EdLaw
Kentucky — KRS 365.734 (student data; cloud computing service providers)
Created by 2014 Ky. Acts ch. 84, effective 15 July 2014. A short statute that binds the cloud computing service provider rather than the school: it limits what a provider may do with student data, prohibits advertising and profiling uses outright, and requires the provider to certify its compliance in writing to the educational institution.
Applicability to EdTech
This is one of the most directly applicable instruments in the US portion of the corpus, because both defined terms describe us:
- A "cloud computing service" is "a service that provides, and that is marketed and designed to provide, an educational institution with account-based access to online computing resources", and a "cloud computing service provider" is any person other than an educational institution that operates one (§365.734(1)(a)–(b)). An "educational institution" is any public, private or school administrative unit serving K–12 students.
- "Process" is defined expansively — "to use, access, collect, manipulate, scan, modify, analyze, transform, disclose, store, transmit, aggregate, or dispose of student data" (§365.734(1)(e)). Scan and analyze are named, so automated processing is squarely covered.
- "Student data" includes photos and unique identifiers and covers data created by the student or by an employee or agent of the institution in connection with the service (§365.734(1)(f)).
- The purpose limitation is narrow: processing is confined to "providing, improving, developing, or maintaining the integrity of its cloud computing services" — anything else needs express permission from the student's parent, not the school's (§365.734(2)). That is a stricter consent route than the school-consent model most state statutes use, and it is worth noting where a product's terms rely on district authorisation.
- Three absolute prohibitions, which no permission cures: processing student data to advertise or facilitate advertising; creating or correcting an individual or household profile for any advertising purpose; and selling, disclosing or otherwise processing student data for any commercial purpose (§365.734(2)).
- A written certification is required, not merely available: a provider entering an agreement to supply cloud computing services to an educational institution "shall certify in writing to the educational institution that it will comply with subsection (2)" (§365.734(3)). This is a concrete deliverable per Kentucky customer.
- FERPA-permitted educational research assistance is expressly preserved (§365.734(2)).
Contents
| Document | Covers |
|---|---|
| STUDENT-DATA.md | §365.734 in full |
Key obligations at a glance
- Process student data only to provide, improve, develop or maintain the integrity of the service, absent express parental permission — §365.734(2).
- Never process student data for advertising, advertising profiles, or any commercial purpose — §365.734(2).
- Certify compliance in writing to the educational institution on entering the agreement — §365.734(3).
Enforcement
The section sets no penalty and creates no private right of action; it sits in KRS Chapter 365 (Trade Practices). It authorises the Kentucky Board of Education to promulgate administrative regulations under KRS Chapter 13A to carry out its requirements (§365.734(4)); those regulations are not extracted in this corpus — collect them if a Kentucky district question lands.
Licence
The corpus reproduces KRS 365.734 verbatim from the Kentucky Legislative Research Commission's per-section PDFs.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
The per-section PDFs carry no copyright notice. The statutes pages (apps.legislature.ky.gov/law/statutes, read 2026-10-01) end with the footer "Copyright Kentucky Legislative Research Commission All rights Reserved". That footer can cover the site, but not the statutes the General Assembly enacts. The "Effective" and "History" lines, and any "Legislative Research Commission Note", are the work of the Legislative Research Commission, the General Assembly's own agency, made in the course of its legislative duties, which is the situation Georgia v. Public.Resource.Org held to be outside copyright.
Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).
Related
- Kentucky personal information security (KRS 61.931–61.933) — the companion regime, which reaches suppliers of a school district as "nonaffiliated third parties"
- California SOPIPA — the operator-binding model most states followed
- Texas Education Code Subchapter D — the closest analogue, with school-purpose framing instead of cloud-service framing
- FERPA — the federal layer whose research exception this section preserves