language: en · status: in-force · last checked: 2026-10-08

Idaho — student data: use and limitations (Idaho Code §33-133)

Idaho's single student-data section, added by 2014 Idaho Sess. Laws ch. 281 and not amended since (its history line reads "[33-133, added 2014, ch. 281, sec. 3, p. 711.]"). Chapter 281 is Senate Bill 1372, whose section 4 declares an emergency so that the act is "in full force and effect on and after its passage and approval"; the Governor signed it on 26 March 2014, its effective date. It is addressed to the state board of education, the state department of education and school districts, and reaches vendors through mandatory contract terms and a civil penalty that applies to "any person".

Applicability to EdTech

• Mandatory contract clauses for private vendors. Districts and schools contracting for "databases, online services, assessments, special education or instructional supports with private vendors" must include a provision that vendors may use aggregated data, or an individual student's data for secondary uses only with clear disclosure and written parental permission, plus either a prohibition on secondary uses (sales, marketing or advertising) or the alternative the paragraph sets out (§33-133(3)(b)(vi)).
• Board and department contracts that outsource student data to private vendors must "include express provisions that safeguard privacy and security", carry the same secondary-use restrictions, provide for data destruction with a time frame, and include penalties for noncompliance (§33-133(3)(f)).
• Vendor compliance and a $50,000 civil penalty. The closing paragraph of §33-133(3)(b) requires the board and department to ensure their private vendors comply, and makes "Any person" found to have violated the section liable for a civil penalty not to exceed $50,000 per violation, in a civil enforcement action by the board or department or "in a court action initiated by an injured party" (§33-133(3)(b), unnumbered closing paragraph).
• Biometric records are personally identifiable data (§33-133(1)(h)).
• Access is limited to vendors who need it: access to the student data system is restricted to, among others, the board's, department's and district's vendors "who require such access to perform their assigned duties" (§33-133(3)(b)(i)).

Contents

Key obligations at a glance

• District contracts with private vendors carry the secondary-use clause — §33-133(3)(b)(vi).
• Board/department outsourcing contracts: privacy and security provisions, data destruction with a time frame, penalties — §33-133(3)(f).
• Board/department may share data with a vendor only to the extent necessary under the contract — §33-133(3)(c)(iv).
• Detailed data security plan including breach planning and notification — §33-133(3)(d).
• Each district and public charter school adopts and posts the board's model policy — §33-133(7).

Enforcement

A civil penalty not to exceed $50,000 per violation, in a civil enforcement action initiated by the board or department or a court action initiated by an injured party; unauthorized release of personally identifiable student data triggers notice to the parent or student consistent with Idaho Code §28-51-105 (§33-133(3)(b), closing paragraph). A district or charter school that fails to adopt, implement and post the model policy where an inappropriate release occurs is separately liable (§33-133(7)).

Licence

The corpus reproduces Idaho Code §33-133 verbatim from the Idaho Legislature's statute page (through the Internet Archive's id_ endpoint, which returns the publisher's original bytes), with its history line.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The statute page ends with the footer "© 2026 Idaho State Legislature." (legislature.idaho.gov — §33-133, read 2026-10-08 through the Internet Archive). A site-wide footer of that kind can cover the site, but not the statutes the Legislature enacts.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• Kansas Student Data Privacy Act — the same 2014 model, binding districts and their service providers
• North Dakota N.D.C.C. §15.1-07-25.3 — a district-policy-only regime
• FERPA — the federal regime the section requires compliance with

Sources

• Idaho Legislature — Idaho Code §33-133
• Idaho Legislature — 2014 Senate Bill 1372, bill status — "Signed by Governor on 03/26/14 Session Law Chapter 281 Effective: 03/26/2014" (read through the Internet Archive capture of 31 January 2017)
• Idaho Legislature — Senate Bill 1372, as amended (PDF) — section 3 adds §33-133; section 4: "An emergency existing therefor, which emergency is hereby declared to exist, this act shall be in full force and effect on and after its passage and approval." (read through the Internet Archive)