2015 Utah Code
Title 53A - State System of Public Education
Chapter 1 - Administration of Public Education at the State Level
Part 7 - Educational Technology Programs
Section 711 - State Board of Education student privacy study -- Chief privacy officer.

Effective 5/12/2015
53A-1-711. State Board of Education student privacy study -- Chief privacy officer.

• (1) For purposes of this section:
  • (a) "Board" means the State Board of Education.
  • (b) "Chief privacy officer" means the chief privacy officer designated by the board in Subsection (4).
  • (c) "Education entity" means:
    • (i) the board;
    • (ii) a local school board or charter school governing board;
    • (iii) a school district;
    • (iv) a public school; or
    • (v) the Utah Schools for the Deaf and the Blind.
  • (d) "Third party service provider" means a person, other than an education entity, that:
    • (i) enters into a contract or written agreement with an education entity to provide a service or product; and
    • (ii) receives student data from the education entity pursuant to the contract or written agreement.

• (2)
  • (a) The board shall develop a funding proposal and make recommendations to the Legislature on how the board and the Legislature can update student privacy laws in statute and in board rule.
  • (b) The board shall consider input from education entities, parents, and other stakeholders as the board develops the funding proposal and recommendations described in Subsection (2)(a).

• (3) The board shall consider the following issues as the board develops the funding proposal and recommendations described in Subsection (2)(a):
  • (a) how an education entity can better maintain, secure, and safeguard student data, including using industry best practices to maintain, secure, and safeguard the student data;
  • (b) how to provide disclosures to parents and students on how student data will be collected, maintained, and used;
  • (c) the process to release student data to an education entity or to a person, including to the following:
    • (i) another education entity;
    • (ii) a government entity:
      • (A) within the state; or
      • (B) outside of the state; and
    • (iii) a private third party;
  • (d) how to allow a student to expunge the student's data;
  • (e) how to manage a contract with a third party service provider to ensure that a contract entered into between an education entity and a third party service provider includes:
    • (i) provisions requiring specific restrictions on the use of student data;
    • (ii) specific dates governing the destruction of student data given to a third party service provider;
    • (iii) provisions that prohibit a third party service provider from using personally identifiable information for a secondary use, including sales, marketing, or advertising;
    • (iv) provisions limiting a third party service provider's use of student data strictly for the purpose of providing services to the education entity; and
    • (v) provisions requiring a third party service provider to maintain, secure, and safeguard all student data by using industry best practices to maintain, secure, and safeguard the student data; and
  • (f) the penalties for:
    • (i) an unauthorized release of student data; or
    • (ii) failing to maintain, secure, and safeguard student data.

• (4)
  • (a) The board shall designate a chief privacy officer.
  • (b) The chief privacy officer shall:
    • (i) oversee the administration of student privacy laws; and
    • (ii) work with the board to develop the funding proposal and recommendations described in Subsection (2)(a).

• (5) On or before January 31, 2016, the board and the chief privacy officer shall present the funding proposal and recommendations described in Subsection (2)(a) to the Public Education Appropriations Subcommittee.

Enacted by Chapter 384, 2015 General Session

Technically renumbered to avoid duplication of section number also used in SB222, Chapter 446.