Utah Code 53E-9-309. Third-party contractors
Current as of: 2024 | Check for updates
|
Other versions
(1) A third-party contractor shall use personally identifiable student data received under a contract with an education entity strictly for the purpose of providing the contracted product or service within the negotiated contract terms.
Terms Used In Utah Code 53E-9-309
- Adult student: means a student who:(1)(a) is at least 18 years old;(1)(b) is an emancipated student; or(1)(c) qualifies under the McKinney-Vento Homeless Education Assistance Improvements Act of 2001, Utah Code 53E-9-301
- Contract: A legal written agreement that becomes binding when signed.
- Education entity: means :
(7)(a) the state board;(7)(b) a local school board;(7)(c) a charter school governing board;(7)(d) a school district;(7)(e) a charter school; or(7)(f) the Utah Schools for the Deaf and the Blind. See Utah Code 53E-9-301- General audience application: means an Internet website, online service, online application, mobile application, or software program that:
(9)(a) is not specifically intended for use by an audience member that attends kindergarten or a grade from 1 to 12, although an audience member may attend kindergarten or a grade from 1 to 12; and(9)(b) is not subject to a contract between an education entity and a third-party contractor. See Utah Code 53E-9-301- LEA: means :
(10)(a) a school district;(10)(b) a charter school; or(10)(c) the Utah Schools for the Deaf and the Blind. See Utah Code 53E-9-301- Parent: means :
(14)(a) a student's parent;(14)(b) a student's legal guardian; or(14)(c) an individual who has written authorization from a student's parent or legal guardian to act as a parent or legal guardian on behalf of the student. See Utah Code 53E-9-301- Person: means :
(24)(a) an individual;(24)(b) an association;(24)(c) an institution;(24)(d) a corporation;(24)(e) a company;(24)(f) a trust;(24)(g) a limited liability company;(24)(h) a partnership;(24)(i) a political subdivision;(24)(j) a government office, department, division, bureau, or other body of government; and(24)(k) any other organization or entity. See Utah Code 68-3-12.5- Personally identifiable student data: includes :
(15)(b)(i) a student's first and last name;(15)(b)(ii) the first and last name of a student's family member;(15)(b)(iii) a student's or a student's family's home or physical address;(15)(b)(iv) a student's email address or other online contact information;(15)(b)(v) a student's telephone number;(15)(b)(vi) a student's social security number;(15)(b)(vii) a student's biometric identifier;(15)(b)(viii) a student's health or disability data;(15)(b)(ix) a student's education entity student identification number;(15)(b)(x) a student's social media user name and password or alias;(15)(b)(xi) if associated with personally identifiable student data, the student's persistent identifier, including:(15)(b)(xi)(A) a customer number held in a cookie; or(15)(b)(xi)(B) a processor serial number;(15)(b)(xii) a combination of a student's last name or photograph with other information that together permits a person to contact the student online;(15)(b)(xiii) information about a student or a student's family that a person collects online and combines with other personally identifiable student data to identify the student; and(15)(b)(xiv) information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. See Utah Code 53E-9-301- State board: means the State Board of Education. See Utah Code 53E-1-102
- Student data: means information about a student at the individual student level. See Utah Code 53E-9-301
- Targeted advertising: means presenting advertisements to a student where the advertisement is selected based on information obtained or inferred over time from that student's online behavior, usage of applications, or student data. See Utah Code 53E-9-301
- Third-party contractor: means a person who:
(20)(a) is not an education entity; and(20)(b) pursuant to a contract with an education entity, collects or receives student data in order to provide a product or service, as described in the contract, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service. See Utah Code 53E-9-301- Writing: includes :
(48)(a) printing;(48)(b) handwriting; and(48)(c) information stored in an electronic or other medium if the information is retrievable in a perceivable format. See Utah Code 68-3-12.5(2) When contracting with a third-party contractor, an education entity, or a government agency contracting on behalf of an education entity, shall require the following provisions in the contract:(2)(a) requirements and restrictions related to the collection, use, storage, or sharing of student data by the third-party contractor that are necessary for the education entity to ensure compliance with the provisions of this part and state board rule;(2)(b) a description of a person, or type of person, including an affiliate of the third-party contractor, with whom the third-party contractor may share student data;(2)(c) provisions that, at the request of the education entity, govern the deletion of the student data received by the third-party contractor;(2)(d) except as provided in Subsection (4) and if required by the education entity, provisions that prohibit the secondary use of personally identifiable student data by the third-party contractor; and(2)(e) an agreement by the third-party contractor that, at the request of the education entity that is a party to the contract, the education entity or the education entity’s designee may audit the third-party contractor to verify compliance with the contract.(3) As authorized by law or court order, a third-party contractor shall share student data as requested by law enforcement.(4) A third-party contractor may:(4)(a) use student data for adaptive learning or customized student learning purposes;(4)(b) market an educational application or product to a parent of a student if the third-party contractor did not use student data, shared by or collected on behalf of an education entity, to market the educational application or product;(4)(c) use a recommendation engine to recommend to a student:(4)(c)(i) content that relates to learning or employment, within the third-party contractor’s application, if the recommendation is not motivated by payment or other consideration from another party; or(4)(c)(ii) services that relate to learning or employment, within the third-party contractor’s application, if the recommendation is not motivated by payment or other consideration from another party;(4)(d) respond to a student request for information or feedback, if the content of the response is not motivated by payment or other consideration from another party;(4)(e) use student data to allow or improve operability and functionality of the third-party contractor’s application; or(4)(f) identify for a student nonprofit institutions of higher education or scholarship providers that are seeking students who meet specific criteria:(4)(f)(i) regardless of whether the identified nonprofit institutions of higher education or scholarship providers provide payment or other consideration to the third-party contractor; and(4)(f)(ii) only if the third-party contractor obtains authorization in writing from:(4)(f)(ii)(A) a student’s parent through the student’s school or LEA; or(4)(f)(ii)(B) for an adult student, the student.(5) At the completion of a contract with an education entity, if the contract has not been renewed, a third-party contractor shall return or delete upon the education entity’s request all personally identifiable student data under the control of the education entity unless a student or the student’s parent consents to the maintenance of the personally identifiable student data.(6)(6)(a) A third-party contractor may not:(6)(a)(i) except as provided in Subsection (6)(b), sell student data;(6)(a)(ii) collect, use, or share student data, if the collection, use, or sharing of the student data is inconsistent with the third-party contractor’s contract with the education entity; or(6)(a)(iii) use student data for targeted advertising.(6)(b) A person may obtain student data through the purchase of, merger with, or otherwise acquiring a third-party contractor if the third-party contractor remains in compliance with this section.(7) The provisions of this section do not:(7)(a) apply to the use of a general audience application, including the access of a general audience application with login credentials created by a third-party contractor’s application;(7)(b) apply if the student data is shared in accordance with the education entity’s directory information policy, as described in 34 C.F.R. § 99.37;(7)(c) apply to the providing of Internet service; or(7)(d) impose a duty on a provider of an interactive computer service, as defined in 47 U.S.C. § 230, to review or enforce compliance with this section.(8) A provision of this section that relates to a student’s student data does not apply to a third-party contractor if the education entity or third-party contractor obtains authorization from the following individual, in writing, to waive that provision:(8)(a) the student’s parent, if the student is not an adult student; or(8)(b) the student, if the student is an adult student.