2016 Colorado Revised Statutes
Title 22 - Education
General and Administrative
Article 16 - Student Data Transparency and Security
§ 22-16-108. School service contract provider - data transparency

(1) Each school service contract provider shall provide clear information that is understandable by a layperson explaining the data elements of student personally identifiable information that the school service contract provider collects, the learning purpose for which the school service contract provider collects the student personally identifiable information, and how the school service contract provider uses and shares the student personally identifiable information. The information must include all student personally identifiable information that the school service contract provider collects regardless of whether it is initially collected or ultimately held individually or in the aggregate. The school service contract provider shall provide the information to each public education entity that the school service contract provider contracts with in a format that is easily accessible through a website, and the public education entity shall post the information on its website. The school service contract provider shall update the information as necessary to maintain accuracy.

(2) Each school service contract provider shall provide clear notice to each public education entity that it contracts with before making material changes to its privacy policy for school services.

(3) Each school service contract provider shall facilitate access to and correction of any factually inaccurate student personally identifiable information by a contracting local education provider in response to a request for correction that the local education provider receives and responds to in accordance with section 22-16-112 (1) (c).

(4) Upon discovering the misuse or unauthorized release of student personally identifiable information held by the contract provider, a subcontractor of the contract provider, or a subsequent subcontractor, the contract provider shall notify the contracting public education entity as soon as possible, regardless of whether the misuse or unauthorized release is a result of a material breach of the terms of the contract.