Student & Staff Data Privacy FAQ for School Records 

Portrait Express is  a  trusted  provider  of  school  services,  providing  portrait  and  photography  services  to  schools  and  families  throughout  North  America  since  1983.  In  preparation  for  Picture  Day,  Portrait Express  requires  certain  directory  -  type  information  from  your  school  (“School  Data”),  to  be  used  as  follows  :

 •  To  produce  and  deliver  to  schools  the  portrait  -  based  products  and  services  needed  for  the  school’s  administrative  purposes  and/or  for  use  in  the  school  yearbook  (the  “School  Service  Items”)  ;  and  

•  To  deliver  Picture  Day  notices  on  behalf  of  your  school  and  provide  parents  of  students  photographed  opportunities  to  purchase  portraits.

The  following  FAQs  are  intended  to  further  demonstrate  Portrait Express’s  commitment  to  responsible  stewardship  of  your  School  Data.

What School Data does Portrait Express collect? The  data  we  need  for  Picture  Day  depends  upon  the  specific  services  and  deliverables  your photographer  is  providing to your  school.  We  limit  collection  to  only  that  which  is  necessary  for  an  authorized  school  purpose.  We  collect  basic  roster  and  classroom  information  in  advance  of  Picture  Day  to  ensure  a  perfect  name  -  image  match  for  each  portrait  and  for  efficient  distribution  within  the  school.  In some cases,  we  collect  parents’  email  addresses  in  order  to  deliver  Picture  Day  -  related  communications.  In  such  cases,  we  do  not  retain  or  use  such  information  for  any  other  purpose.  In  addition,  School  Data  may  be  incorporated  into  School  Service  Items.  For  example,  if  Portrait Express  is  producing  student  ID  cards,  we  need  the  student  ID  number  to  do  the  job.  Schools  ultimately  decide  how  much,  or  how  little,  information  is  used  in  producing  School  Service  Items.

How does Portrait Express use School Data?  Portrait Express  uses  School  Data  solely  as  necessary  to  create,  offer  and  deliver  student  images  and  school  administrative  services  to  the  school  and  families  of  the  students.  Portrait Express  will  not  sell  or  license  such  data  to  others.  To  the  extent  service  providers  are  employed  by  Portrait Express  to  assist  in  fulfilling  Portrait Express’s  obligations,  we  require  compliance  with  strict  confidentiality  and  security  measures.  Portrait Express  retains  School  Data  only  as  necessary  and  permissible  to  promote  the  sale  of  portraits  to  parents,  to  retrieve  the  images  to  supply  picture  orders  for  the  current  school  year  and  to  support  the  school  for  an  approved  administrative  purpose.  Once  such  data  is  no  longer  needed  for  these  purposes,  it  is  securely  destroyed.  While  retained,  images  remain  under  Portrait Express’s  control  and  treated  as  confidential  information.  

What about FERPA  -  does the law allow disclosure of School Data to Portrait Express?  Yes.  Portrait Express  acknowledges  its  obligations  as  a  service  provider  to  your  school  for  student  and  staff  photography  pursuant  to  the  federal  Family  Educational  Rights  and  Privacy  Act  (FERPA),  20  U. S. C.  §  1232  g  and  its  implementing  regulations,  34  CFR  part  99.  As  such,  we  affirm  that  Portrait Express  has  a  legitimate  need  for  certain  School  Data  to  provide  photographic  services  and  products  for  the  school’s  administrative  needs.  Your  school  retains  the  authority  to  control  Portrait Express’s  use  of  School  Data,  including  the  right  to  require  the  return  or  destruction  of  any  School  Data  provided  to  Portrait Express  at  any  time.  Additionally,  Portrait Express  will  strive  to  meet  any  additional  data  handling  requirements  as  prescribed  by  state  law  and/or  school  district  policies,  as  long  as  we  are  notified  of  the  same  prior  to  disclosure.

How  does Portrait Express protect School Data? Portrait Express  employs  a  variety  of  physical,  technical  and  organizational  security  measures  to  help  protect  School  Data  from  unauthorized  access  and  use.

Facilities.  Portrait Express  produces  portraits  and  School  Service  Items  within  its  own  U.  S.  -  based  photo  labs.  Portrait Express  network  devices  are  located  in a  secure  datacenter  facility  under  direct  control  by  Portrait Express  employees.

Networks.  Devices  storing  or  providing  access  to  School  Data  are  protected  with  the  same  multi  -  layered  security  strategies  that  we  use  to  protect  Portrait Express’s  sensitive  and  confidential  business  records.  Image  databases  supporting  our  photo  processing  labs  and  websites  are  separated  from  associated  data  files  containing  identifiable  information,  and  all  databases  are  protected  by  firewalls,  monitoring,  vulnerability  scanning  and  authentication  procedures.  We  perform  regular  network  penetration  testing  and  intrusion  prevention  methods.  Our  systems  enable  secure  transmission  of  School  Data  from  and  to  the  Portrait Express  network  with  encryption  technologies.

Personnel.  Portrait Express’s  policy  is  to  collect,  use  and  disclose  personal  information  only  in  ways  that  are  consistent  with  our  respect  for  an  individual’s  privacy.  We  require  Portrait Express  employees  to  sign  confidentiality  agreements  as  a  condition  of  employment,  and  provide  training  on  the  appropriate  use  and  handling  of  School  Data.  Access  to  School  Data  is  limited  to  those  who  need  it  to  perform  their  jobs.  We  take  appropriate  measures  to  enforce  these  policies.