BILL NUMBER: SBX5 2AMENDED BILL TEXT AMENDED IN ASSEMBLY DECEMBER 10, 2009 AMENDED IN ASSEMBLY DECEMBER 3, 2009 AMENDED IN SENATE NOVEMBER 3, 2009 AMENDED IN SENATE OCTOBER 28, 2009 INTRODUCED BY Senator Simitian AUGUST 27, 2009 An act to amend Section 1798.24 of the Civil Code, and to amend Sections 10802 and 49076 of,andto add Section 49079.5 to, and to add and repeal Section 49079.6 of, the Education Code, relating to pupil data. LEGISLATIVE COUNSEL'S DIGEST SB 2, as amended, Simitian. Pupil data. (1) Federal law requires schools and educational agencies receiving federal financial assistance to comply with specified provisions regarding the release of pupil data. State law prescribes additional rules relating to the authorized release of pupil data. Under existing law, the State Department of Education is required to contract for the development of proposals to provide for the retention and analysis of longitudinal pupil achievement data on the tests administered pursuant to the Standardized Testing and Reporting Program (STAR), the English language development tests, and the high school exit examination. This longitudinal achievement data is known as the California Longitudinal Pupil Achievement Data System (CALPADS). Under existing law, the CALPADS is required to be used to accomplish specified goals, including providing school districts and the department access to the data necessary to comply with federal reporting requirements, as specified, providing a better means of evaluating educational progress and investments over time, providing local educational agencies information that can be used to improve pupil achievement, and providing an efficient, flexible, and secure means of maintaining longitudinal statewide pupil data. Existing law requires the department to establish a process by which local educational agencies issue, maintain, and report information using unique pupil identifiers for child care and development programs, as specified. This bill would require the department to establish this process no later than January 1, 2011. The bill would state the Legislature's intent that on or before January 1, 2011, the department ensure that certain data elements pertaining to preschool be collected for all preschool programs operated by a local educational agency. This bill would authorize the department, to the extent permissible under the federal Family Educational Rights and Privacy Act (FERPA) and specified state law, and commencing July 1, 2010, to conduct pupil data management on behalf of local educational agencies. The bill would state the intent of the Legislature to accomplish specified objectives related to these provisions, including, but not limited to, complying with the United States Constitution and all applicable federal laws, including FERPA and its implementing regulations, the California Constitution, and all applicable state laws and their implementing regulations, in order to protect pupil rights and privacy. The bill would authorize local educational agencies to access specified data via the CALPADS, and, to the extent permissible under federal and state law, to share specified data via the CALPADS. The bill would require the department to establish, no earlier than July 1, 2010, an education data team to act as an institutional review board to review and respond to all requests for pupil data, as specified. The bill would require the department, to the extent feasible, to redirect department personnel for the purposes of the education data team rather than establishing new positions. The bill would make the department responsible for data management decisions for data under its jurisdiction and make the department and a local educational agency jointly liable for any data management decisions in which the department and the local educational agency participate jointly, as specified. The bill would require the department to develop appropriate policies and procedures for the education data team by July 1, 2010. The bill would authorize the department, with certain exceptions, to assess a fee on research applicants to cover prescribed costs. The bill would require the department to perform the duties specified in these provisions with its existing resources. The bill would make these provisions inoperative on July 1, 2013, and repeal them on January 1, 2014. (2) Existing law prohibits a state agency from disclosing any personal information in a manner that would link the information disclosed to the individual to whom it pertains. Existing law provides exceptions to this prohibition, including authorizing a state agency to release personally identifiable data to a nonprofit educational institution conducting scientific research, provided the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency. Existing law authorizes the CPHS to enter into written agreements to enable other institutional review boards to provide the required data security approvals. This bill would delete the authorization to release data to a nonprofit educational institution conducting scientific research and, instead, authorize data to be released to a nonprofit entity conducting scientific research. The bill would require the CPHS to enter into a written agreement with the institutional review board to provide the required data security approvals for the release of data to researchers, as specified. (3) The bill would state the intent of the Legislature to create a Preschool through Higher Education (P-20) statewide longitudinal educational data system in order to inform education policy and improve instruction, and to use this P-20 system for state-level research to improve instruction. The bill would additionally state the Legislature's intent to require the State Department of Education, the Commission on Teacher Credentialing, the California Community Colleges, the University of California, the California State University, and any other state education agency to be required to disclose, or redisclose, personally identifiable pupil records to this P-20 system, as permissible under federal and state law. Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 1798.24 of the Civil Code is amended to read: 1798.24. No agency may disclose any personal information in a manner that would link the information disclosed to the individual to whom it pertains unless the information is disclosed, as follows: (a) To the individual to whom the information pertains. (b) With the prior written voluntary consent of the individual to whom the record pertains, but only if that consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent. (c) To the duly appointed guardian or conservator of the individual or a person representing the individual if it can be proven with reasonable certainty through the possession of agency forms, documents or correspondence that this person is the authorized representative of the individual to whom the information pertains. (d) To those officers, employees, attorneys, agents, or volunteers of the agency that has custody of the information if the disclosure is relevant and necessary in the ordinary course of the performance of their official duties and is related to the purpose for which the information was acquired. (e) To a person, or to another agency where the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is accounted for in accordance with Section 1798.25. With respect to information transferred from a law enforcement or regulatory agency, or information transferred to another law enforcement or regulatory agency, a use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency. (f) To a governmental entity when required by state or federal law. (g) Pursuant to the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code). (h) To a person who has provided the agency with advance, adequate written assurance that the information will be used solely for statistical research or reporting purposes, but only if the information to be disclosed is in a form that will not identify any individual. (i) Pursuant to a determination by the agency that maintains information that compelling circumstances exist that affect the health or safety of an individual, if upon the disclosure notification is transmitted to the individual to whom the information pertains at his or her last known address. Disclosure shall not be made if it is in conflict with other state or federal laws. (j) To the State Archives as a record that has sufficient historical or other value to warrant its continued preservation by the California state government, or for evaluation by the Director of General Services or his or her designee to determine whether the record has further administrative, legal, or fiscal value. (k) To any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency reasonably attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law. ( l ) To any person pursuant to a search warrant. (m) Pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code. (n) For the sole purpose of verifying and paying government health care service claims made pursuant to Division 9 (commencing with Section 10000) of the Welfare and Institutions Code. (o) To a law enforcement or regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law. (p) To another person or governmental organization to the extent necessary to obtain information from the person or governmental organization as necessary for an investigation by the agency of a failure to comply with a specific state law that the agency is responsible for enforcing. (q) To an adopted person and is limited to general background information pertaining to the adopted person's natural parents, provided that the information does not include or reveal the identity of the natural parents. (r) To a child or a grandchild of an adopted person and disclosure is limited to medically necessary information pertaining to the adopted person's natural parents. However, the information, or the process for obtaining the information, shall not include or reveal the identity of the natural parents. The State Department of Social Services shall adopt regulations governing the release of information pursuant to this subdivision by July 1, 1985. The regulations shall require licensed adoption agencies to provide the same services provided by the department as established by this subdivision. (s) To a committee of the Legislature or to a Member of the Legislature, or his or her staff when authorized in writing by the member, where the member has permission to obtain the information from the individual to whom it pertains or where the member provides reasonable assurance that he or she is acting on behalf of the individual. (t) (1) To the University of California or a nonprofit entity conducting scientific research, provided the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an institutional review board, as authorized in paragraphs (4) and (5) of this subdivision. The approval required under this subdivision shall include a review and determination that all the following criteria have been satisfied: (A) The researcher has provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information. (B) The researcher has provided a sufficient plan to destroy or return all personal information as soon as it is no longer needed for the research project, unless the researcher has demonstrated an ongoing need for the personal information for the research project and has provided a long-term plan sufficient to protect the confidentiality of that information. (C) The researcher has provided sufficient written assurances that the personal information will not be reused or disclosed to any other person or entity, or used in any manner, not approved in the research protocol, except as required by law or for authorized oversight of the research project. (2) The CPHS or institutional review board shall, at a minimum, accomplish all of the following as part of its review and approval of the research project for the purpose of protecting personal information held in agency databases: (A) Determine whether the requested personal information is needed to conduct the research. (B) Permit access to personal information only if it is needed for the research project. (C) Permit access only to the minimum necessary personal information needed for the research project. (D) Require the assignment of unique subject codes that are not derived from personal information in lieu of social security numbers if the research can still be conducted without social security numbers. (E) If feasible, and if cost, time, and technical expertise permit, require the agency to conduct a portion of the data processing for the researcher to minimize the release of personal information. (3) Reasonable costs to the agency associated with the agency's process of protecting personal information under the conditions of CPHS approval may be billed to the researcher, including, but not limited to, the agency's costs for conducting a portion of the data processing for the researcher, removing personal information, encrypting or otherwise securing personal information, or assigning subject codes. (4) The CPHS may enter into written agreements to enable other institutional review boards to provide the data security approvals required by this subdivision, provided the data security requirements set forth in this subdivision are satisfied. (5) Pursuant to paragraph (4), the CPHS shall enter into a written agreement with the institutional review board established pursuant to Section 49079.5 of the Education Code. The agreement shall authorize, commencing July 1, 2010, or the date upon which the written agreement is executed, whichever is later, that board to provide the data security approvals required by this subdivision, provided the data security requirements set forth in this subdivision and the act specified in paragraph (1) of subdivision (a) of Section 49079.5 are satisfied. (u) To an insurer if authorized by Chapter 5 (commencing with Section 10900) of Division 4 of the Vehicle Code. (v) Pursuant to Section 280, 282, 8009, or 18396 of the Financial Code. This article shall not be construed to require the disclosure of personal information to the individual to whom the information pertains when that information may otherwise be withheld as set forth in Section 1798.40. SEC. 2. Section 10802 of the Education Code is amended to read: 10802. (a) The department shall establish a process by which local educational agencies issue, maintain, and report information using the unique statewide pupil identifiers specified in paragraph (3) of subdivision (e) of Section 60900 for state and federally funded center-based child care and development programs under their purview. (b) In order to comply with the federal American Recovery and Reinvestment Act of 2009 (Public Law 111-5) assurances delineated in Section 6401(e)(2) of the America COMPETES Act (20 U.S.C.Sec.9871Sec. 9871 ), the department shall establish the process referenced in subdivision (a) no later than January 1, 2011. (c) It is the intent of the Legislature that on or before January 1, 2011, the department, at a minimum, ensures that the data elements pertaining to preschool described in Section 6401(e)(2)(D) of the America COMPETES Act (20 U.S.C.Sec.9871Sec. 9871 ) be collected for all preschool programs operated by a local educational agency. (d) Except to the extent required by federal law, or as needed to ensure compliance with federal law, the department shall not require these center-based child care and development programs to implement or maintain unique pupil identifiers specified in paragraph (3) of subdivision (e) of Section 60900 until an appropriation for this purpose is provided in the annual Budget Act or another statute. SEC. 3. Section 49076 of the Education Code is amended to read: 49076. A school district is not authorized to permit access to pupil records to any person without written parental consent or under judicial order except that: (a) Access to those particular records relevant to the legitimate educational interests of the requester shall be permitted to the following: (1) School officials and employees of the district, members of a school attendance review board appointed pursuant to Section 48321, and any volunteer aide, 18 years of age or older, who has been investigated, selected, and trained by a school attendance review board for the purpose of providing followup services to pupils referred to the school attendance review board, provided that the person has a legitimate educational interest to inspect a record. (2) Officials and employees of other public schools or school systems, including local, county, or state correctional facilities where educational programs leading to high school graduation are provided or where the pupil intends to or is directed to enroll, subject to the rights of parents as provided in Section 49068. (3) Authorized representatives of the Comptroller General of the United States, the Secretary of Education, and administrative head of an education agency, state education officials, or their respective designees, or the United States Office of Civil Rights, where the information is necessary to audit or evaluate a state or federally supported education program or pursuant to a federal or state law, provided that except when collection of personally identifiable information is specifically authorized by federal law, any data collected by those officials shall be protected in a manner which will not permit the personal identification of pupils or their parents by other than those officials, and any personally identifiable data shall be destroyed when no longer needed for the audit, evaluation, and enforcement of federal legal requirements. (4) Other state and local officials to the extent that information is specifically required to be reported pursuant to state law adopted prior to November 19, 1974. (5) Parents of a pupil 18 years of age or older who is a dependent as defined in Section 152 of the Internal Revenue Code of 1954. (6) A pupil 16 years of age or older or having completed the 10th grade who requests access. (7) Any district attorney who is participating in or conducting a truancy mediation program pursuant to Section 48263.5, or Section 601.3 of the Welfare and Institutions Code, or participating in the presentation of evidence in a truancy petition pursuant to Section 681 of the Welfare and Institutions Code. (8) A prosecuting agency for consideration against a parent or guardian for failure to comply with the Compulsory Education Law (Chapter 2 (commencing with Section 48200) of Part 27) or with Compulsory Continuation Education (Chapter 3 (commencing with Section 48400) of Part 27). (9) Any probation officer or district attorney for the purposes of conducting a criminal investigation or an investigation in regards to declaring a person a ward of the court or involving a violation of a condition of probation. (10) Any judge or probation officer for the purpose of conducting a truancy mediation program for a pupil, or for purposes of presenting evidence in a truancy petition pursuant to Section 681 of the Welfare and Institutions Code. The judge or probation officer shall certify in writing to the school district that the information will be used only for truancy purposes. A school district releasing pupil information to a judge or probation officer pursuant to this paragraph shall inform, or provide written notification to, the parent or guardian of the pupil within 24 hours of the release of the information. (11) Any county placing agency for the purpose of fulfilling the requirements of the health and education summary required pursuant to Section 16010 of the Welfare and Institutions Code or for the purpose of fulfilling educational case management responsibilities required by the juvenile court or by law and to assist with the school transfer or enrollment of a pupil. School districts, county offices of education, and county placing agencies may develop cooperative agreements to facilitate confidential access to and exchange of the pupil information by electronic mail, facsimile, electronic format, or other secure means. (b) School districts may release information from pupil records to the following: (1) Appropriate persons in connection with an emergency if the knowledge of the information is necessary to protect the health or safety of a pupil or other persons. (2) Agencies or organizations in connection with the application of a pupil for, or receipt of, financial aid. However, information permitting the personal identification of a pupil or his or her parents may be disclosed only as may be necessary for purposes as to determine the eligibility of the pupil for financial aid, to determine the amount of the financial aid, to determine the conditions which will be imposed regarding the financial aid, or to enforce the terms or conditions of the financial aid. (3) The county elections official, for the purpose of identifying pupils eligible to register to vote, and for conducting programs to offer pupils an opportunity to register to vote. The information, however, shall not be used for any other purpose or given or transferred to any other person or agency. (4) Accrediting associations in order to carry out their accrediting functions. (5) Organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instruction, if the studies are conducted in a manner that will not permit the personal identification of pupils or their parents by persons other than representatives of the organizations and the information will be destroyed when no longer needed for the purpose for which it is obtained. (6) Officials and employees of private schools or school systems where the pupil is enrolled or intends to enroll, subject to the rights of parents as provided in Section 49068. This information shall be in addition to the pupil's permanent record transferred pursuant to Section 49068. A person, persons, agency, or organization permitted access to pupil records pursuant to this section may not permit access to any information obtained from those records by any other person, persons, agency, or organization, except for allowable exceptions contained within the Family Educational Rights and Privacy Act of 2001 (20 U.S.C. Sec. 1232g) and state law, without the written consent of the pupil's parent. However, this paragraph does not require prior parental consent when information obtained pursuant to this section is shared with other persons within the educational institution, agency, or organization obtaining access, so long as those persons have a legitimate interest in the information. (c) Notwithstanding any other provision of law, any school district, including any county office of education or superintendent of schools, may participate in an interagency data information system that permits access to a computerized database system within and between governmental agencies or districts as to information or records which are nonprivileged, and where release is authorized as to the requesting agency under state or federal law or regulation, if each of the following requirements are met: (1) Each agency and school district shall develop security procedures or devices by which unauthorized personnel cannot access data contained in the system. (2) Each agency and school district shall develop procedures or devices to secure privileged or confidential data from unauthorized disclosure. (3) Each school district shall comply with the access log requirements of Section 49064. (4) The right of access granted shall not include the right to add, delete, or alter data without the written permission of the agency holding the data. (5) An agency or school district may not make public or otherwise release information on an individual contained in the database where the information is protected from disclosure or release as to the requesting agency by state or federal law or regulation. SEC. 4. Section 49079.5 is added to the Education Code, to read: 49079.5.(a)The Legislature recognizes that a longitudinal pupil data system provides direct and tangible benefits to pupils, educators, policymakers, and the public. The Legislature intends to make statewide longitudinal education data accessible to, and used to inform and engage, authorized stakeholders in an effort to support the continuous improvement of instruction, operations, management, and resource allocation, and in a manner that complies with all federal and state privacy laws. The Legislature intends to make statewide longitudinal education data available and accessible to researchers so they may evaluate the effectiveness of instructional materials, strategies, and approaches for educating different types of pupils in a manner that complies with federal and state privacy laws, including, but not limited to, the Family Educational Rights and Privacy Act of 2001 (20 U.S.C. Sec. 1232g) (FERPA). It is the intent of the Legislature, in enacting this section, to accomplish all of the following:(1)(a) Comply with the United States Constitution and all applicable federal laws, including FERPA and its implementing regulations (34 C.F.R. 99).(2)(b) Comply with the California Constitution and all applicable state laws and their implementing regulations, including, but not limited to, Section 1798.24 of the Civil Code.(3)(c) Further an environment in which the department and the California Longitudinal Pupil Achievement Data System (CALPADS) serve as resources for local educational agencies.(4)(d) Promote a culture of continuous improvement through collaboration and informed decisionmaking at the classroom, school, district, state, and policymaker level.(5)(e) Minimize the anticipated workload increase on the department that may be generated by an increased number of data requests as CALPADS becomes operational, by establishing clear guidance on data access and an efficient process for responding to requests for access.(6)(f) Pursuant to FERPA and as defined in Section 1798.24 of the Civil Code, make pupil data available to qualified researchers from nonprofit organizations while appropriately protecting the privacy of individual pupils. SEC. 5. Section 49079.6 is added to the Education Code, to read:(b)49079.6. (a) Commencing on July 1, 2010, and to the extent permissible under FERPA and its implementing regulations and Section 1798.24 of the Civil Code, the department may act on behalf of local educational agencies under FERPA, including providing access to and protecting the security of pupil data.(c)(b) Commencing on July 1, 2010, and to the extent permissible under FERPA and its implementing regulations, the department, on behalf of local educational agencies, may release pupil data to qualified researchers from nonprofit entities, pursuant to subdivision (t) of Section 1798.24 of the Civil Code.(d)(c) No earlier than July 1, 2010, the department shall establish an education data team within its staff to act as an institutional review board, whose composition and policies and procedures shall be in compliance with Part 46 of Title 45 of the Code of Federal Regulations, pursuant to subdivision (t) of Section 1798.24 of the Civil Code, and to review and respond to all requests for pupil data. The department, to the extent feasible, shall redirect department personnel for the purposes of the education data team rather than establish new positions. (1) Pursuant to subdivision (t) of Section 1798.24 of the Civil Code, the education data team shall enter into a signed agreement with the Committee for the Protection of Human Subjects for the California Health and Human Services Agency to enable the education data team to provide the data security approvals required by Section 1798.24 of the Civil Code. The agreement shall authorize the education data team to release individually identifiable data to qualified researchers and other state and local agencies, as defined and permitted under federal and state law. (2) The department shall commence preparations for the creation of the education data team upon enactment of the measure that adds this section. (3) By July 1, 2010, the department shall develop appropriate policies and procedures for the education data team that shall include, but not be limited to, all of the following: (A) Processes for all of the following: (i) Application for access to data. (ii) Response to applications for access to data, including timelines. (iii) Appeal of denials for access to data. (iv) Recording disclosure or redisclosure of personally identifiable information, pursuant to FERPA. (B) Criteria to be used for approving the release of data, including, but not limited to, all of the following: (i) The release of data to researchers from nonprofit organizations, pursuant to FERPA and subdivision (t) of Section 1798.24 of the Civil Code, that are conducting research for the purpose of improving instruction to pupils. (ii) Limitations on data released, including, but not limited to, releasing to researchers only data necessary to meet research objectives. (iii) The release of data from the department to another state educational agency with valid legal authority to conduct audit, evaluation, compliance, or enforcement analysis of educational materials, programs, outcomes, or activities, pursuant to FERPA and state law. (C) (i) Any reasonable fees or charges that may be imposed upon research applicants to cover costs of responding to time-intensive requests. (ii) Fees or charges imposed upon an applicant pursuant to this subparagraph shall not exceed the actual costs incurred by the department in responding to the applicant's request. (iii) Fees or charges shall not be imposed pursuant to this subparagraph upon any state agency, except for fees or charges related to the release of data for research purposes to the University of California, the California State University, or the Chancellor of the California Community Colleges. (D) Rules for data recipients regarding data control and destruction of data after use, to guard against any misuse of data, including third-party transfer. (E) A written agreement that conforms to state and federal privacy and disclosure laws and regulations, and existing laws regarding data control and security, that shall be signed by any organization receiving data to conduct a study.(e)(d) A local educational agency may access data via CALPADS concerning pupils enrolled within the local educational agency ortransferring to the local educational agency from another local educational agency.concerning pupils who intend or are directed to enroll, subject to the rights of parents as provided in Section 49068, within one local educational agency.(f)(e) In order to promote a culture of collaboration and data analysis and to increase the identification and sharing of effective practices, local educational agencies may share data with each other via CALPADS to the extent permissible under federal and state law.(g)(f) The department is responsible for data management decisions for the data under its jurisdiction. The department, rather than a local educational agency, shall be liable for its decisions relating to the management of data under its control according to applicable provisions of law. If the department and a local educational agency participate jointly in the management of data, both the department and the local educational agency shall be liable to the extent of their respective involvement according to applicable provisions of law. This subdivision does not limit the liability of a researcher who obtains data pursuant to this section and who releases that data in violation of either FERPA or its implementing regulations, or subdivision (t) of Section 1798.24 of the Civil Code.(h)(g) The department shall perform the duties specified in this section with its existing resources. (h) This section shall remain in effect only until July 1, 2013, and as of January 1, 2014, is repealed, unless a later enacted statute, that is enacted before January 1, 2014, deletes or extends that date. (i) It is the intent of the Legislature that, prior to extending or repealing the dates specified in subdivision (h), the appropriate policy committees of each house shall review and consider both of the following: (1) Changes in federal law related to access to pupil data, including, but not limited to, the reauthorization of the federal Elementary and Secondary Education Act (20 U.S.C. Sec. 6301) and changes in FERPA. (2) Any recommendations made by the working group convened pursuant to Section 2 of Chapter 561 of the Statutes of 2008.SEC. 5.SEC. 6. Consistent with the federal American Recovery and Reinvestment Act (Public Law 111-5), and as set forth in Chapter 561 of the Statutes of 2008, the Legislature declares its intent to create a Preschool through Higher Education (P-20) statewide longitudinal educational data system in order to inform education policy and improve instruction. The Legislature intends for this P-20 system to be used for state-level research to improve instruction and, as such, intends to require the State Department of Education, the Commission on Teacher Credentialing, the California Community Colleges, the University of California, the California State University, and any other state education agency to be required to disclose, or redisclose, personally identifiable pupil records to this P-20 system, as permissible under federal and state law.