Rep. Norm Thurston — Voting Record

Bill

Number

S.B. 207 Second Substitute (2018GS)

Sponsor

Sen. Anderegg, J.

Final action

Governor Signed 3/19/2018

Outcome

Became law — signed by Gov. Gary R. Herbert

Summary

What it does

• This bill:
• defines terms;
• updates provisions of Title 53E, Chapter 9, Part 3, Student Data Protection, to:
• coordinate with federal law; and
• provide clarification;
• grants certain rulemaking authority to the State Board of Education; and
• makes technical and conforming corrections.

Every vote on this bill

Bill text

STUDENT DATA PROTECTION AMENDMENTS
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Jacob L. Anderegg
House Sponsor: 
____________
LONG TITLE
General Description:
This bill amends provisions related to student data protection.
Highlighted Provisions:
This bill:
▸ defines terms;
▸ updates provisions of Title 53E, Chapter 9, Part 3, Student Data Protection, to:
• coordinate with federal law; and
• provide clarification;
▸ grants certain rulemaking authority to the State Board of Education; and
▸ makes technical and conforming corrections.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
53E-9-301
, as renumbered and amended by Laws of Utah 2018, Chapter 1
53E-9-302
, as renumbered and amended by Laws of Utah 2018, Chapter 1
53E-9-304
, as renumbered and amended by Laws of Utah 2018, Chapter 1
53E-9-305
, as renumbered and amended by Laws of Utah 2018, Chapter 1
53E-9-306
, as renumbered and amended by Laws of Utah 2018, Chapter 1
53E-9-308
, as renumbered and amended by Laws of Utah 2018, Chapter 1
53E-9-309
, as renumbered and amended by Laws of Utah 2018, Chapter 1
53E-9-310
, as renumbered and amended by Laws of Utah 2018, Chapter 1
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
53E-9-301
 is amended to read:
53E-9-301.
Definitions.
As used in this part:
(1) "Adult student" means a student who:
(a) is at least 18 years old;
(b) is an emancipated student; or
(c) qualifies under the McKinney-Vento Homeless Education Assistance
Improvements Act of 2001, 42 U.S.C. Sec. 11431 et seq.
(2) "Aggregate data" means data that:
(a) are totaled and reported at the group, cohort, school, school district, region, or state
level with at least 10 individuals in the level;
(b) do not reveal personally identifiable student data; and
(c) are collected in accordance with board rule.
(3) (a) "Biometric identifier" means a:
(i) retina or iris scan;
(ii) fingerprint;
(iii) human biological sample used for valid scientific testing or screening; or
(iv) scan of hand or face geometry.
(b) "Biometric identifier" does not include:
(i) a writing sample;
(ii) a written signature;
(iii) a voiceprint;
(iv) a photograph;
(v) demographic data; or
(vi) a physical description, such as height, weight, hair color, or eye color.
(4) "Biometric information" means information, regardless of how the information is
collected, converted, stored, or shared:
(a) based on an individual's biometric identifier; and
(b) used to identify the individual.
(5) "Board" means the State Board of Education.
[
(6) "Cumulative disciplinary record" means disciplinary student data that is part of a
cumulative record.
]
[
(7) "Cumulative record" means physical or electronic information that the education
entity intends:
]
[
(a) to store in a centralized location for 12 months or more; and
]
[
(b) for the information to follow the student through the public education system.
]
[
(8) "Data authorization" means written authorization to collect or share a student's
student data, from:
]
[
(a) the student's parent, if the student is not an adult student; or
]
[
(b) the student, if the student is an adult student.
]
(6) "Data breach" means an unauthorized release of or unauthorized access to
personally identifiable student data that is maintained by an education entity.
[
(9)
] 
(7)
 "Data governance plan" means an education entity's comprehensive plan for
managing education data that:
(a) incorporates reasonable data industry best practices to maintain and protect student
data and other education-related data;
(b) describes the role, responsibility, and authority of an education entity data
governance staff member;
[
(b)
] 
(c)
 provides for necessary technical assistance, training, support, and auditing;
[
(c)
] 
(d)
 describes the process for sharing student data between an education entity and
another person;
[
(d)
] 
(e)
 describes the 
education entity's data expungement
 process [
for an adult student
or parent to request that data be expunged; and
]
, including how to respond to requests for
expungement;
(f) describes the data breach response process; and
[
(e)
] 
(g)
 is published annually and available on the education entity's website.
[
(10)
] 
(8)
 "Education entity" means:
(a) the board;
(b) a local school board;
(c) a charter school governing board;
(d) a school district;
(e) a charter school;
(f) the Utah Schools for the Deaf and the Blind; or
(g) for purposes of implementing the School Readiness Initiative described in Title
53F, Chapter 6, Part 3, School Readiness Initiative, the School Readiness Board created in
Section 
53F-6-302
.
[
(11)
] 
(9)
 "Expunge" means to seal or permanently delete data, as described in board
rule made under Section 
53E-9-306
.
[
(12) "External application" means a general audience:
]
[
(a) application;
]
[
(b) piece of software;
]
[
(c) website; or
]
[
(d) service.
]
(10) "General audience application" means an Internet website, online service, online
application, mobile application, or software program that:
(a) is not specifically intended for use by an audience member that attends kindergarten
or a grade from 1 to 12, although an audience member may attend kindergarten or a grade from
to 12; and
(b) is not subject to a contract between an education entity and a third-party contractor.
[
(13)
] 
(11)
 "Individualized education program" or "IEP" means a written statement:
(a) for a student with a disability; and
(b) that is developed, reviewed, and revised in accordance with the Individuals with
Disabilities Education Act, 20 U.S.C. Sec. 1400 et seq.
[
(14) "Internal application" means an Internet website, online service, online
application, mobile application, or software, if the Internet website, online service, online
application, mobile application, or software is subject to a third-party contractor's contract with
an education entity.
]
[
(15)
] 
(12)
 "Local education agency" or "LEA" means:
(a) a school district;
(b) a charter school;
(c) the Utah Schools for the Deaf and the Blind; or
(d) for purposes of implementing the School Readiness Initiative described in Title
53F, Chapter 6, Part 3, School Readiness Initiative, the School Readiness Board created in
Section 
53F-6-302
.
[
(16) "Metadata dictionary" means a complete list of an education entity's student data
elements and other education-related data elements, that:
]
[
(a) defines and discloses all data collected, used, stored, and shared by the education
entity, including:
]
[
(i) who uses a data element within an education entity and how a data element is used
within an education entity;
]
[
(ii) if a data element is shared externally, who uses the data element externally and
how a data element is shared externally;
]
[
(iii) restrictions on the use of a data element; and
]
[
(iv) parent and student rights to a data element;
]
[
(b) designates student data elements as:
]
[
(i) necessary student data; or
]
[
(ii) optional student data;
]
[
(c) designates student data elements as required by state or federal law; and
]
[
(d) without disclosing student data or security information, is displayed on the
education entity's website.
]
(13) "Metadata dictionary" means a record that:
(a) defines and discloses all personally identifiable student data collected and shared by
the education entity;
(b) comprehensively lists all recipients with whom the education entity has shared
personally identifiable student data, including:
(i) the purpose for sharing the data with the recipient;
(ii) the justification for sharing the data, including whether sharing the data was
required by federal law, state law, or a local directive; and
(iii) how sharing the data is permitted under federal or state law; and
(c) without disclosing personally identifiable student data, is displayed on the
education entity's website.
[
(17)
] 
(14)
 "Necessary student data" means data required by state statute or federal law
to conduct the regular activities of an education entity, including:
(a) name;
(b) date of birth;
(c) sex;
(d) parent contact information;
(e) custodial parent information;
(f) contact information;
(g) a student identification number;
(h) local, state, and national assessment results or an exception from taking a local,
state, or national assessment;
(i) courses taken and completed, credits earned, and other transcript information;
(j) course grades and grade point average;
(k) grade level and expected graduation date or graduation cohort;
(l) degree, diploma, credential attainment, and other school exit information;
(m) attendance and mobility;
(n) drop-out data;
(o) immunization record or an exception from an immunization record;
(p) race;
(q) ethnicity;
(r) tribal affiliation;
(s) remediation efforts;
(t) an exception from a vision screening required under Section 
53G-9-404
 or
information collected from a vision screening required under Section 
53G-9-404
;
(u) information related to the Utah Registry of Autism and Developmental Disabilities,
described in Section 
26-7-4
;
(v) student injury information;
(w) a [
cumulative
] disciplinary record created and maintained as described in Section
53E-9-306
;
(x) juvenile delinquency records;
(y) English language learner status; and
(z) child find and special education evaluation data related to initiation of an IEP.
[
(18)
] 
(15)
 (a) "Optional student data" means student data that is not:
(i) necessary student data; or
(ii) student data that an education entity may not collect under Section 
53E-9-305
.
(b) "Optional student data" includes:
(i) information that is:
(A) related to an IEP or needed to provide special needs services; and
(B) not necessary student data;
(ii) biometric information; and
(iii) information that is not necessary student data and that is required for a student to
participate in a federal or other program.
[
(19)
] 
(16)
 "Parent" means [
a student's parent or legal guardian.
]
:
(a) a student's parent;
(b) a student's legal guardian; or
(c) an individual who has written authorization from a student's parent or legal
guardian to act as a parent or legal guardian on behalf of the student.
[
(20)
] 
(17)
 (a) "Personally identifiable student data" means student data that identifies
or is used by the holder to identify a student.
(b) "Personally identifiable student data" includes:
(i) a student's first and last name;
(ii) the first and last name of a student's family member;
(iii) a student's or a student's family's home or physical address;
(iv) a student's email address or other online contact information;
(v) a student's telephone number;
(vi) a student's social security number;
(vii) a student's biometric identifier;
(viii) a student's health or disability data;
(ix) a student's education entity student identification number;
(x) a student's social media user name and password or alias;
(xi) if associated with personally identifiable student data, the student's persistent
identifier, including:
(A) a customer number held in a cookie; or
(B) a processor serial number;
(xii) a combination of a student's last name or photograph with other information that
together permits a person to contact the student online;
(xiii) information about a student or a student's family that a person collects online and
combines with other personally identifiable student data to identify the student; and
(xiv) [
other information that is linked to a specific student that would allow a
reasonable person in the school community, who does not have first-hand knowledge of the
student, to identify the student with reasonable certainty.
] 
information that, alone or in
combination, is linked or linkable to a specific student that would allow a reasonable person in
the school community, who does not have personal knowledge of the relevant circumstances,
to identify the student with reasonable certainty.
[
(21)
] 
(18)
 "School official" means an employee or agent of an education entity, if the
education entity has authorized the employee or agent to request or receive student data on
behalf of the education entity.
[
(22)
] 
(19)
 (a) "Student data" means information about a student at the individual
student level.
(b) "Student data" does not include aggregate or de-identified data.
[
(23) "Student data disclosure statement" means a student data disclosure statement
described in Section 
53E-9-305
.
]
[
(24)
] 
(20)
 "Student data manager" means:
(a) the state student data officer; or
(b) an individual designated as a student data manager by an education entity under
Section 
53E-9-303
[
.
]
, who fulfills the duties described in Section 
53E-9-308
.
[
(25)
] 
(21)
 (a) "Targeted advertising" means presenting advertisements to a student
where the advertisement is selected based on information obtained or inferred over time from
that student's online behavior, usage of applications, or student data.
(b) "Targeted advertising" does not include advertising to a student:
(i) at an online location based upon that student's current visit to that location; or
(ii) in response to that student's request for information or feedback, without retention
of that student's online activities or requests over time for the purpose of targeting subsequent
ads.
[
(26)
] 
(22)
 "Third-party contractor" means a person who:
(a) is not an education entity; and
(b) pursuant to a contract with an education entity, collects or receives student data in
order to provide a product or service, as described in the contract, if the product or service is
not related to school photography, yearbooks, graduation announcements, or a similar product
or service.
(23) "Written consent" means written authorization to collect or share a student's
student data, from:
(a) the student's parent, if the student is not an adult student; or
(b) the student, if the student is an adult student.
Section 2. Section 
53E-9-302
 is amended to read:
53E-9-302.
State student data protection governance.
(1) (a) An education entity or a third-party contractor who collects, uses, stores, shares,
or deletes student data shall protect student data as described in this part.
(b) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
board shall make rules to administer this part, including student data protection standards for
public education employees, student aides, and volunteers.
(2) The board shall oversee the preparation and maintenance of:
(a) a statewide data governance plan; and
(b) a state-level metadata dictionary.
(3) As described in this Subsection (3), the board shall establish advisory groups to
oversee student data protection in the state and make recommendations to the board regarding
student data protection.
(a) The board shall establish a student data policy advisory group:
(i) composed of members from:
(A) the Legislature;
(B) the board and board employees; and
(C) one or more LEAs;
(ii) to discuss and make recommendations to the board regarding:
(A) enacted or proposed legislation; and
(B) state and local student data protection policies across the state;
(iii) that reviews and monitors the state student data governance plan; and
(iv) that performs other tasks related to student data protection as designated by the
board.
(b) The board shall establish a student data governance advisory group:
(i) composed of the state student data officer and other board employees; and
(ii) that performs duties related to state and local student data protection, including:
(A) overseeing data collection and usage by board program offices; and
(B) preparing and maintaining the board's student data governance plan under the
direction of the student data policy advisory group.
(c) The board shall establish a student data users advisory group:
(i) composed of members who use student data at the local level; and
(ii) that provides feedback and suggestions on the practicality of actions proposed by
the student data policy advisory group and the student data governance advisory group.
(4) (a) The board shall designate a state student data officer.
(b) The state student data officer shall:
(i) act as the primary point of contact for state student data protection administration in
assisting the board to administer this part;
(ii) ensure compliance with student privacy laws throughout the public education
system, including:
(A) providing training and support to applicable board and LEA employees; and
(B) producing resource materials, model plans, and model forms for local student data
protection governance, including a model student data [
disclosure statement
] 
collection notice
;
(iii) investigate complaints of alleged violations of this part;
(iv) report violations of this part to:
(A) the board;
(B) an applicable education entity; and
(C) the student data policy advisory group; and
(v) act as a state level student data manager.
(5) The board shall designate:
(a) at least one support manager to assist the state student data officer; and
(b) a student data protection auditor to assist the state student data officer.
(6) The board shall establish [
an external
] 
a
 research review process for a request for
data for the purpose of [
external
] research or evaluation.
Section 3. Section 
53E-9-304
 is amended to read:
53E-9-304.
Student data ownership and access -- Notification in case of
significant data breach.
(1) (a) A student owns the student's personally identifiable student data.
[
(b) A student may download, export, transfer, save, or maintain the student's student
data, including a document.
]
(b) The following may access a student's student data that is maintained by an
education entity:
(i) the student, if the student is an adult; or
(ii) (A) the student's parent;
(B) the student's legal guardian; or
(C) in accordance with the education entity's internal policy, and in the absence of a
parent or legal guardian, an individual acting as a parent to the student.
(2) 
(a)
 If [
there is a release of a student's personally identifiable student data due to a
security breach, an
] 
a significant data breach occurs at an education entity, the
 education entity
shall notify:
[
(a)
] 
(i)
 the student, if the student is an adult student; or
[
(b)
] 
(ii)
 the student's parent or legal guardian, if the student is not an adult student.
(b) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
board shall make rules to define a significant data breach described in Subsection (2)(a).
Section 4. Section 
53E-9-305
 is amended to read:
53E-9-305.
Collecting student data -- Prohibition -- Student data collection notice
-- Authorization.
[
(1) An education entity shall comply with this section beginning with the 2017-18
school year.
]
[
(2)
] 
(1)
 An education entity may not collect a student's:
(a) social security number; or
(b) except as required in Section 
78A-6-112
, criminal record.
[
(3)
] 
(2)
 An education entity [
that collects student data into a cumulative record
] shall,
in accordance with this section, prepare and distribute to parents and students a student data
[
disclosure
] 
collection notice
 statement that:
(a) is a prominent, stand-alone document;
(b) is annually updated and published on the education entity's website;
(c) states the [
necessary and optional
] student data 
that
 the education entity collects;
(d) states that the education entity will not collect the student data described in
Subsection [
(2)
] 
(1)
;
(e) states the student data described in Section 
53E-9-308
 that the education entity may
not share without [
a data authorization
] 
written consent
;
[
(f) describes how the education entity may collect, use, and share student data;
]
[
(g)
] 
(f)
 includes the following statement:
"The collection, use, and sharing of student data has both benefits and risks. Parents
and students should learn about these benefits and risks and make choices regarding student
data accordingly."; 
[
(h)
] 
(g)
 describes in general terms how the education entity stores and protects student
data; and
[
(i)
] 
(h)
 states a student's rights under this part.
[
(4)
] 
(3)
 An education entity may collect the necessary student data of a student [
into a
cumulative record
] if the education entity provides a student data [
disclosure statement
]
collection notice
 to:
(a) the student, if the student is an adult student; or
(b) the student's parent, if the student is not an adult student.
[
(5)
] 
(4)
 An education entity may collect optional student data [
into a cumulative
record
] if the education entity:
(a) provides, to an individual described in Subsection [
(4)
] 
(3)
, a student data
[
disclosure statement
] 
collection notice
 that includes a description of:
(i) the optional student data to be collected; and
(ii) how the education entity will use the optional student data; and
(b) obtains [
a data authorization
] 
written consent
 to collect the optional student data
from an individual described in Subsection [
(4)
] 
(3)
.
[
(6)
] 
(5)
 An education entity may collect a student's biometric identifier or biometric
information [
into a cumulative record
] if the education entity:
(a) provides, to an individual described in Subsection [
(4)
] 
(3)
, a biometric information
[
disclosure statement
] 
collection notice
 that is separate from a student data [
disclosure
statement
] 
collection notice
, which states:
(i) the biometric identifier or biometric information to be collected;
(ii) the purpose of collecting the biometric identifier or biometric information; and
(iii) how the education entity will use and store the biometric identifier or biometric
information; and
(b) obtains [
a data authorization
] 
written consent
 to collect the biometric identifier or
biometric information from an individual described in Subsection [
(4)
] 
(3)
.
Section 5. Section 
53E-9-306
 is amended to read:
53E-9-306.
Using and deleting student data -- Rulemaking -- Disciplinary
records.
(1) In accordance with Title 63G, Chapter 2, Government Records Access and
Management Act, and Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the board
shall make rules regarding using and expunging student data, including:
(a) a categorization of [
cumulative
] disciplinary records that includes the following
levels of maintenance:
(i) one year;
(ii) three years; and
(iii) [
except as required in
] 
in accordance with
 Subsection (3), as determined by the
education entity;
(b) the types of student data that may be expunged, including:
(i) medical records; and
(ii) behavioral test assessments; [
and
]
(c) the types of student data that may not be expunged, including:
(i) grades;
(ii) transcripts;
(iii) a record of the student's enrollment; and
(iv) assessment information[
.
]
; and
(d) the timeline and process for a prior student or parent of a prior student to request
that an education entity expunge all of the prior student's student data.
(2) In accordance with board rule, an education entity may create and maintain a
[
cumulative
] disciplinary record for a student.
[
(3) (a) An education entity shall, in accordance with board rule, expunge a student's
student data that is stored by the education entity if:
]
[
(i) the student is at least 23 years old; and
]
[
(ii) the student requests that the education entity expunge the student data.
]
[
(b)
] 
(3)
 An education entity shall retain and dispose of records in accordance with
Section 
63G-2-604
 and board rule.
Section 6. Section 
53E-9-308
 is amended to read:
53E-9-308.
Sharing student data -- Prohibition -- Requirements for student data
manager -- Authorized student data sharing.
[
(1) An education entity shall comply with this section beginning with the 2017-18
school year.
]
[
(2) An education entity may not share a student's personally identifiable student data if
the personally identifiable student data is not shared in accordance with:
]
[
(a) the Family Education Rights and Privacy Act and related provisions under 20
U.S.C. Secs. 1232g and 1232h; and
]
[
(b) this part.
]
(1) (a) Except as provided in Subsection (1)(b), an education entity, including a student
data manager, may not share personally identifiable student data without written consent.
(b) An education entity, including a student data manager, may share personally
identifiable student data:
(i) in accordance with the Family Education Rights and Privacy Act and related
provisions under 20 U.S.C. Secs. 1232g and 1232h;
(ii) as required by federal law; and
(iii) as described in Subsections (3), (5), and (6).
[
(3)
] 
(2)
 A student data manager shall:
(a) authorize and manage the sharing, outside of the 
student data manager's
 education
entity, of personally identifiable student data [
from a cumulative record
] for the education
entity as described in this section; [
and
]
(b) act as the primary local point of contact for the state student data officer described
in Section 
53E-9-302
[
.
]
; and
(c) fulfill other responsibilities described in the data governance plan of the student
data manager's education entity.
[
(4) (a) Except as provided in this section or required by federal law, a student data
manager may not share, outside of the education entity, personally identifiable student data
from a cumulative record without a data authorization.
]
[
(b) A student data manager may share the personally identifiable student data of a
student with the student and the student's parent.
]
[
(5) A student data manager may share a student's personally identifiable student data
from a cumulative record with:
]
[
(a) a school official;
]
[
(b) as described in Subsection (6), an authorized caseworker or other representative of
the Department of Human Services; or
]
[
(c) a person to whom the student data manager's education entity has outsourced a
service or function:
]
[
(i) to research the effectiveness of a program's implementation; or
]
[
(ii) that the education entity's employees would typically perform.
]
[
(6)
] 
(3)
 A student data manager may share a student's personally identifiable student
data [
from a cumulative record
] with a caseworker or representative of the Department of
Human Services if:
(a) the Department of Human Services is:
(i) legally responsible for the care and protection of the student; or
(ii) providing services to the student;
(b) the student's personally identifiable student data is not shared with a person who is
not authorized:
(i) to address the student's education needs; or
(ii) by the Department of Human Services to receive the student's personally
identifiable student data; and
(c) the Department of Human Services maintains and protects the student's personally
identifiable student data.
[
(7)
] 
(4)
 The Department of Human Services, a school official, or the Utah Juvenile
Court may share [
education information, including a student's personally identifiable student
data,
] 
personally identifiable student data
 to improve education outcomes for youth:
(a) in the custody of, or under the guardianship of, the Department of Human Services;
(b) receiving services from the Division of Juvenile Justice Services;
(c) in the custody of the Division of Child and Family Services;
(d) receiving services from the Division of Services for People with Disabilities; or
(e) under the jurisdiction of the Utah Juvenile Court.
[
(8) Subject to Subsection (9), a student data manager may share aggregate data.
]
[
(9) (a) If a student data manager receives a request to share data for the purpose of
external research or evaluation, the student data manager shall:
]
[
(i) submit the request to the education entity's external research review process; and
]
[
(ii) fulfill the instructions that result from the review process.
]
[
(b) A student data manager may not share personally identifiable student data for the
purpose of external research or evaluation.
]
[
(10) (a) A student data manager may share personally identifiable student data in
response to a subpoena issued by a court.
]
[
(b) A person who receives personally identifiable student data under Subsection
(10)(a) may not use the personally identifiable student data outside of the use described in the
subpoena.
]
[
(11) (a) In accordance with board rule, a student data manager may share personally
identifiable information that is directory information.
]
[
(b) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act,
the board shall make rules to:
]
[
(i) define directory information; and
]
[
(ii) determine how a student data manager may share personally identifiable
information that is directory information.
]
(5) (a) A student data manager may share personally identifiable student data in
response to a subpoena issued by a court.
(b) A person who receives personally identifiable student data under Subsection (5)(a)
may not use the personally identifiable student data outside of the use described in the
subpoena.
(6) A student data manager may share student data, including personally identifiable
student data, in response to a request to share student data for the purpose of research or
evaluation, if the student data manager:
(a) verifies that the request meets the requirements of 34 C.F.R. Sec. 99.31(a)(6);
(b) submits the request to the education entity's research review process; and
(c) fulfills the instructions that result from the review process.
(7) A student data manager may share aggregate data.
Section 7. Section 
53E-9-309
 is amended to read:
53E-9-309.
Third-party contractors -- Use and protection of student data --
Contract requirements -- Completion of contract -- Required and allowed uses of student
data -- Restrictions on the use of student data -- Exceptions.
(1) A third-party contractor shall use personally identifiable student data received
under a contract with an education entity strictly for the purpose of providing the contracted
product or service within the negotiated contract terms.
(2) When contracting with a third-party contractor, an education entity shall require the
following provisions in the contract:
(a) requirements and restrictions related to the collection, use, storage, or sharing of
student data by the third-party contractor that are necessary for the education entity to ensure
compliance with the provisions of this part and board rule;
(b) a description of a person, or type of person, including an affiliate of the third-party
contractor, with whom the third-party contractor may share student data;
(c) provisions that, at the request of the education entity, govern the deletion of the
student data received by the third-party contractor;
(d) except as provided in Subsection (4) and if required by the education entity,
provisions that prohibit the secondary use of personally identifiable student data by the
third-party contractor; and
(e) an agreement by the third-party contractor that, at the request of the education entity
that is a party to the contract, the education entity or the education entity's designee may audit
the third-party contractor to verify compliance with the contract.
(3) As authorized by law or court order, a third-party contractor shall share student data
as requested by law enforcement.
(4) A third-party contractor may:
(a) use student data for adaptive learning or customized student learning purposes;
(b) market an educational application or product to a parent [
or legal guardian
] of a
student if the third-party contractor did not use student data, shared by or collected on behalf of
an education entity, to market the educational application or product;
(c) use a recommendation engine to recommend to a student:
(i) content that relates to learning or employment, within the third-party contractor's
[
internal
] application, if the recommendation is not motivated by payment or other
consideration from another party; or
(ii) services that relate to learning or employment, within the third-party contractor's
[
internal
] application, if the recommendation is not motivated by payment or other
consideration from another party;
(d) respond to a student request for information or feedback, if the content of the
response is not motivated by payment or other consideration from another party;
(e) use student data to allow or improve operability and functionality of the third-party
contractor's [
internal
] application; or
(f) identify for a student nonprofit institutions of higher education or scholarship
providers that are seeking students who meet specific criteria:
(i) regardless of whether the identified nonprofit institutions of higher education or
scholarship providers provide payment or other consideration to the third-party contractor; and
(ii) except as provided in Subsection (5), only if the third-party contractor obtains
[
written consent
] 
authorization in writing from
:
(A) [
of
] a student's parent [
or legal guardian
] through the student's school or LEA; or
(B) for a student who is age 18 or older or an emancipated minor, [
from
] the student.
(5) A third-party contractor is not required to obtain [
written consent
] 
authorization in
writing
 under Subsection (4)(f)(ii) if the third-party contractor:
(a) is a national assessment provider; and
(b) (i) secures [
the express written consent of
] 
express authorization in writing from
the student or the student's parent; and
(ii) the express [
written consent
] 
authorization in writing
 is given in response to clear
and conspicuous notice that the national assessment provider requests consent solely to provide
access to information on employment, educational scholarships, financial aid, or postsecondary
educational opportunities.
(6) At the completion of a contract with an education entity, if the contract has not
been renewed, a third-party contractor shall return or delete upon the education entity's request
all personally identifiable student data under the control of the education entity unless a student
or the student's parent consents to the maintenance of the personally identifiable student data.
(7) (a) A third-party contractor may not:
(i) except as provided in Subsections (5) and (7)(b), sell student data;
(ii) collect, use, or share student data, if the collection, use, or sharing of the student
data is inconsistent with the third-party contractor's contract with the education entity; or
(iii) use student data for targeted advertising.
(b) A person may obtain student data through the purchase of, merger with, or
otherwise acquiring a third-party contractor if the third-party contractor remains in compliance
with this section.
[
(8) A provider of an electronic store, gateway, marketplace, or other means of
purchasing an external application is not required to ensure that the external application
obtained through the provider complies with this section.
]
[
(9)
] 
(8)
 The provisions of this section do not:
(a) apply to the use of [
an external
] 
a general audience
 application, including the access
of [
an external
] 
a general audience
 application with login credentials created by a third-party
contractor's [
internal
] application;
(b) apply to the providing of Internet service; or
(c) impose a duty on a provider of an interactive computer service, as defined in 47
U.S.C. Sec. 230, to review or enforce compliance with this section.
(9) A provision of this section that relates to a student's student data does not apply to a
third-party contractor if the third-party contractor obtains authorization from the following
individual, in writing, to waive that provision:
(a) the student's parent, if the student is not an adult student; or
(b) the student, if the student is an adult student.
Section 8. Section 
53E-9-310
 is amended to read:
53E-9-310.
Penalties.
(1) (a) A third-party contractor that knowingly or recklessly permits unauthorized
collecting, sharing, or use of student data under this part:
(i) except as provided in Subsection (1)(b), may not enter into a future contract with an
education entity;
(ii) may be required by the board to pay a civil penalty of up to $25,000; and
(iii) may be required to pay:
(A) the education entity's cost of notifying parents and students of the unauthorized
sharing or use of student data; and
(B) expenses incurred by the education entity as a result of the unauthorized sharing or
use of student data.
(b) An education entity may enter into a contract with a third-party contractor that
knowingly or recklessly permitted unauthorized collecting, sharing, or use of student data if:
(i) the board or education entity determines that the third-party contractor has corrected
the errors that caused the unauthorized collecting, sharing, or use of student data; and
(ii) the third-party contractor demonstrates:
(A) if the third-party contractor is under contract with an education entity, current
compliance with this part; or
(B) an ability to comply with the requirements of this part. 
(c) The board may assess the civil penalty described in Subsection (1)(a)(ii) in
accordance with Title 63G, Chapter 4, Administrative Procedures Act.
(d) The board may bring an action in the district court of the county in which the office
of the board is located, if necessary, to enforce payment of the civil penalty described in
Subsection (1)(a)(ii).
(e) An individual who knowingly or intentionally permits unauthorized collecting,
sharing, or use of student data may be found guilty of a class A misdemeanor.
(2) (a) A parent or 
adult
 student may bring an action in a court of competent
jurisdiction for damages caused by a knowing or reckless violation of Section 
53E-9-309
 by a
third-party contractor.
(b) If the court finds that a third-party contractor has violated Section 
53E-9-309
, the
court may award to the parent or student:
(i) damages; and
(ii) costs.
Legislative Review Note
Office of Legislative Research and General Counsel