GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2011
SESSION LAW 2012-133
HOUSE BILL 964
AN ACT to create the north carolina longitudinal data system and governing board; and to provide that private colleges and UNIVERSITIES, NonPUBLIC schools, and the north carolina independent colleges and universities are not liable for a breach of confidentiality caused by the act or OMISSION of a state agencY, local school administrative unit, community college, or constituent institution of the university of north carolina.
The General Assembly of North Carolina enacts:
SECTION 1.(a) The General Statutes are amended by adding a new Chapter to read:
"Education Longitudinal Data System.
"Article 1."North Carolina Longitudinal Data System.
"§ 116E-1. Definitions.
(1) "Board" means the governing board of the North Carolina Longitudinal Data System.
(2) "De-identified data" means a data set in which parent and student identity information, including the unique student identifier and student social security number, has been removed.
(3) "FERPA" means the federal Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g.
(4) "Student data" means data relating to student performance. Student data includes State and national assessments, course enrollment and completion, grade point average, remediation, retention, degree, diploma or credential attainment, enrollment, discipline records, and demographic data. Student data does not include juvenile delinquency records, criminal records, and medical and health records.
(5) "System" means the North Carolina Longitudinal Data System.
(6) "Unique Student Identifier" or "UID" means the identifier assigned to each student by one of the following:
a. A local school administrative unit based on the identifier system developed by the Department of Public Instruction.
b. An institution of higher education, nonpublic school, or other State agency operating or overseeing an educational program, if the student has not been assigned an identifier by a local school administrative unit.
(7) "Workforce data" means data relating to employment status, wage information, geographic location of employment, and employer information.
"§ 116E-2. Purpose of the North Carolina Longitudinal Data System.
(a) The North Carolina Longitudinal Data System is a statewide data system that contains individual-level student data and workforce data from all levels of education and the State's workforce. The purpose of the System is to do the following:
(1) Facilitate and enable the exchange of student data among agencies and institutions within the State.
(2) Generate timely and accurate information about student performance that can be used to improve the State's education system and guide decision makers at all levels.
(3) Facilitate and enable the linkage of student data and workforce data.
(b) The linkage of student data and workforce data for the purposes of the System shall be limited to no longer than five years from the later of the date of the student's completion of secondary education or the date of the student's latest attendance at an institution of higher education in the State.
"§ 116E-3. North Carolina Longitudinal Data System Board.
(a) There is established the North Carolina Longitudinal Data System Board which shall consist of the following 18 members:
(1) The Superintendent of Public Instruction, or the Superintendent's designee.
(2) The President of The University of North Carolina, or the President's designee.
(3) The President of the North Carolina Community College System, or the President's designee.
(4) The Secretary of the Department of Health and Human Services, or the Secretary's designee.
(5) The Assistant Secretary of the Department of Commerce, Division of Employment Security, or the Assistant Secretary's designee.
(6) The Secretary of the Department of Revenue, or the Secretary's designee.
(7) The Commissioner of Labor, or the Commissioner's designee.
(8) The President of the North Carolina Independent Colleges and Universities, Inc., or the President's designee.
(9) The Commissioner of Motor Vehicles, Department of Transportation, or the Commissioner's designee.
(10) The State Chief Information Officer, or the Officer's designee.
(11) The State Controller, or the Controller's designee.
(12) Three members appointed by the General Assembly upon the recommendation of the President Pro Tempore of the Senate.
(13) Three members appointed by the General Assembly upon the recommendation of the Speaker of the House of Representatives.
(14) One member appointed by the Governor, to serve at the Governor's pleasure.
(b) Appointed members of the Board shall serve terms of four years. Appointed members may be reappointed but shall not serve more than two consecutive terms. Vacancies among appointed members shall be filled by the appointing entity and shall be for the remainder of the vacant term.
(c) The Board shall elect from the appointed members a chair and a vice-chair for a term of two years. A chair may serve no more than two consecutive terms.
(d) Members of the Board shall receive such per diem compensation and necessary travel and subsistence expenses while engaged in the official discharge of the official duties as is provided by law for members of State boards and commissions.
"§ 116E-4. Powers and duties of the Board.
(a) The Board shall have the following powers and duties:
(1) Develop an implementation plan to phase in the establishment and operation of the System.
(2) Provide general oversight and direction to the System.
(3) Approve the annual budget for the System.
(4) Before the use of any individual data in the System, the Board shall do the following:
a. Create an inventory of the individual student data proposed to be accessible in the System and required to be reported by State and federal education mandates.
b. Develop and implement policies to comply with FERPA and any other privacy measures, as required by law or the Board.
c. Develop a detailed data security and safeguarding plan that includes the following:
1. Authorized access and authentication for authorized access.
2. Privacy compliance standards.
3. Privacy and security audits.
4. Breach notification and procedures.
5. Data retention and disposition policies.
(5) Oversee routine and ongoing compliance with FERPA and other relevant privacy laws and policies.
(6) Ensure that any contracts that govern databases that are outsourced to private vendors include express provisions that safeguard privacy and security and include penalties for noncompliance.
(7) Designate a standard and compliance time line for electronic transcripts that includes the use of UID to ensure the uniform and efficient transfer of student data between local school administrative units and institutions of higher education.
(8) Review research requirements and set policies for the approval of data requests from State and local agencies, the General Assembly, and the public.
(9) Establish an advisory committee on data quality to advise the Board on issues related to data auditing and tracking to ensure data validity.
(b) The Board shall adopt rules according to Chapter 150B of the General Statutes as provided in G.S. 116E-6 to implement the provisions of this Article.
(c) The Board shall report annually to the Joint Legislative Education Oversight Committee by December 15. The report shall include the following:
(1) An update on the implementation of the System's activities.
(2) Any proposed or planned expansion of System data.
(3) Any other recommendations made by the Board, including the most effective and efficient configuration for the System.
"§ 116E-5. North Carolina Longitudinal Data System.
(a) There is created the North Carolina Longitudinal Data System. The System shall be located administratively within the Department of Public Instruction but shall exercise its powers and duties independently of the Department of Public Instruction and the State Board of Education.
(b) The System shall allow users to do the following:
(1) Effectively organize, manage, disaggregate, and analyze individual student and workforce data.
(2) Examine student progress and outcomes over time, including preparation for postsecondary education and the workforce.
(c) The System shall be considered an authorized representative of the Department of Public Instruction, The University of North Carolina, and the North Carolina System of Community Colleges under applicable federal and State statutes for purposes of accessing and compiling student record data for research purposes.
(d) The System shall perform the following functions and duties:
(1) Serve as a data broker for the System, including data maintained by the following:
a. The Department of Public Instruction.
b. Local boards of education, local school administrative units, and charter schools.
c. The University of North Carolina and its constituent institutions.
d. The Community Colleges System Office and local community colleges.
e. The North Carolina Independent College and Universities, Inc., and private colleges or universities.
f. Nonpublic schools serving elementary and secondary students.
g. The Department of Commerce, Division of Employment Security.
h. The Department of Revenue.
i. The Department of Health and Human Services.
j. The Department of Labor.
(2) Ensure routine and ongoing compliance with FERPA, the Internal Revenue Code, and other relevant privacy laws and policies, including the following:
a. The required use of de-identified data in data research and reporting.
b. The required disposition of information that is no longer needed.
c. Providing data security, including the capacity for audit trails.
d. Providing for performance of regular audits for compliance with data privacy and security standards.
e. Implementing guidelines and policies that prevent the reporting of other potentially identifying data.
(3) Facilitate information and data requests for State and federal education reporting with existing State agencies as appropriate.
(4) Facilitate approved public information requests.
(5) Develop a process for obtaining information and data requested by the General Assembly and Governor of current de-identified data and research.
(e) Use of data accessible through the System shall be regulated in the following ways:
(1) Direct access to data shall be restricted to authorized staff of the System.
(2) Only de-identified data shall be used in the analysis, research, and reporting conducted by the System.
(3) The System shall only use aggregate data in the release of data in reports and in response to data requests.
(4) Data that may be identifiable based on the size or uniqueness of the population under consideration shall not be reported in any form by the System.
(5) The System shall not release information that may not be disclosed under FERPA, the Internal Revenue Code, and other relevant privacy laws and policies.
(6) Individual or personally identifiable data accessed through the System shall not be a public record under G.S. 132-1.
(f) The System may receive funding from the following sources:
(1) State appropriations.
(2) Grants or other assistance from local school administrative units, community colleges, constituent institutions of The University of North Carolina, or private colleges and universities.
(3) Federal grants.
(4) Any other grants or contributions from public or private entities received by the System.
"§ 116E-6. Data sharing.
(a) Local school administrative units, charter schools, community colleges, constituent institutions of The University of North Carolina, and State agencies shall do all of the following:
(1) Comply with the data requirements and implementation schedule for the System as set forth by the Board.
(2) Transfer student data and workforce data to the System in accordance with the data security and safeguarding plan developed by the Board under G.S. 116E-5.
(b) Private colleges and universities, the North Carolina Independent Colleges and Universities, Inc., and nonpublic schools may transfer student data and workforce data to the System in accordance with the data security and safeguarding plan developed by the Board under G.S. 116E-5."
SECTION 1.(b) G.S. 105-259(b) is amended by adding a new subdivision to read:
"(43) To furnish requested workforce data to the North Carolina Longitudinal Data System, as required by G.S. 116E-6. Information furnished to the North Carolina Longitudinal Data System shall be provided in a nonidentifying form for statistical and analytical purposes to facilitate and enable the linkage of student data and workforce data and shall not include information allowing the identification of specific taxpayers."
SECTION 1.(c) Notwithstanding G.S. 116E-6 as created by this act, State agencies that have not received an appropriation or sufficient grant funding to support participation in a longitudinal data system shall not be required to submit data to the System prior to July 1, 2015.
SECTION 1.(d) Appointments to the North Carolina Longitudinal Data System Board shall be made by the appointing entity no later than August 1, 2012. The State Board of Education, the Board of Governors of The University of North Carolina, the State Board of Community Colleges, the Division of Employment Security of the Department of Commerce, the Department of Revenue, the Department of Health and Human Services, the Division of Motor Vehicles of the Department of Transportation, and the Department of Labor, in consultation with the North Carolina Independent Colleges and Universities, Inc., shall establish the North Carolina Longitudinal Data System that shall be fully operational by July 1, 2014. Prior to facilitating access to any individual data in the North Carolina Longitudinal Data System, the North Carolina Longitudinal Data System Board shall report to the Joint Legislative Education Oversight Committee on the inventory of individual student data proposed to be maintained in the System, the policies of the Board to comply with the federal Family Educational Rights and Privacy Act, Internal Revenue Code and other privacy measures required by law and the Board, and a data security and safeguarding plan for the System. The Board shall (i) evaluate the efficiency, effectiveness, and cost in structuring the System as a federated data system or a centralized data warehouse and (ii) assess the technical capabilities and costs of each entity for data sharing through the System, and shall report to the Joint Legislative Education Oversight Committee on those issues by January 15, 2013.
SECTION 2. Article 39 of Chapter 115C of the General Statutes is amended by adding a new section to read:
"§ 115C-566.1. Disclosure of student data and records by nonpublic schools.
A nonpublic school that discloses personally identifiable information in student data or records according to the terms of a written agreement with a State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina, in compliance with the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, shall not be liable for a breach of confidentiality, disclosure, use, retention, or destruction of the student data or records if the breach, disclosure, use, retention, or destruction results from actions or omissions of either (i) the State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina to which the data was provided or (ii) persons provided access to the data or records by those entities."
SECTION 3. Chapter 116 of the General Statutes is amended by adding a new Article to read:
"Article 27A.
"Disclosure of Student Data and Records by Private Institutions.
"§ 116-229.1. Disclosure of student data and records by private colleges and universities.
(a) A private college or university that discloses personally identifiable information in student data or records according to the terms of a written agreement with a State agency, local school administrative unit, community college, constituent institution of The University of North Carolina, or the North Carolina Independent Colleges and Universities, Inc., in compliance with the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, shall not be liable for a breach of confidentiality, disclosure, use, retention, or destruction of the student data or records if the breach, disclosure, use, retention, or destruction results from actions or omissions of either (i) the State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina to which the data was provided or (ii) persons provided access to the data or records by those entities.
(b) The North Carolina Independent Colleges and Universities, Inc., shall not be liable for a breach of confidentiality, disclosure, use, retention, or destruction of student data or records transferred on behalf of a private college or university to a State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina if the breach, disclosure, use, retention, or destruction results from actions or omissions of either (i) the State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina to which the data was provided or (ii) persons provided access to the data or records by those entities."
SECTION 4. This act is effective when it becomes law.
In the General Assembly read three times and ratified this the 27th day of June, 2012.
s/ Walter H. Dalton
President of the Senate
s/ Thom Tillis
Speaker of the House of Representatives
s/ Beverly E. Perdue
Governor
Approved 12:37 p.m. this 29th day of June, 2012