Utah Code 53E-9-304. Student data ownership and access — Notification in case of significant data breach
Current as of: 2024 | Check for updates
|
Other versions
(1)
Terms Used In Utah Code 53E-9-304
- Adult student: means a student who:(1)(a) is at least 18 years old;(1)(b) is an emancipated student; or(1)(c) qualifies under the McKinney-Vento Homeless Education Assistance Improvements Act of 2001, Utah Code 53E-9-301
- Data breach: means an unauthorized release of or unauthorized access to personally identifiable student data that is maintained by an education entity. See Utah Code 53E-9-301
- Education entity: means :
(7)(a) the state board;(7)(b) a local school board;(7)(c) a charter school governing board;(7)(d) a school district;(7)(e) a charter school; or(7)(f) the Utah Schools for the Deaf and the Blind. See Utah Code 53E-9-301- Parent: means :
(14)(a) a student's parent;(14)(b) a student's legal guardian; or(14)(c) an individual who has written authorization from a student's parent or legal guardian to act as a parent or legal guardian on behalf of the student. See Utah Code 53E-9-301- Personally identifiable student data: includes :
(15)(b)(i) a student's first and last name;(15)(b)(ii) the first and last name of a student's family member;(15)(b)(iii) a student's or a student's family's home or physical address;(15)(b)(iv) a student's email address or other online contact information;(15)(b)(v) a student's telephone number;(15)(b)(vi) a student's social security number;(15)(b)(vii) a student's biometric identifier;(15)(b)(viii) a student's health or disability data;(15)(b)(ix) a student's education entity student identification number;(15)(b)(x) a student's social media user name and password or alias;(15)(b)(xi) if associated with personally identifiable student data, the student's persistent identifier, including:(15)(b)(xi)(A) a customer number held in a cookie; or(15)(b)(xi)(B) a processor serial number;(15)(b)(xii) a combination of a student's last name or photograph with other information that together permits a person to contact the student online;(15)(b)(xiii) information about a student or a student's family that a person collects online and combines with other personally identifiable student data to identify the student; and(15)(b)(xiv) information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. See Utah Code 53E-9-301- State board: means the State Board of Education. See Utah Code 53E-1-102
- Student data: means information about a student at the individual student level. See Utah Code 53E-9-301
(1)(a) A student owns the student’s personally identifiable student data.(1)(b) An education entity shall allow the following individuals to access a student’s student data that is maintained by the education entity:(1)(b)(i) the student’s parent;(1)(b)(ii) the student; and(1)(b)(iii) in accordance with the education entity’s internal policy described in Section 53E-9-303 and in the absence of a parent, an individual acting as a parent to the student.(2)(2)(a) If a significant data breach occurs at an education entity, the education entity shall notify:(2)(a)(i) the student, if the student is an adult student; or(2)(a)(ii) the student’s parent, if the student is not an adult student.(2)(b) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the state board shall make rules to define a significant data breach described in Subsection (2)(a).