Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy topic
No spam. Unsubscribe anytime.
Board adopts data governance manual after questions about student-data sharing and vendors
Summary
The board approved its annual data governance manual but members raised questions about vendor data transfers, use of concussion-testing software 'Sway,' and ongoing cybersecurity work including penetration testing and audits.
The Merrimack Valley School District board voted to accept its annual Data Governance Manual after a presentation by district tech leadership and questions from members about student-data protections.
The manual, presented as an annually reviewed document, governs how the district handles data, cybersecurity and vendor relationships; the tech department will update the manual as practices and threats evolve. Board member concerns focused on how third-party vendors handle personally identifiable information. One member read an excerpt from Sway’s policy describing processing and storage of personal information outside the state or country, and asked whether parents can refuse use or whether alternative processes exist.
Tech leadership (Randy and Katherine) said the district requires vendors to sign a data-privacy agreement; if a vendor will not sign, the district does not use that product. The board also heard that cybersecurity work is ongoing — including onboarding/offboarding audits, phishing training and periodic penetration testing carried out by outside experts such as the Adam Group.
The board approved the manual by voice vote and asked for follow-up where specific vendor exceptions exist.
What’s next: Staff will review vendor agreements and report back on any software that declines to sign the district’s data-privacy agreement and on options for parents when district-required software has problematic data-location provisions.
