The Governing Board recognizes the importance of keeping accurate, comprehensive student records as required by law. The Superintendent or designee shall establish administrative regulations governing the identification, collection, retention, disclosure, and security of student records. These regulations shall ensure the rights of authorized persons to have timely access to student records while maintaining the confidentiality of student records in accordance with state and federal law.
\n
\nThe Superintendent or designee shall designate a certificated employee to serve as custodian of records with responsibility for student records at the district level. At each school, the principal or a certificated employee shall be designated as custodian of records for students enrolled at that school. The custodian of records shall be responsible for implementing Board policy and administrative regulation regarding student records. (5 CCR 431)
\n
\nIf student records containing covered information which is not subject to the California Consumer Privacy Act are under the control of the operator of a website, online service or application, or mobile application, and the student's parent/guardian or the student, if 18 years of age or older, requests deletion of such records, the Superintendent or designee shall provide documentation to the operator that the student has not been enrolled in the district for at least 60 days. (Business and Professions Code 22584)
\n
\nAll appropriate personnel shall receive training regarding district policies and procedures for gathering and handling sensitive student information, including which information should not be solicited.
\n
\nThe district shall not collect or solicit social security numbers or the last four digits of social security numbers of students or their parents/guardians, unless otherwise required to do so by state or federal law. (Education Code 49076.7)
\n
\nThe immigration or citizenship status of a student or a student's family member may only be collected and disclosed in accordance with Board Policy/Administrative Regulation 1445 - Response to Immigration Enforcement.
\n
\nNeither the district nor any district employee shall compile a list, registry, or database based on students' national origin, ethnicity, or religious belief, practice, or affiliation, or disclose student information to federal government authorities for the purpose of compiling such a list, registry, or database for purposes of immigration enforcement. This prohibition does not apply to information that is aggregated and is not personally identifiable. (Government Code 8310.3)
\n
\nThe Superintendent or designee shall develop protocols to comply with a court's restraining order that prohibits a party from accessing specified records and information pertaining to a student. (Family Code 6323.5)
\n
\nStudent Records from Social Media
\n
\nThe Superintendent or designee may gather and maintain information from the social media of any district student, provided that the district first notifies students and parents/guardians about the proposed program, offers an opportunity for public comment at a regularly scheduled Board meeting, and gathers only information that directly pertains to school safety or student safety. (Education Code 49073.6)
\n
\nRetention, Disclosure, and Security of Student Records
\n
\nThe Superintendent or designee shall ensure the confidentiality of student records as required by law and shall establish processes and procedures to safeguard data against damage, loss, or theft, including damage, loss, or theft which may be caused by the use of technology, including artificial intelligence and breaches to the district's digital infrastructure, in the retention or disclosure of student records.
\n
\nThe Superintendent or designee shall ensure that employees receive information and training about cybersecurity, including ways to protect student records from breaches to the district's digital infrastructure.
\n
\nIf the district experiences a cyberattack that impacts more than 500 students or personnel, the Superintendent or designee shall report the cyberattack to the California Cybersecurity Integration Center. (Education Code 35266)
\n
\nThe Superintendent or designee may enter into a contract with a third party for the digital storage, management, and retrieval of student records and/or to authorize a third party provider of digital software to access, store, and use student records, provided that the contract meets the requirements of Education Code 49073.1 and other applicable state and federal laws.