ID H0252

State Board of Education authorized to adopt rules implementing a student information management system and educational data system, with all longitudinal educational data housed and maintained in the educational data system.

Clarifies that student data reported in aggregate form that cannot be tied back to individual students is not considered personally identifiable data, even if multiple aggregate requests could be combined to identify students.

Prohibits transfer of confidential student data outside Idaho except for specific circumstances including out-of-state student transfers, higher education attendance, voluntary program participation, vendor contracts, and migrant student reporting.

Requires State Board of Education to develop detailed data security plan including access guidelines, administrative safeguards, encryption provisions, privacy compliance standards, security audits, breach procedures, and data retention policies.

Establishes civil penalties up to $50,000 per violation for unauthorized data release or failure to comply with privacy requirements, and mandates annual notification to governor and legislature regarding new data collections, changes to existing collections, and security audit results.