subchapter 06d – government data analytics center

SECTION .0100 – NORTH CAROLINA EDUCATION LONGITUDINAL DATA SYSTEM

09 NCAC 06D .0101 DEFINITIONS

In addition to the definitions set forth in G.S. 116E-1, the following definitions shall apply to the rules in this Section:

(1) "Aggregated" means the result of the collection and combination of data about a group of individuals that has been de-identified. Aggregated data can be used for the purposes of making comparisons or identifying patterns within or among groups of subjects or individuals. An example of aggregated data is the number of high school graduates from Wake County who graduated from the University of North Carolina System with a Bachelor of Science in Engineering within the past three years and their average salary.

(2) "Applicable law" means all statutes and rules of North Carolina and all relevant United States federal statutes and regulations pertaining to the protection of privacy and security of confidential data. Applicable law includes the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g; the Health Insurance Portability and Accountability Act, 42 U.S.C. 300gg, 29 U.S.C 1181 et seq., and 42 USC 1320d et seq.; the Workforce Innovation and Opportunity Act, 29 U.S.C. Ch. 32; and all regulations promulgated thereunder.

(3) "Contributor" means an entity that discloses Data to the System. The Contributors may be one or more of the entities specified in G.S. 116E-5(d)(1).

(4) "Data" means early childhood data, student data as defined in G.S. 116E-1(4), workforce data as defined in G.S. 116E-1(7), or other personally identifying data disclosed by the Contributors to the System and any data released from the System in response to data requests.

(5) "Early Childhood" means the time period in an individual's life from birth to age eight.

(6) "GDAC" means the Government Data Analytics Center, which has the authority to operate and oversee the System pursuant to G.S. 116E-4.

(7) "North Carolina Education Longitudinal Data System" or "System" means the system referenced in G.S. 116E-5.

(8) "Report" means the de-identified or aggregated information, data extract, or data file generated by the System using Data on a specified group of students, workforce members, or both, to fulfill a Request.

(9) "Request" means an inquiry for a Report containing information on a specified group of students, workforce members, or both from the System by a Requestor

(10) "Requestor" means an entity or individual that makes a Request to the System for a Report. A Requestor may also be a Contributor.

History Note: Authority G.S. 143B-1321(a)(16); 116E-4(b);

Eff. January 1, 2021.

09 NCAC 06D .0102 DATA REQUEST PROCESS

(a) In order to initiate a Request for a Report from the System, a Requestor must complete an Education Longitudinal Data System Report Request Form located at: https://it.nc.gov/services/nc-gdac. The Requestor shall submit the form through the website, by emailing it to gdacadmin@nc.gov, or by mailing a hard copy to the following address: Government Data Analytics Center, 4101 Mail Service Center, Raleigh, NC 27699-4101.

(b) The Requestor shall include the following information in the Request form:

(1) the name of the Requestor individual and his or her contact information;

(2) the name of the organization for whom the Requestor is making the Request on behalf of, if applicable;

(3) whether or not the Requestor, or the organization the Requestor is making the Request on behalf of, is considered a public official as defined under 20 C.F.R. 603.2(d);

(4) the categories or types of Data needed to generate the Reports being requested, such as data pertaining to students who graduated high school in 2013 who were students in the University of North Carolina School System in 2014;

(5) the purposes for which the Requestor will utilize the Reports; and

(6) to whom or in what medium the Requestor plans to publish research based on or interpretations of the Report.

(1) store Reports on servers or media utilizing safeguards based on nationally accepted standards, including those published by the National Institute of Standards and Technology (NIST);

(2) comply with all Applicable Law and the Requestor data sharing agreement in storing and using the Reports; and

(3) use a data destruction policy based on nationally accepted standards, including NIST standards, to destroy the Report after it has served the Requestor's stated purpose if the Report contains de-identified but not aggregated workforce data from the Division of Employment Security.

History Note: Authority G.S. 143B-1321(a)(16); 116E-4(b);

Eff. January 1, 2021.

09 NCAC 06D .0103 CONTRIBUTOR DATA SHARING AGREEMENTS

(a) A Contributor that plans to contribute Data to the System shall enter into a data sharing agreement with the Government Data Analytics Center and other Contributors. This data sharing agreement shall contain the following:

(1) obligations to comply with all Applicable Law when disclosing, accessing, or using Data in the System;

(2) limitations on Data access to authorized persons employed or contracted by the parties of the Memorandum of Understanding;

(3) requirements for safeguarding any Data disclosed by a Contributor; and

(4) terms regarding the relevant limitations of liability for State and local government agencies and private or non-governmental Contributors.

(b) In accordance with G.S. 143B-1385(d)(2), each Contributor shall be the sole custodian of the Data it stores and maintains that may be disclosed to the System. Each Contributor shall only disclose Data to the System and to GDAC that the Contributor is authorized to disclose in compliance with Applicable Law.

History Note: Authority G.S. 143B-1321(a)(16); 116E-4(b);

Eff. January 1, 2021.

09 NCAC 06D .0104 REQUESTOR DATA SHARING AGREEMENTS AND REQUIREMENTS

(a) Except as provided in Paragraph (b) of this Rule, all Requestors shall enter into a data sharing agreement with the Contributors that are the custodians of the Data that may be needed to generate a requested report. The requestor data sharing agreement shall be separate and distinct from the Memorandum of Understanding between the Contributors and GDAC.

(b) Requestors who are also Contributors and parties to the Contributor Memorandum of Understanding shall not be required to enter into a Requestor data sharing agreement unless one or more of the Contributors responding to the party's Request notifies the Requestor that a data sharing agreement must be entered into before Data is disclosed in order to comply with Applicable Law. An example of when a Requestor data sharing agreement may be required is an instance where a Contributor is making a Request of the NC Department of Commerce for Data that has not been Aggregated.

(1) limitations on Report access to authorized persons;

(2) prohibition on the re-identification of persons included in Reports in accordance with G.S. 116E-5(e);

(3) information technology system and data security standards required by the Contributor who will be providing Data for the Report;

(4) privacy compliance standards;

(5) data breach procedures, including notification of DIT of any cybersecurity incidents as described by G.S. 143B-1320(a)(4a) or G.S. 143b-1320(a)(16a) using the incident report form available at: https://it.nc.gov/resources/cybersecurity-risk-management/statewide-cybersecurity-incident-report-form;

(6) terms regarding the disclaimer of liability as applied to Contributors pursuant to the doctrine of sovereign immunity and statutory immunity; and

(7) data retention and data removal standards.

History Note: Authority G.S. 143B-1321(a)(16); 116E-4(b);

Eff. January 1, 2021.