Dive Brief:

• The Missouri Department of Elementary and Secondary Education (DESE) will stop collecting student information, including Social Security numbers, unless it is absolutely necessary.
• The action was in response to a recent state audit that found the department had aggregated and stored an unnecessary amount of students’ personal information.
• The department plans to also delete any sensitive data that it no longer needs and secure its current data system.

Dive Insight:

One lesson for other states from Missouri’s audit: Update your plan for what happens in case of a privacy breach. Missouri’s education department did not have a comprehensive plan for how to respond in the wake of a breach — the state’s protocol and plan had not been updated in over a decade.

As for the unnecessary data collection, state auditors says some simple steps will go a long way. “What we’re saying is, collect it at the time you need it, and then don’t collect it again, don’t type it in the system again, don’t type it in a spreadsheet and upload it to DESE’s system again,” state auditor Nicole Galloway told MissouriNet.