Law note · Idaho
Student Data Accessibility, Transparency and Accountability Act (SDATAA)
SDATAA binds the State Board of Education, school districts, public charter schools, and their private vendors on the collection, use, and disclosure of K-12 student data.
A student's permanent educational record may not include, among other exclusions, the student's biometric information, Social Security number, or data collected through statewide-assessment affective computing such as facial-expression, EEG, or eye-tracking analysis (with a carve-out for special needs and exceptional students).
Unlike Idaho's general breach and genetic-privacy statutes, SDATAA arms an injured party directly: a person found, in a court action initiated by an injured party or in a civil enforcement action by the State Board or the Department of Education, to have violated the Act is liable for a civil penalty of up to $50,000 per violation; a district or charter school that fails to adopt, implement, and post its student-data policy faces a separate $50,000 civil penalty enforced by the State Board with Attorney General assistance.
Unless otherwise prohibited by law or court order, a school district must provide a parent or guardian with copies of all of their child's educational records upon request, so long as the child has not yet turned eighteen.
What it asks of an app
- Do not retain a K-12 student's biometric information, Social Security number, or affective-computing assessment data as part of the student's permanent educational record.
- Expect a violation of SDATAA to be actionable directly by an injured parent or student, not solely by a regulator, for a civil penalty of up to $50,000 per violation.
- If you are a school district or public charter school, adopt, implement, and post your student-data policy; failing to do so carries its own separate civil penalty.
- Unless prohibited by law or court order, give a parent or guardian copies of all of their child's educational records upon request, so long as the child has not yet turned eighteen.
When LexLint raises it
Declared activities: processes_biometrics
Primary source: official Idaho statute text, Idaho Code sec. 33-133, Idaho Legislature