Student Privacy

Student Data Transparency & Security

Under Colorado’s Student Data Transparency and Security Act, Liberty Common School  is required to post and maintain the following information on its website: (1) a link to the Colorado Department of Education’s Data Dictionary; (2) a link to the Colorado Department of Education’s inventory of data containing personally identifiable information on individual students; (3) student personally identifiable information collected and maintained by Liberty Common School in its electronic-data system that is not reported to the Colorado Department of Education; (4) a list of school-service-contract providers with which Liberty Common School contracts that includes a copy of each school service contract; and (5) to the extent practicable, a list of the school service on-demand providers that Liberty Common School and/or its employees use for school services.

Colorado Department of Education


Click here to access the Colorado Department of Education’s Data Dictionary.


Click here to access a list of the Colorado Department of Education’s inventory of data containing personally identifiable information on individual students.

Liberty Common School


Liberty Common School

1725 Sharp Point Dr. Fort Collins, CO 80525

Liberty Common High School

2745 Minnesota Dr. Fort Collins, CO 80525

 

 

 

STUDENT DATA PRIVACY POLICY

 

 

 

 

I.  Policy Statement

 

Student privacy is a critical component of Liberty Common School’s (LCS) operations, and the protection and management of the various types of student records and Personally Identifiable Information (PII) is critical to LCS’s operations.   Concurrently, using data effectively and responsibly is foundational to making the best decisions in today’s schools and improving student performance. LCS maintains student files, as well as computer systems and related devices that collect and record data as required for educational delivery, management, and reporting purposes.  Student PII or other sensitive data requested, collected, captured, generated, stored, or otherwise entrusted to and maintained by LCS shall be analyzed on a case by case basis and shared only for legitimate educational purposes with those who are authorized, or as required by law. Reasonable care must be taken to ensure that student PII or other sensitive data is never misused or disclosed to unauthorized individuals or agencies.

 

 

The purpose of this policy (Policy) is to establish general privacy practices for student records and PII academic and discipline records, and information captured or generated by LCS’s operations, systems, network devices, or communications.  The policy further delimits conditions where PII may be disclosed.

 

The privacy and protection of confidential student and faculty education records and the PII contained therein shall be governed by the federal Family Education Rights and Privacy Act (FERPA), the Colorado Student Data Transparency and Security Act (SDTSA), and this Policy.

 

This Policy attempts to be as comprehensive as possible, but it is not intended to cover every situation which may be considered student data privacy-related. LCS is committed to providing a place for learning, teaching, and gathering free from concerns that one’s PII will be poorly protected and/or misused. LCS administrators and IT specialists will prioritize student-data privacy when evaluating whether to engage with third-party service providers. The adoption of this Policy are in keeping with this commitment.

 

 

II.  Scope of Policy

 

This Policy applies to all LCS staff and students in contact with PII or sensitive data requested, collected, captured, generated, stored by, or entrusted to LCS.

 

 

III. Definitions

 

1.      Data. Any student or family information collected, captured, stored, generated, or otherwise entrusted to and maintained by LCS, its employees, contractors, agents, systems, storage devices, or other means. This includes systems and devices involved in the transmission and storage of video and voice data.

 

2.      Personally Identifiable Information. As used in this policy, “personally identifiable information” (PII) is information that, alone or in combination, is linked or linkable to a specific individual so as to allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the individual with reasonable certainty.  All student PII is confidential and private.  LCS data privacy procedures adhere to the guidelines set forth in FERPA and SDTSA.

 

PII includes but is not limited to: (1) the student’s name; (2) the name of the student’s parent or other family members; (3) the address or phone number of the student or student’s family; (4) personal identifiers such as the student’s social security number, student number or biometric record; (6) indirect identifiers such as the student’s date of birth, place of birth or mother’s maiden name; or (7) photographic and voice records. 

 

3.      School Service Contract Provider. An entity, other than a public education entity or an institution of higher education, that enters into a formal, negotiated contract with LCS to provide a school service.

 

4.      School Service On-Demand Provider. An entity, other than a public education entity, that provides a school service to LCS, subject to agreement by LCS, or an employee of LCS, to standard, non-negotiable terms and conditions of service established by the providing entity.

 

5.      Student Academic and Discipline Records. "Records" are any information or data, including but not limited to academic and discipline records, recorded in any medium including, but not limited to, handwriting, print, tapes, film, and any electronic storage or retrieval media. "Student records" are those records directly related to a student and maintained by LCS.

 

6.      Third Party. A third party, for the purpose of this Policy, is an entity other than LCS or a person who is not employed by LCS.

 

IV. Transparency

 

LCS will maintain a Student Privacy page on its website.  This page will contain all elements required by the SDTSA, including

 

1.      A list of all School Service On-Demand Providers used by LCS.  This list will be maintained by the IT Department, and updated a minimum of twice per year.

 

2.      A list of any School Service On-Demand Providers which LCS has either refused to use or discontinued to use due to student-privacy concerns.  This list will be maintained by the IT Department.

 

3.      A list of School Service Contract Providers engaged in a contractual relationship with LCS, along with links to the executed contracts.  This list will be maintained jointly by the LCS Administration and the LCS IT Department.

 

4.      A link to access a list of the Colorado Department of Education’s inventory of data containing PII on individual students.

 

5.      A description of PII in language understandable to a layperson.

 

6.      A link to this Policy.

 

 

V. Maintenance of Student Records and Data Retention and Destruction

 

All student-education records, including but not limited to confidential PII and student academic and discipline records, shall be retained for the periods required by governing law and relevant LCS policy. Thereafter, such records are subject to destruction in accordance with governing law, recognized best practices, and Section VII of this Policy.

 

 

VI. Access to Student Records and Personally Identifiable Information

 

1.      Access to PII, and the collection and sharing of PII, is only authorized in accordance with governing law and this Policy.  Student PII or other sensitive data may only be collected or reviewed by LCS staff for legitimate educational purposes related to educational decisions, legal compliance, reporting, or other lawful purposes.

 

2.      Requests for any student academic and/or discipline records will be denied unless it can be reasonably ascertained by an LCS administrator that there is parental consent for the release of requested records to the individual or entity furnishing the request, and that the request is consistent with governing law.  Every new request for a student records will require a new communication of parental consent to an LCS administrator.

 

3.      LCS will only provide student PII to the Colorado Department of Education as required by law or as a condition of receiving a benefit, such as grant funding or special designations.

 

4.      LCS will only disclose student PII and sensitive data to a School Service Contract Provider which contractually agrees to comply with FERPA and SDTSA laws, and for legitimate educational purposes.

 

5.      LCS will only disclose student PII and sensitive data to a School Service On-Demand Provider which contains in its user-agreement language consistent with FERPA and SDTSA laws.

 

6.      Access to LCS computers, e-mail and document accounts, and to electronically stored PII shall be password protected. Further, LCS administrators shall ensure the security of electronically stored PII, including but not limited to: (1) controlled building access; and (2) video surveillance monitoring of building’s ingress/egress.

 

7.      LCS employees, volunteers and students shall report to the LCS administration all threats and known or suspected occurrences of unauthorized access, loss, disclosure, modification, disruption or destruction of electronically stored student records or confidential PII.

 

 

VII. Data Destruction

 

1.      LCS will dispose of or destroy data in a manner consistent with governing law and current industry standards. The IT Director will determine the appropriate process for making sensitive, digitally-maintained data from computer desktops, laptops, hard drives, and portable media, inaccessible and unusable.  The IT Director will be responsible for compliance with governing law and this Policy.

 

2.      Paper and hardcopy records maintained by LCS and containing student PII or other sensitive data shall be shredded.

 

3.      A School Service Contract Provider must contractually agree to destroy student PII in a manner consistent with the SDTSA.  This means:

 

a.      The School Service Contract Provider will contractually agree to destroy records containing student PII at the request of LCS, unless parental consent for record retention is attained. The contract provider shall provide the LCS with a Certificate of Data Destruction, and

b.      The School Service Contract Provider will contractually agree to, following the termination or conclusion of the contract, destroy all student PII collected, generated, or inferred as a result of the contract.  The contract provider shall provide the LCS with a Certificate of Data Destruction.

 

 

 

VIII. Vendor or Provider Misuse and/or Unauthorized Disclosure of PII

 

If LCS identifies that a School Service On-Demand Provider or School-Service Contract provider has experienced a material breach, engaged in misuse of student data, or allowed unauthorized release of student PII, the LCS Board of Directors will ensure the following are accomplished:

1.      Notifying the individuals impacted by the breach; communicate the steps in place to address and resolve the breach.

 

2.      Public discussion of the nature of the material breach, and provide an opportunity for the contract provider to respond.

 

3.      A decision whether the contract shall be subject to termination and if the provider will be disqualified from future contracts with LCS.

 

IX.  Staff Training

 

1.      LCS shall take measures to periodically educate and train staff regarding its obligation under governing law and this Policy to maintain the privacy and protection of student records and PII, including but not limited to maintaining the privacy and protection of PII when using LCS information technology, online services and mobile applications.

 

2.      LCS staff are and will continue to be trained to refrain from engaging any Service On-Demand Provider without first consulting either an LCS administrator or the LCS IT Director regarding the specific provider being considered.  Staff will only engage a Service On-Demand Provider once receiving explicit permission to do so.

 

 

X.  Data Security Audits

 

The IT Director shall implement practices and procedures to maintain the security of electronically stored PII, including but not limited to: (1) access logging and monitoring by device and location; (2) intrusion detection and vulnerability testing; (3) use of automated tools and monitoring procedures to detect, report and remediate system vulnerabilities and breaches; (4) responding to threats and occurrences of unauthorized access, loss, disclosure, modification, disruption or destruction of electronically stored PII to LCS administration; and (5) notifying the LCS administration of affected persons of such threats and occurrences.

 

The director of the IT Department will determine if an external/independent third party security auditor is necessary to maintain the integrity of LCS server security.

 

 

 

XI. Enforcement

 

LCS is committed to enforcing this Policy and engaging in practices to protect the privacy of every student and family from who it collects data.  LCS staff found to be in violation of this Policy, at the sole discretion of LCS administrators, may be subject to disciplinary action, up to and including termination.

 

 

 

Policy Adopted: June, 2019


                        

Click here to access a list of school-service-contract providers with which Liberty Common contracts, together with copies of each of their school service contracts.

 

Click here to access a list of school-service on-demand providers that Liberty Common School and/or its employees use for school services.