record of the student’s enrollment, assessment information.
The procedure for expungement shall match the record amendment procedure found in 34 CFR 99, Subpart C of FERPA.
- If a parent believes that a record is misleading, inaccurate, or in violation of the student’s privacy, they may request that the record be expunged.
- UI shall decide whether to expunge the data within a reasonable time after the request.
- If UI decides not to expunge the record, they will inform the parent of their decision as well as the right to an appeal hearing.
- UI shall hold the hearing within a reasonable time after receiving the request for a hearing.
- UI shall provide the parent notice of the date, time, and place in advance of the hearing.
- The hearing shall be conducted by any individual that does not have a direct interest in the outcome of the hearing.
- UI shall give the parent a full and fair opportunity to present relevant evidence. At the parents’ expense and choice, they may be represented by an individual of their choice, including an attorney.
- UI shall make its decision in writing within a reasonable time following the hearing.
- The decision must be based exclusively on evidence presented at the hearing and include a summary of the evidence and reasons for the decision.
- If the decision is to expunge the record, UI will seal it or make it otherwise unavailable to other staff and educators.