Sec. 121.4. Complaints of breach or unauthorized release of personally identifiable information

(a) Each educational agency must establish and communicate to parents, eligible students, teachers, principals or other staff of an educational agency, its procedures for them to file complaints about breaches or unauthorized releases of student data and/or teacher or principal data.

(b) The complaint procedures must require educational agencies to promptly acknowledge receipt of complaints, commence an investigation, and take the necessary precautions to protect personally identifiable information.

(c) Following its investigation of a submitted complaint, the educational agency shall provide the parent or eligible student, teacher, principal or any other staff member of the educational agency who filed a complaint with its findings within a reasonable period but no more than 60 calendar days from the receipt of the complaint by the educational agency. Where the educational agency requires additional time, or where the response may compromise security or impede a law enforcement investigation, the educational agency shall provide the parent, eligible student, teacher, principal or any other staff member of the educational agency who filed a complaint with a written explanation that includes the approximate date when the educational agency anticipates that it will respond to the complaint.

(d) Educational agencies may require complaints to be submitted in writing.

(e) Educational agencies must maintain a record of all complaints of breaches or unauthorized releases of student data and their disposition in accordance with applicable data retention policies, including the Records Retention and Disposition Schedule ED-1 (1988; rev. 2004), as set forth in section 185.12, Appendix I of this Title.