Notification of Privacy Practices

Colorado’s newly passed Student Data Transparency and Security Act [C.R.S. Section 22-16-101 et seq.] adds to existing
laws pertaining to student data privacy and security. It adopts additional duties that the State Board of Education (State
Board), Department of Education (CDE), and Local Education Providers (LEPs), a term that includes School Districts,
Boards of Cooperative Services, and Charter Schools, must all comply with. The purpose of this law is to increase the
transparency and security of all Student Personally Identifiable Information (Student PII) that CDE and LEPs collect and
maintain. It also imposes duties on all commercial entities that provide school services by formal contract with CDE or
with an LEP (called Contract Providers in the law) and the commercial entities that an LEP or employees of an LEP choose
to use without entering in a formal, negotiated contract (On-Demand Providers). The latter, On-Demand Providers, may
also be referred to as “Click-through Applications”.

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."

• Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.
• Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.
• Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):
  • School officials with legitimate educational interest;
  • Other schools to which a student is transferring;
  • Specified officials for audit or evaluation purposes;
  • Appropriate parties in connection with financial aid to a student;
  • Organizations conducting certain studies for or on behalf of the school;
  • Accrediting organizations;
  • To comply with a judicial order or lawfully issued subpoena; 
  • Appropriate officials in cases of health and safety emergencies; and
  • State and local authorities, within a juvenile justice system, pursuant to specific State law.

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

The Children’s Online Privacy Protection Act (COPPA) gives parents control over what information websites can collect from their kids. COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.

The Protection of Pupil Rights Amendment (PPRA) applies to the programs and activities of a state education agency (SEA), local education agency (LEA), or other recipient of funds under any program funded by the U.S. Department of Education.  It governs the administration to students of a survey, analysis, or evaluation that concerns one or more of the following eight protected areas:

1. political affiliations or beliefs of the student or the student’s parent;
2. mental or psychological problems of the student or the student’s family;
3. sex behavior or attitudes;
4. illegal, anti-social, self-incriminating, or demeaning behavior;
5. critical appraisals of other individuals with whom respondents have close family relationships;
6. legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers;
7. religious practices, affiliations, or beliefs of the student or student’s parent; or
8. income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

PPRA also concerns marketing surveys and other areas of student privacy, parental access to information, and the administration of certain physical examinations to minors.  The rights under PPRA transfer from the parents to a student who is 18 years old or an emancipated minor under state law.