A BILL TO BE ENTITLED
AN ACT amending the law pertaining to the education longitudinal data system, as recommended by the joint legislative oversight committee on information technology.
The General Assembly of North Carolina enacts:
SECTION 1.  G.S. 116E‑1(7) reads as rewritten:
"(7)	'Workforce data' means data relating to employment status, wage information, geographic location of employment, and employer information. Such data is individual data."
SECTION 2.  G.S. 116E‑2(a) reads as rewritten:
"(a)	The North Carolina Longitudinal Data System is a statewide data system that contains individual student data and workforce data from all levels of education and the State's workforce. The purpose of the System is to do the following:
(1)	Facilitate and enable the exchange of student data and workforce among agencies and institutions within the State.
(2)	Generate timely and accurate information about student performance that can be used to improve the State's education system and guide decision makers at all levels.
(3)	Facilitate and enable the linkage of student data and workforce data."
SECTION 3.  G.S. 116E‑3 is amended by adding a new subsection to read:
"(f)	The Board shall be located administratively within the Department of Public Instruction but shall exercise its powers and duties independently of the Department of Public Instruction and the State Board of Education. The Board may employ professional and clerical staff, including an executive director."
SECTION 4.  G.S. 116E‑4 reads as rewritten:
"§ 116E‑4.  Powers and duties of the Board.
(a)	The Board shall have the following powers and duties:
(1)	Develop an implementation plan to phase in the establishment and operation of the System.
(2)	Provide general oversight and direction for the System and to users of the System.
(3)	Approve the annual budget for the System.
(4)	Before the use of any individual data in the System, the Board shall do the following:
a.	Create an inventory of the individual student data proposed to be accessible in the System and required to be reported by State and federal education mandates.
b.	Develop and implement policies to comply with FERPA and any other privacy measures, as required by law or the Board.
c.	Develop a detailed data security and safeguarding plan that includes the following:
1.	Authorized access and authentication for authorized access.
2.	Privacy compliance standards.
3.	Privacy and security audits.
4.	Breach notification and procedures.
5.	Data retention and disposition policies.
(5)	Oversee routine and ongoing compliance with FERPA and other relevant privacy laws and policies.
(6)	Make and enter into contracts and agreements necessary or incidental to the performance of its powers and duties under this Article; use revenue available to the Board for administrative expenses and its obligations under the contracts and agreement; and ensure that any contracts that develop, use, or integrate databases that are outsourced to private vendors include express provisions that safeguard privacy and security and include penalties for noncompliance.
(7)	Designate a standard and compliance time line for electronic transcripts that includes the use of UID to ensure the uniform and efficient transfer of student data between local school administrative units and institutions of higher education.
(8)	Review research requirements and set policies for the approval of data requests from State and local agencies, the General Assembly, and the public.
(9)	Establish an advisory committee on data quality to advise the Board on issues related to data auditing and tracking to ensure data validity.
(b)	The Board shall adopt rules according to Chapter 150B of the General Statutes as provided in G.S. 116E‑6 to implement the provisions of this Article.
(c)	The Board shall report quarterly to the Joint Legislative Education Oversight Committee, the Joint Legislative Commission on Governmental Operations, and the Joint Legislative Oversight Committee on Information Technology. The report shall include the following:
(1)	An update on the implementation of the System's activities.
(2)	Any proposed or planned expansion of System data.
(3)	Any other recommendations made by the Board, including the most effective and efficient configuration for the System.
(d)	The Board is deemed an authorized representative of the Department of Public Instruction, The University of North Carolina, and the North Carolina System of Community Colleges under applicable State and federal law for the purpose of accessing and compiling student record data for research purposes.
(e)	The Board may receive funding from the following sources:
(1)	State appropriations.
(2)	Grants or other assistance from local school administrative units, community colleges, constituent institutions of The University of North Carolina, or private colleges and universities.
(3)	Federal grants.
(4)	Any other grants or contributions from public or private entities received by the System."
SECTION 5.  G.S. 116E‑5 reads as rewritten:
"§ 116E‑5.  North Carolina Longitudinal Data System.
(a)	There is created the North Carolina Longitudinal Data System. The System is an information technology asset of the State and shall be located administratively within the Department of Public Instruction but shall be operated independently of the Department of Public Instruction and the State Board of Education.
(b)	The System shall allow users to do the following:
(1)	Effectively organize, manage, disaggregate, and analyze individual student and workforce data.
(2)	Examine student progress and outcomes over time, including preparation for postsecondary education and the workforce.
	(d)	The System shall perform the following functions and duties:
(1)	Serve as a data broker for the System, including data maintained by the following:
a.	The Department of Public Instruction.
b.	Local boards of education, local school administrative units, and charter schools.
c.	The University of North Carolina and its constituent institutions.
d.	The Community Colleges System Office and local community colleges.
e.	The North Carolina Independent College and Universities, Inc., and private colleges or universities.
f.	Nonpublic schools serving elementary and secondary students.
g.	The Department of Commerce, Division of Employment Security.
h.	The Department of Revenue.
i.	The Department of Health and Human Services.
j.	The Department of Labor.
(2)	Ensure routine and ongoing compliance with FERPA, the Internal Revenue Code, and other relevant privacy laws and policies, including the following:
a.	The required use of de‑identified data in data research and reporting.
b.	The required disposition of information that is no longer needed.
c.	Providing data security, including the capacity for audit trails.
d.	Providing for performance of regular audits for compliance with data privacy and security standards.
e.	Implementing guidelines and policies that prevent the reporting of other potentially identifying data.
(3)	Facilitate information and data requests for State and federal education reporting with existing State agencies as appropriate.
(4)	Facilitate approved responses to public information requests from the Board.
(5)	Develop a process for obtaining information and data requested by the General Assembly and Governor of current de‑identified data and research.
(e)	Use of data accessible through the System shall be regulated in the following ways:
(1)	Direct access to data shall be restricted to authorized staff of the Board.
(2)	Only de‑identified data shall be used in the analysis, research, and reporting conducted by the System.
(3)	The Board shall only use aggregate data in the release of data in reports and in response to data requests.
(4)	Data that may be identifiable based on the size or uniqueness of the population under consideration shall not be reported in any form by the System.
(5)	The Board shall not release information that may not be disclosed under FERPA, the Internal Revenue Code, and other applicable privacy laws and policies.
(6)	Individual or personally identifiable data accessed through the System shall not be a public record under G.S. 132‑1.
					"
SECTION 6.  This act is effective when it becomes law.