(a) The State School Superintendent shall designate a senior department employee to serve as the chief privacy officer of the department to assume primary responsibility for data privacy and security policy, including:

(1) Establishing department-wide policies necessary to assure that the use of technologies sustains, enhances, and does not erode privacy protections relating to the use, collection, and disclosure of student data;

(2) Ensuring that student data contained in the state data system is handled in full compliance with this article, the federal Family Educational Rights and Privacy Act, and other state and federal data privacy and security laws;

(3) Evaluating legislative and regulatory proposals involving use, collection, and disclosure of student data by the department;

(4) Conducting a privacy impact assessment on legislative proposals, regulations, and program initiatives of the department, including the type of personal information collected and the number of students affected;

(5) Coordinating with the Attorney General's office and other legal entities as necessary to ensure that state programs, policies, and procedures involving civil rights, civil liberties, and privacy considerations are addressed in an integrated and comprehensive manner;

(6) Preparing an annual report to the General Assembly on activities of the department that affect privacy, including complaints of privacy violations, internal controls, and other matters;

(7) Working with the department general counsel and other officials in engaging with stakeholders about the quality, usefulness, openness, and privacy of data;

(8) Establishing and operating a department-wide Privacy Incident Response Program to ensure that incidents involving department data are properly reported, investigated, and mitigated, as appropriate;

(9) Establishing a model process and policy for any parent to file complaints of privacy violations or inability to access his or her child's education records against the responsible local board of education pursuant to Code Section 20-2-667; and

(10) Providing training, guidance, technical assistance, and outreach to build a culture of privacy protection, data security, and data practice transparency to students, parents, and the public among all state and local governmental education entities that collect, maintain, use, or share student data.

(b) The chief privacy officer may investigate issues of compliance with this article and with other state data privacy and security laws by the department and local boards of education and may:

(1) Have access to all records, reports, audits, reviews, documents, papers, recommendations, and other materials available to the department that relate to programs and operations with respect to the responsibilities of the chief privacy officer under this Code section;

(2) Make such investigations and reports relating to the administration of the programs and operations of the department as are necessary or desirable; and

(3) In matters relating to compliance with federal laws, refer the matter to the appropriate federal agency and cooperate with any investigations by such federal agency.