Privacy & Data Security

Protecting student and staff information is our highest priority. This system complies with the Family Educational Rights and Privacy Act (FERPA), the Utah Student Data Protection Act (HB444, R277-487), and the Cache County School District’s Data Governance and Information Technology Security Plans.

What Data We Collect

• Student ID number (for attendance and hall-pass functions)
• Basic enrollment details (grade level, class schedule)
• Attendance status and time of scan
• Staff user IDs for audit logging

We do not collect sensitive personal details such as Social Security Numbers, financial data, or medical records.

How We Use Student Data

• Track attendance and hall-pass activity in real time
• Support counseling and remediation workflows
• Provide administrators with live status reports
• Maintain security and audit logs for accountability

Data Protection Measures

• Access Control: Role-based permissions with multi-factor authentication for admins
• Encryption: All data is encrypted in transit (HTTPS) and at rest
• Audit Logs: Security-relevant events are logged and retained in accordance with district policy
• Filtering & Security: District-approved content filters, anti-malware, and network safeguards
• Vendor Controls: All third-party vendors must sign a Restriction on Use of Personally Identifiable Information Agreement

Data Retention & Disposal

Attendance and hall-pass data is retained only as long as needed for educational purposes, then securely deleted following district retention schedules.

Parental & Student Rights

Under FERPA and Utah law, parents/guardians and eligible students have the right to:

• Inspect and review education records
• Request corrections to inaccurate or misleading records
• Request a copy of the district’s Data Governance Plan
• Opt-out of directory information disclosures
• File a complaint with the U.S. Department of Education

To exercise these rights, please contact your school office or the district’s Data Privacy Officer.

Breach Notification

In the event of a data breach, the district will promptly investigate and notify affected individuals. As required by Utah law, the district will also notify the Utah Attorney General’s Office and the Utah Cyber Center within 5 business days of discovery.

Questions?

For questions about this system’s privacy and data protection practices, please contact:

• District IT Security Officer