In this subtitle the following words have the meanings indicated. “Center” means the Maryland Longitudinal Data System Center. “Child welfare data” means data relating to a child’s experience with child protective services, family preservation services, and State–sponsored out–of–home services. “Child welfare data” includes: Out–of–home placement data, including: Supervising jurisdiction; Removal reason; Characteristics at the time of removal; Return reason; Placement start and end dates; and Placement type; Family preservation services data, including: Supervising jurisdiction; Type of family preservation service; and Service start and end dates; and Child protective services data, including: Responsible jurisdiction; Type of child protective service response; Date on which child protective services responded; Alleged maltreatment type; Disposition of an investigative response by child protective services; and Date on which child protective services completes a response. “De–identified data” means a data set in which parent and student identity information, including the State Assigned Student Identifier and student Social Security number, has been removed. “Governing Board” means the Governing Board of the Maryland Longitudinal Data System Center. “Industry certificate” means a certificate or license awarded by an industry certifier that prepares an individual to work in a career field. “Industry certificate” does not include a business license or vocational certificate. “Industry certifier” means a nationally recognized, third–party entity using predetermined standards for knowledge and skills that prepare an individual to work in a career field. “License” means an occupational or professional license issued to an individual under the Business Occupations and Professions Article, the Business Regulation Article, or the Health Occupations Article. “Licensing authority” means a State entity that issues a license to an individual. “Personally identifiable information” means data that can be used to identify a particular individual and match that individual’s student or workforce record across different data sources. “Personally identifiable information” includes: Name; Date of birth; and Social Security number, SASID, or other government–assigned identification number. “State Assigned Student Identifier” or “SASID” means the identifier assigned to each student by: A local education agency based on the identifier system developed by the State Department of Education; or An institution of higher education, if the student has not been assigned an identifier by a local education agency. “Student data” means data relating to or impacting student performance. “Student data” includes: State and national assessments; Course–taking and completion; Grade point average; Remediation; Retention; Degree, diploma, or credential attainment; Enrollment; Demographic data; Juvenile delinquency records; Elementary and secondary school disciplinary records; Child welfare data; License, industry certificate, or vocational certificate; Personally identifiable information; Parental status; and Student disability data by specific disability category. “Student data” does not include: Criminal and CINA records; Medical and health records; and Pregnancy status. “Vocational certificate” means a certificate or license awarded by an institution of postsecondary education approved to operate under § 11–202 of this article on completion of a course of study, including credit–bearing and noncredit courses, that prepares an individual to work in a career field. “Workforce data” means data about employees relating to: Employment status; Wage information; Geographic location of employment; Employer information; and Personally identifiable information.

The State Department of Education, Maryland Higher Education Commission, University System of Maryland, Morgan State University, St. Mary’s College of Maryland, and Maryland Department of Labor jointly shall establish the Maryland Longitudinal Data System that shall be fully operational by December 31, 2014. The Maryland Longitudinal Data System is a statewide data system that contains individual–level student data and workforce data from all levels of education and the State’s workforce, and allows the Center to: Effectively organize, manage, disaggregate, and analyze individual student data; and Examine student progress and outcomes over time, including preparation for postsecondary education and the workforce. The linkage of student data and workforce data for the purposes of the Maryland Longitudinal Data System shall be limited to no longer than 20 years from the date of latest attendance in any educational institution in the State. The purpose of the Maryland Longitudinal Data System is to: Generate timely and accurate information about student performance that can be used to improve the State’s education system and guide decision makers at all levels; and Facilitate and enable the linkage of student data and workforce data.

There is a Maryland Longitudinal Data System Center. The Center is an independent unit within State government. The organizational placement and location of the Center shall be determined by the Governing Board. The head of the Center is the Executive Director, who shall be appointed by the Governing Board. The Center may employ the additional staff necessary to carry out the Center’s functions as provided in the State budget. The Center shall be considered an authorized representative of the State Department of Education and the Maryland Higher Education Commission under applicable federal and State statutes for purposes of accessing and compiling student record data for research purposes. The Center shall perform the following functions and duties: Serve as a central repository of student data and workforce data in the Maryland Longitudinal Data System, including data sets provided by: The State Department of Education; Local education agencies; The Maryland Higher Education Commission; Institutions of higher education; The Maryland Department of Labor; The Department of Juvenile Services; and The Social Services Administration within the Department of Human Services; Oversee and maintain the warehouse of the Maryland Longitudinal Data System data sets; Ensure routine and ongoing compliance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies, including: The required use of de–identified data in data research and reporting; The required disposition of information that is no longer needed; Providing data security, including the capacity for audit trails; Providing for performance of regular audits for compliance with data privacy and security standards; and Implementing guidelines and policies that prevent the reporting of other potentially identifying data; Conduct research using timely and accurate student data and workforce data to improve the State’s education system and guide decision making by State and local governments, educational agencies, institutions, teachers, and other education professionals; Conduct research relating to: The impact of State and federal education programs; The performance of educator preparation programs; Best practices regarding classroom instruction, education programs and curriculum, and segment alignment; and The impact child welfare programs have on the educational and economic outcomes of students; At the direction of the Accountability and Implementation Board established in Title 5, Subtitle 4 of this article provide: A researcher designated by the Board access to the data in the Maryland Longitudinal Data System in accordance with the procedures for staff authorization and data access established by the Maryland Longitudinal Data System governing board; Aggregate data tables; or Research or evaluation; Analyze social determinants from the following State agencies and appropriate local agencies that impact the education performance of students and indicate the need for wraparound services of students: The Maryland Department of Health; The Department of Juvenile Services; and The Department of Human Services; To the extent practicable, conduct longitudinal studies of the items under this section to evaluate the impact of the Blueprint for Maryland’s Future on the State; Share data with third–party data centers only in accordance with § 24–703.4 of this subtitle; Fulfill information and data requests to facilitate State and federal education reporting with existing State agencies as appropriate; and Fulfill approved public information requests. The Center shall submit a report to the Accountability and Implementation Board on the information determined under subsection (f)(7) and (8) of this section. Direct access to data in the Maryland Longitudinal Data System shall be restricted to authorized staff of the Center. The Center may only use de–identified data in the analysis, research, and reporting conducted by the Center. The Center may only use aggregate data in the release of data in reports and in response to data requests. Data that may be identifiable based on the size or uniqueness of the population under consideration may not be reported in any form by the Center. The Center may not release or sell information that may not be disclosed under the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies. The Center may receive funding from the following sources: State appropriations; Grants or other assistance from local education agencies and institutions of higher education; Federal grants; and Any other grants or contributions from public or private entities received by the Center.

In this section the following words have the meanings indicated. “Foster care recipient” has the meaning stated in § 15–106.1 of this article. “Homeless youth” has the meaning stated in § 15–106.1 of this article. The Center shall develop a clear and easy–to–understand graphic data dashboard that is published annually on the Center’s website with information, disaggregated by local school system, regarding: The number of students who are dually enrolled under Title 18, Subtitle 14A of this article; and The number and course name of the courses in which a student under item (1) of this subsection dually enrolls at the high school and at the public institution of higher education. The Center, in consultation with the Commission, shall develop a clear and easy–to–understand graphic data dashboard that is published annually on the Center’s website with information regarding the experience of foster care recipients and homeless youth and how out–of–home placement affected participation in higher education. The information in the data dashboard under this subsection shall be disaggregated by the county, age, race, and ethnicity of the foster care recipients and homeless youth. The data dashboard required under this subsection shall include information on: The rate of enrollment in institutions of higher education by placement; The type of institution of higher education in which foster care recipients and homeless youth are enrolled; The type of financial support provided to foster care recipients and homeless youth enrolled in an institution of higher education, including the number that: Received a tuition exemption during the previous academic year; and Previously received a tuition exemption at any point during their enrollment at the institution of higher education but did not receive the tuition during the previous academic year; and The graduation rate for foster care recipients and homeless youth from institutions of higher education. On or before December 15, 2021, and each December 15 thereafter, the Center shall send to the Governor and, in accordance with § 2–1257 of the State Government Article, the General Assembly a copy of the data dashboard published under this subsection, as the dashboard appeared on the date it is sent.

In this section the following words have the meanings indicated. “Aggregated data” means de–identified data that is summarized by type of program of study or educational institution. “Student information” means: Student Social Security number; Program of study; Enrollment; and Name of educational institution. “Tax information” means income tax records, wage information, and other data stored by the Comptroller. The Center and the Comptroller jointly shall develop a protocol for research purposes for the: Center to send student information to the Comptroller; Comptroller to match student information to tax information; and Comptroller to produce aggregated data from the matched information on the average amount of wage or salary earnings from self–employment or other sources of income for individuals within each educational institution or program of study. The Comptroller may not produce any aggregated data that may be identifiable based on the size or uniqueness of the population under consideration. The Center and the Comptroller jointly shall develop data handling and security standards for the Comptroller to utilize for the protocol, including: Data retention and disposition policies; Authorized access and authentication for authorized access policies; Privacy compliance standards; and Breach notification and procedures. The Comptroller shall comply with any data privacy and security standards in accordance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies.

The Center shall develop a protocol that is fully aligned with the Center’s data sets and security standards for: A county board to convert a student’s home address and geolocation information into census tract and block numbers; and The Department to collect the census tract and block number information from a county board and provide the information to the Center. For fiscal years 2021 and 2022, the Governor shall appropriate in the annual State budget $100,000 to the Center for development of the protocol under this section.

In this section the following words have the meanings indicated. “FedRAMP” means the Federal Risk and Authorization Management Program managed by the U.S. General Services Administration. “Third–party data center” means a secure computational research platform managed by a person other than a state agency that allows states to securely share data for purposes of data matching and multistate reporting. Subject to the requirements of this section, the Governing Board may authorize the Center to provide individual–level student data and individual–level workforce data to a third–party data center only for the purpose of facilitating multistate research and reporting on student outcomes. The Governing Board may authorize the sharing of data under paragraph (1) of this subsection only with one third–party data center at a time. Before authorizing the Center to provide data to a third–party data center, the Governing Board shall ensure that the third–party data center: Has data handling and security standards that are at least as rigorous as those employed by the Center; Is a FedRAMP–authorized and –certified platform; Uses personally identifiable information only to the extent that is necessary for matching student data and workforce data with data from other states; Employs privacy–enhancing techniques, including data hashing, in place of personally identifiable data whenever appropriate; Uses only de–identified data for analytic purposes; Releases only aggregate data in reports and other output; and Does not report data in any form that may be used to identify individuals based on the size or uniqueness of the population under consideration. Before providing any data to a third–party data center, the Center shall enter into a written data sharing agreement with a third–party data center, in which the third–party data center agrees to comply with: The conditions listed under paragraph (1) of this subsection; State and federal laws relating to data privacy; and Any other criteria the Governing Board determines are appropriate. Each year, the Governing Board shall review an authorized data sharing agreement to ensure that the use of student data and workforce data by the third–party data center remains compliant with the terms of the agreement. Before providing any data to a third–party data center, the Governing Board shall affirmatively approve: The sharing of the data elements that constitute each data set; The sharing of each data set; and Each proposed research or reporting project that seeks to use Maryland data. Within 30 days after entering into a written data sharing agreement with a third–party data center in accordance with this section, the Center shall submit a report to the Senate Committee on Education, Energy, and the Environment and the House Ways and Means Committee, in accordance with § 2–1257 of the State Government Article, that includes: The name of the third–party data center; A summary of the data to be shared; and The purpose of and value to the State for entering into the data sharing agreement. Within 1 year of the date the report under paragraph (1) of this subsection was submitted and each year thereafter until the data sharing agreement is no longer in effect, the Center shall submit a report to the Senate Committee on Education, Energy, and the Environment and the House Ways and Means Committee, in accordance with § 2–1257 of the State Government Article, that describes: The status of the data sharing agreement; How the data is being used to further the purposes and stated value of the data sharing agreement; and Any violations of the data sharing agreement, if any, and steps taken to remedy the violations.

There is a Governing Board of the Center. The Governing Board shall include the following members: The Secretary of Higher Education, or the Secretary’s designee; The Chancellor of the University System of Maryland, or the Chancellor’s designee; The President of Morgan State University, or the President’s designee; The State Superintendent of Schools, or the Superintendent’s designee; The Secretary of Juvenile Services, or the Secretary’s designee; The Secretary of Labor, or the Secretary’s designee; The Secretary of Human Services, or the Secretary’s designee; A representative of local superintendents of schools, appointed by the Governor with the advice and consent of the Senate; A representative of the executive directors of the health occupations boards, appointed by the Governor with the advice and consent of the Senate; The Executive Director of the Maryland Association of Community Colleges, or the Executive Director’s designee; The President of the Maryland Independent College and University Association, or the President’s designee; and Four members of the public, appointed by the Governor with the advice and consent of the Senate. One of the public members of the Governing Board shall have expertise in large data systems and data security. The Governor shall appoint a chair of the Governing Board from among its members. A member appointed by the Governor: Serves at the pleasure of the Governor; Serves for a term of 3 years and until a successor is appointed and qualifies; and May be reappointed but may not serve more than two consecutive terms. A member of the Governing Board: May not receive compensation as a member of the Governing Board; but Is entitled to reimbursement for expenses under the Standard State Travel Regulations, as provided in the State budget. The Governing Board shall: Establish the organizational placement and location of the Center after seeking and evaluating proposals from interested entities based on criteria that shall include: The ability of the entity to support the operation of a large data system; Strength of funding support; and Expertise in data security; Develop an implementation plan to phase in the establishment and operation of the Maryland Longitudinal Data System and the Center; Provide general oversight and direction to the Center; Approve the annual budget for the Center; Establish the policy and research agenda of the Center; Before the incorporation of any individual data in the Maryland Longitudinal Data System: Create an inventory of the individual student data: Proposed to be maintained in the system; and Required to be reported by State and federal education mandates; Develop and implement policies to comply with the federal Family Educational Rights and Privacy Act and any other privacy measures, as required by law or the Governing Board; and Develop a detailed data security and safeguarding plan that includes: Authorized access and authentication for authorized access; Privacy compliance standards; Privacy and security audits; Breach notification and procedures; and Data retention and disposition policies; Approve data sharing with third–party data centers in accordance with § 24–703.4 of this subtitle; Oversee routine and ongoing compliance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies; Ensure that any contracts that govern databases that are outsourced to private vendors include express provisions that safeguard privacy and security and include penalties for noncompliance; Designate a standard and compliance timeline for electronic transcripts that includes the use of SASID to ensure the uniform and efficient transfer of student data between local education agencies and institutions of higher education; and Review research requirements and set policies for the approval of data requests from State and local agencies, the Maryland General Assembly, and the public.

The Governing Board shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the General Assembly on or before December 15 of each year. The report shall include: An update on the implementation of the Maryland Longitudinal Data System and the Center’s activities; A list of all studies performed by the Center during the reporting period; A list of currently warehoused data that is determined to be no longer necessary to carry out the mission of the Center; Any proposed or planned expansion of data maintained in the database; and Any other recommendations made by the Governing Board.

The Center shall adopt regulations to implement the provisions of this subtitle.

Local education agencies, community colleges, public senior higher education institutions, the Department of Human Services, and other State agencies shall: Make every effort to comply with the data requirements and implementation schedule for the Maryland Longitudinal Data System as set forth by the Governing Board; and Transfer student data and workforce data to the Maryland Longitudinal Data System in accordance with the data security and safeguarding plan developed under § 24–704(g)(6) of this subtitle. Private secondary schools may transfer student data and workforce data to the Maryland Longitudinal Data System in accordance with the data security and safeguarding plan developed under § 24–704(g)(6) of this subtitle. For–profit institutions of higher education, private nonprofit institutions of higher education that do not receive State funds, and institutions of higher education that are required to register under § 11–202.2 of this article shall transfer student–level enrollment data, degree data, and financial aid data for all Maryland residents to the Maryland Longitudinal Data System in accordance with the data security and safeguarding plan developed under § 24–704(g)(6) of this subtitle. Private nonprofit institutions of higher education that receive State funds shall transfer student–level enrollment data, degree data, financial aid data, and credit data for all students to the Maryland Longitudinal Data System in accordance with the data security and safeguarding plan developed under § 24–704(g)(6) of this subtitle. An institution that transfers or discloses student–level data under paragraph (1) or (2) of this subsection is not liable for a breach of confidentiality or for a disclosure, use, retention, or destruction of the data that results from an act or omission by: The Maryland Longitudinal Data System Center; A State agency; or A person provided access to the data by the Maryland Longitudinal Data System Center or a State agency. If the Maryland Independent College and University Association transfers or discloses student–level data to the Maryland Longitudinal Data System or a State agency on behalf of a private nonprofit institution of higher education under paragraph (1) or (2) of this subsection, the association is not liable for a breach of confidentiality or for a disclosure, use, retention, or destruction of the data that results from an act or omission by: The Maryland Longitudinal Data System Center; A State agency; or A person provided access to the data by the Maryland Longitudinal Data System Center or a State agency. Notwithstanding any other provision of law, a licensing authority shall: Make every effort to comply with the data requirements and implementation schedule for the Maryland Longitudinal Data System as set forth by the Governing Board; and Transfer student data to the Maryland Longitudinal Data System in accordance with the data security and safeguarding plan developed under § 24–704(g) of this subtitle. An industry certifier that receives State funds shall: Comply with the data requirements and implementation schedule for the Maryland Longitudinal Data System set forth by the Governing Board; and Transfer student data to the Maryland Longitudinal Data System in accordance with the data security and safeguarding plan developed under § 24–704(g) of this subtitle.