Sec. 121.13. Chief privacy officer’s powers

(a) The chief privacy officer shall have the power to access all records, reports, audits, reviews, documents, papers, recommendations, and other materials maintained by an educational agency that relate to student data or teacher or principal data, which shall include but not be limited to records related to any technology product or service that will be utilized to store and/or process personally identifiable information.

(b) Based upon a review of such records, the chief privacy officer may require an educational agency to act to ensure that personally identifiable information is protected in accordance with State and Federal law and regulations, including but not limited to requiring an educational agency to perform a privacy impact and security risk assessment.

(c) The chief privacy officer shall also have and exercise any other powers that the commissioner shall deem appropriate.