Office Directory

Government Relations, Compliance and Procedures

Administrative Procedures

Administrative Procedures 3000 - Business & Non-Instructional Operations

Administrative Procedure 3050 - Confidential Data and Personally Identifiable Information (PII)

Administrative Procedures 3000 - Business & Non-Instructional Operations

Administrative Procedure 3050 - Confidential Data and Personally Identifiable Information (PII)

I. Purpose

The purpose of this administrative procedure is to outline requirements for employees of Prince George's County Public Schools (PGCPS) who, as part of their professional job duties, may have access to confidential data, including personally identifiable information (PII), regarding current or former students, current or former employees, parents, staff, donors, interns, and/or volunteers.

II. Policy

The Prince George's County Board of Education (Board) is committed to ensuring the effectiveness, safety, and soundness of Prince George's County Public Schools Information Technology Services. The Board believes that it is essential to put preventive measures in place to protect sensitive information in electronic format and maintain the safety and privacy of individuals. (Board Policy 0117)

III. Background

In accordance with federal and state law and Board policy, PGCPS will make every effort to safeguard student records, personnel records, and other types of confidential data from unauthorized use or disclosure to individuals without a legitimate need to access the information.

IV. Definitions

Confidential information – Any data, record, or communication, regardless of format, maintained by PGCPS that (1) includes personally identifiable information regarding students, parents, staff, contractors or volunteers; or (2) would not be available to an individual under the Maryland Public Information Act.
1. Confidential information includes, but is not limited to: personal financial information; employee evaluations; records relating to legal matters; medical or psychological information; and, subject to limitations, certain commercial or financial transaction information, pending investigatory records or records relating to internal, executive-level recommendations.
Directory information – Information contained in a student's education record that would not generally be considered harmful or an invasion of privacy if disclosed. For PGCPS's official designation of what constitutes directory information, see AP 5134 (Family Educational Rights and Privacy Act (FERPA) Annual Notice and Directory Information).
Disclosure – Permitting access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic, to any party except the party that provided or created the record.
Educational record(s) – Records that are directly related to a student, and are maintained by PGCPS or by a party acting for PGCPS. Educational records include, but are not limited to records concerning disciplinary actions taken against students, and records relating to a student's attendance, grades and/or health.
Emergency - A situation that presents an actual, impending, or imminent threat to the health or safety of a student, employee, or other individuals associated with the organization. An emergency is characterized by circumstances that require immediate action to protect individuals, and may include, but is not limited to, events such as natural disasters, terrorist attacks, campus shootings, epidemic disease outbreaks, or serious injury incidents.
Legitimate job-related or educational interest – PGCPS Board members', employees', interns, and contracted employees' need to access a student's educational record or a personnel record to perform their professional responsibilities.
Personally identifiable information (PII) – Includes information within an educational record for students or personnel record for employees (including contract employees) which would reasonably be considered an invasion of privacy if disclosed.
1. Examples of personally identifiable information include, but are not limited to: social security number; employee identification number, or EIN; student identification number; a biometric record; date of birth; race, nationality, ethnicity, origin, color, religious or political beliefs or associations; sex, sexual orientation, gender identity, preferred name, marital status; personal financial information, including credit card and debit card numbers, or financial or bank account numbers and routing information; driver's license numbers and state identification card numbers; medical records or health care history (including pharmaceutical records); employment history or criminal background records; employee home contact information; the name of a parent or other family member; other indirect identifiers, such as a place of birth or mother's maiden name.
2. Other information that, alone or in combination, is linked or linkable to a specific individual that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the individual with reasonable certainty, qualifies as personally identifiable information.
3. Information requested by a person who PGCPS reasonably believes knows the identity of the individual student or employee to whom the record applies.
4. This definition does not apply to information designated as directory information by law or school system procedures.
Personnel record(s) – Records directly related to an employee, in any format and location, that are maintained by PGCPS, or by a party acting for PGCPS.
School official – A person employed by PGCPS as an administrator, supervisor, teacher or support staff member (including health or medical staff and law enforcement personnel). The term also includes a member of the Board.
1. A contractor, consultant, volunteer, or other party to whom PGCPS has outsourced institutional services or functions may also be considered a school official provided that they are performing an institutional service or function for which PGCPS would otherwise use employees and is under the direct control of PGCPS with respect to the use and maintenance of education records.
Third party – Any individual or entity external to PGCPS that is granted access to, collects, stores, processes, or otherwise handles student personally identifiable information (PII) or other sensitive PGCPS data. This includes, but is not limited to, vendors, service providers, consultants, and research organizations.
User - Refers to PGCPS employees, permanent or temporary, substitutes, contractors and contractors; employees, vendors, and students enrolled in PGCPS who have access to the PGCPS network.

V. Procedures

Employment and Access Control
1. Security and control of confidential information shall be the responsibility of each division.
2. During the course of employment, a school official may have access to confidential information. School officials who are authorized to use or disclose confidential information also have the responsibility to safeguard access to such information by limiting access to those who are allowed by permission and/or by law.
3. Any confidential information, whether oral, written, or electronic, should be maintained with respect and in a manner that ensures its confidentiality. The unauthorized release or disclosure of any such confidential information is a violation of this administrative procedure and may result in possible disciplinary action and possible legal liability for the employee or PGCPS.
4. All users (including students, parents and staff) must safeguard access to the PGCPS network and refrain from disclosing usernames or passwords that would allow unauthorized access to PGCPS computer systems and platforms. Employees must immediately report any situation where confidential data and PII is vulnerable or case where it is shared to the Supervisor/Division.
5. Employees may not keep files with PII after departing PGCPS. Upon retirement, resignation, termination, or separation from employment, or at any time upon the request of their supervisor or a senior administrator, all employees shall surrender all organizational records/data involving PII to their appropriate supervisor or senior administrator.
6. The Division of Information Technology (DIT) shall take steps to ensure the school official’s remote electronic access to PII is disabled upon the date of retirement, resignation, termination, or separation from employment.
Security Control of Documents and Confidential Information
1. Protecting PII against inappropriate access, use, disclosure, or transmission requires appropriate administrative, technical, and physical safeguards. These include, but are not limited to:
  1. Physical safeguards include:
    1. ) Storing documents containing PII in secured cabinets or rooms;
    2. ) Ensuring that documents containing PII are not left on desks or in other locations that may be visible to individuals not authorized to access the PII; and
    3. ) Using a privacy screen on monitors in high traffic areas to prevent accidental disclosure.
  2. Minimization
    1. ) The risk of unauthorized disclosure or inappropriate access to PII increases with the amount of data being stored or shared. To reduce the risk:
      1. ) Store only PII that is necessary for the functions of the specific office/department;
      2. ) Reduce the amount of PII included in records (including redaction of financial account information, use of less sensitive substitutes such as partial SSN and the PGCPS Identifier);
      3. ) Minimize aggregations of PII; and
      4. ) Reduce the number and scope of repositories of PII (both physical and electronic copies) and only for the time period where a valid business need for the information exists.
  3. Storage
    1. ) Store only when it is essential for carrying out the specific functions or responsibilities of your office or department within PGCPS, and strictly in accordance with the requirements and limitations outlined in the relevant PGCPS policies.
    2. ) Files containing PII should only be stored on secure devices and/or resources provided by the district.
    3. ) Do not retain any PII that is not directly needed for an approved business purpose, regularly review stored PII to ensure that only necessary information is kept and that the retention period aligns with district or state requirements.
    4. ) Do not replicate documents and files containing PII and/or store them on devices or resources not provided by the district. In cases where back-up copies are required, ensure they are equally secured and protected as the original copy.
  4. Transmission
    1. ) Users with access must take reasonable steps to ensure that they do not mistakenly disclose any confidential information to any unauthorized persons in or outside PGCPS.
    2. ) Records containing PII may only be transferred to authorized internal individuals who possess a legitimate job-related or educational interest and in a method approved by the DIT.
    3. ) Records/data containing PII may only be transferred to authorized third parties with a current agreement in place and through established processes. Inquiries should be directed to DIT at cito@pgcps.org.
  5. Disposal
    Render PII unreadable prior to disposal. For example, this may include shredding paper documents or deleting electronic records from their storage location after such records are no longer needed or when the retention period has expired.
Authorized Disclosure of Confidential Information within PGCPS
1. Only school officials, or individuals within PGCPS who are permitted under law and PGCPS procedure and have a legitimate job-related or educational interest, are authorized to access, use, transmit, handle or receive PII.
2. Employees are prohibited from accessing, using and/or disclosing personally identifiable information for any reason other than the legitimate performance of the individual's job duties or in ways that jeopardize the security of such information.
3. Employees may only share personally identifiable information with school officials or other employees who have a legitimate job-related or educational interest. Employees must consult with their supervisor/designee to discuss any questions or concerns regarding sharing personally identifiable information with other employees or school officials prior to disclosing the information.
4. Keeping Sensitive Information Safe (Encryption and Secure Transmission): All PII and confidential information data must be encrypted during storage and transmission, so it is not available to unauthorized people.
  1. Sending Information: Data in transit must use current secure, industry-standard encryption protocols (e.g., TLS 1.2 or higher, SFTP, or encrypted email).
  2. Storing Information: Any data at rest (saved on servers, removable media, or cloud systems) must be "locked" (encrypted) using official security standards approved by the Division of Information Technology (DIT).
  3. Security Keys: Encryption keys must be securely managed and stored separately from encrypted data in accordance with DIT requirements.
  4. Prohibited Methods: Unencrypted transmissions of PII or confidential data (such as through plain email or unsecured file transfer) strictly prohibited.
5. Employees must immediately report to their supervisor and the DIT any unauthorized use or disclosure of confidential PII.
6. An employee's failure to adhere to the requirements of this administrative procedure regarding protection of PII may result in disciplinary action up to and including termination of employment, and possible legal liability.
7. An employee's obligation to protect PII continues after separation from employment. Any misuse or unauthorized release of such information subsequent to the conclusion of employment with PGCPS may be grounds for legal action.
Permitted Disclosure to Third Parties
1. PGCPS may release PII to third parties only as permitted by state and federal laws and regulations, Board policy, and/or PGCPS administrative procedures. Third parties to whom PGCPS is disclosing PII must be bound by agreements with appropriate PII safeguarding and use provisions. All methods of disclosure must be approved by DIT. PII or other confidential data disclosed to third parties must be encrypted both in transit and at rest. Third parties must also demonstrate the ability to maintain equivalent encryption, access-control, and key-management safeguards consistent with PGCPS standards.
2. Board members, employees, and vendors may disclose a PGCPS employee's or student's PII to appropriate parties in an emergency if knowledge of the information is necessary to protect the health or safety of the employee or other individuals.
  1. In addition, in determining whether the disclosure of a student's PII to other parties in a health or safety emergency is appropriate, pursuant to the Code of Maryland Regulations 13A.08.02.24 the Board member, employee or vendor making the disclosure first must take the following factors into account:
    1. ) The seriousness of the threat to the health and safety of the student or other individuals;
    2. ) The need for the information to meet the emergency;
    3. ) Whether the parties to whom the PII is disclosed are in a position to deal with the emergency; and
    4. ) The extent to which time is of the essence in dealing with the emergency.
  2. Section V.D.2. is to be strictly construed.
3. Directory information regarding students or personnel may be released without prior permission in accordance with the law and PGCPS procedures, including Administrative Procedure 5134.
  1. For students, Administrative Procedure 5134 has designated the following as directory information: student's name; telephone listing; PGCPS email address; participation in officially recognized activities and sports; honors and awards received; the most recent school attended; dates of attendance; grade level; and student identification number, user ID, or other unique personal identifier that cannot be used to access education records without a PIN, password, etc. (As noted in AP 5134, a student's Social Security number, on whole or in part, cannot be used for this purpose.)
    1. ) However, this information shall not be released without confirming with the school or appropriate central office whether the parent/guardian submitted an “opt-out” notice of sharing the directory information without consent.
  2. For employees, directory information is generally considered the employee's name, title, work location, work telephone number, annual salary, original hire date, and public licensure information. Requests for any other information should be reviewed by the Office of General Counsel prior to release.
  3. Employees must consult with their supervisor/designee to discuss any questions or concerns regarding sharing directory information regarding students or employees prior to disclosing the information.

VI. Monitoring and Compliance

Division Chiefs will be responsible for the monitoring and compliance for this procedure on an annual basis. The Division of Information Technology will assist with access control and response in the case of a reported incident.