California Code of Regulations › Title 5 - Education › Division 4 - California Student Aid Commission › Chapter 1 - California Student Aid Commission › Article 3.1 - Model Opt-Out Form for the Free Application for Federal Student Aid (Fafsa) or the California Dream Act Application (Cadaa) Completion Requirement; and Model Acceptable Use Policy for Handling Personal Information › Appendix B

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
[Local Education Agency]
Free Application for Federal Student Aid (FAFSA) or the
					 California Dream Act Application (CADAA)
Completion Requirement
Education Code Section
					 51227.5
MODEL Acceptable Use Policy
Introduction and Overview
Education Code Section
					 51225.7, enacted
					 in 2021, requires that each local educational agency ensure that each
					 12th grade pupil complete specified financial aid
					 applications, opt-out of the requirement, or be determined exempt from the
					 requirement. To assist in complying with Section
					 51225.7, certain
					 confidential information related to pupils' completion of those applications may be
					 shared with [local educational agency]. The purpose of this policy is to ensure that
					 [local educational agency], its staff and contractors, comply with state laws
					 related to the confidentiality and privacy of information shared by parents, legal
					 guardians, and pupils under Section
					 51225.7, as well
					 as confidential information that may be shared with [local educational agency] by
					 other government agencies, and to protect against the unauthorized disclosure of
					 Confidential Information provided to [local educational agency].
Failure to ensure the confidentiality of Confidential
					 Information provided to [local educational agency] to ensure compliance with Section
					 51225.7 could result in a violation of
					 state law and an invasion of parents' and pupils' rights to privacy in their
					 financial and educational records.
Policy
Disclosure of Confidential Information shall be limited solely
					 to personnel having the need and authorization to access such information. [Local
					 educational agency]'s employees, contractors, consultants and temporary employees
					 having access to [local educational agency]'s information assets (data and systems)
					 or to the specific Confidential Information provided to the [local educational
					 agency] for purpose of Education Code Section
					 51225.7, shall acknowledge adherence to
					 this policy and sign an information security and confidentiality agreement provided
					 by [local educational agency].
State Law Requirements
[Local Educational Agency] designates [XXXXXXXX], [Position] as
					 the individual responsible for implementing this policy and ensuring compliance with
					 its provisions. [XXXXXX] shall maintain in writing [local educational agency]
					 policies and procedures that support this policy, maintain a list of staff,
					 contractors, and other individuals who have access to confidential information
					 pursuant to this policy, and ensure all such individuals are included in [local
					 educational agency]'s annual information security and privacy awareness
					 training.
[Local educational agency] will ensure that it handles any
					 Confidential Information it collects for purposes of complying with Education Code
					 Section 51225.7 in a manner consistent with the
					 following state laws, where applicable, and with any policies and procedures [local
					 educational agency] has adopted in furtherance of these laws:
(1) the California Information Practices Act (California Civil
					 Code Sections
					 1798, et
					 seq.):
(2) California's Pupil Protections Relating to Immigration and
					 Citizenship Status provisions (Education Code Section
					 234.7).
(3) California's Values Act (Government Code Sections
					 7284, et
					 seq.);
(4) California Student Online Personal Information Practice Act
					 (Business and Professions Code Sections
					 22584,
					 et seq.);
(5) Third Party Contracts for the digital storage, maintenance,
					 and retrieval of student records (Education Code Section
					 49073.1);
(6) Pupil Records (Education Code Sections
					 49060, et seq.
					 and any related regulations); and
(7) California's Public Records Act (Government Code Sections
					 6250, et
					 seq.)
In addition to the foregoing, the following conditions apply to
					 [local education agency]'s management of Confidential Information collected or
					 maintained by it in furtherance of the requirements of Education Code Section
					 51225.7:
* [Local educational agency] will ensure that Confidential
					 information will be maintained on a secure data infrastructure with appropriate
					 levels of security for the data based on the Federal Information Processing
					 Standards Publication 199 protection levels. Confidential Information will not be
					 copied to other computers and will not physically leave [local educational agency]'s
					 data infrastructure, [local educational agency] will apply security patches and
					 upgrades and keep virus software up-to-date on all systems on which data may be
					 used.
* If transfer of Confidential Information to a third party is
					 necessary, [local educational agency] will ensure such transfer is only made for
					 purposes of furthering [local educational agency]'s obligations pursuant to
					 Education Code Section
					 51225.7 and that
					 such transfers are only made to parties covered by this acceptable use policy, or
					 which are otherwise bound by the same requirements as this policy. In addition, any
					 such transfer will be made in a secure manner, such as secure file transfer
					 protocol, an encrypted cloud-based solution, or an encrypted hard drive.
* The [local educational agency] shall not disclose of any
					 Confidential Information in [local educational agency]'s possession pursuant to
					 fulfilling its obligations under Education Code Section
					 51225.7 if the
					 disclosure is not authorized by Family Educational Rights and Privacy Act (FERPA) or
					 applicable state laws.
* The [local educational agency] shall not disclose Confidential
					 Information to third parties not covered by this acceptable use policy without the
					 written consent of the pupil, or a parent or guardian when the pupil is a minor.
					 Written consent shall include: (1) the signature and date of the parent, guardian,
					 or eligible pupil providing consent; (2) a description of the records to be
					 disclosed; (3) the reason for release of information; (4) the parties or class of
					 parties receiving the information; and (5) if requested by the parents, guardians or
					 eligible pupil, a copy of the records to be released. The [local educational agency]
					 shall permanently keep the consent notice with the pupil record file.
If a pupil, parent, or guardian chooses not to provide
					 information that could assist [local educational agency] in meeting its obligations
					 pursuant to Education Code Section
					 51225.7, [local educational
					 agency] shall not use such actions as a basis to
					 discriminate against any pupils or families or bar children from enrolling or
					 attending school or discipline the pupil in any fashion.
Definition of Key Terms
"FAFSA" means the Free Application for Federal Student
					 Aid.
"CADAA" means the California Dream Act Application.
"FAFSA/CADAA Completion Requirements" means the requirements
					 contained in Education Code Section
					 51225.7 that
					 local educational agencies ensure that each 12th grade
					 pupil either (1) complete a FAFSA or CADAA application; (2) opt out of the
					 completion requirement; or (3) is otherwise exempt from the requirement.
"Confidential Information" means any information shared by
					 parents, legal guardians, and pupils to assist [local educational agency] in
					 complying with Education Section
					 51225.7, as well
					 as information related to a pupil's FAFSA or CADAA status that is provided to [local
					 educational agency] by the California Student Aid Commission, California Department
					 of Education, or other entity; and any similar information created by [local
					 educational agency] related to its compliance with Education Code Section
					 51225.7.
Please visit [insert LEA privacy policy link] for the [insert
					 LEA] privacy statement.