EdLaw
Nevada — school service providers (NRS 388.281 to 388.296)
Nevada's operator statute, which binds the school service provider directly: the definitions of school service and targeted advertising, the written disclosure and notice duties, the limits on collection, use and transfer of personally identifiable information with the civil penalty for violating them, the data security plan and breach notice, the aggregated-data exception, and the bar on waiving any of it by contract.
NRS 388.281 Definitions.
As used in NRS 388.281 to 388.296, inclusive, unless the context otherwise requires, the words and terms defined in NRS 388.282 to 388.285, inclusive, have the meanings ascribed to them in those sections.
NRS 388.282 “Personally identifiable information” defined.
“Personally identifiable information” has the meaning ascribed to it in 34 C.F.R. § 99.3.
NRS 388.283 “School service” defined.
- (a) Collects or maintains personally identifiable information concerning a pupil;
- (b) Is used primarily for educational purposes; and
- (c) Is designed and marketed for use in public schools and is used at the direction of teachers and other educational personnel.
- (a) An Internet website, online service or mobile application that is designed or marketed for use by a general audience, even if the school service is also marketed to public schools;
- (b) An internal database, system or program maintained or operated by a school district, charter school or university school for profoundly gifted pupils;
- (c) A school service for which a school service provider has:
- (1) Been designated by a school district, the sponsor of a charter school, the governing body of a university school for profoundly gifted pupils or the Department as a school official pursuant to the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g;
- (2) Entered into a contract with the school district, the sponsor of a charter school, the governing body of a university school for profoundly gifted pupils or the Department; and
- (3) Agreed to comply with and be subject to the provisions of the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g, relating to personally identifiable information;
- (d) Any examinations administered pursuant to NRS 390.105 or the college and career readiness assessment administered pursuant to NRS 390.610; or
- (e) Any instructional programs purchased by a school district, a charter school, the governing body of a university school for profoundly gifted pupils or the Department.
NRS 388.284 “School service provider” defined.
“School service provider” means a person that operates a school service, to the extent the provider is operating in that capacity.
NRS 388.285 “Targeted advertising” defined.
“Targeted advertising” means presenting advertisements to a pupil where the advertisement is selected based on information obtained or inferred from the online behavior of a pupil, the use of applications by a pupil or personally identifiable information concerning a pupil. The term does not include advertising to a pupil at an online location based upon the current visit to the location by the pupil or a single search query without the collection and retention of the online activities of a pupil over time.
NRS 388.291 School service provider to provide written disclosure to certain persons and entities; notice of changes to plan for security of data concerning pupils; review and correction of personally identifiable information.
- Before the persons or governmental entities described in subsection 3 begin using a school service, a school service provider must provide a written disclosure to such persons or governmental entities in language that is easy to understand, which includes, without limitation:
- (a) The types of personally identifiable information collected by the school service provider and the manner in which such information is used; and
- (b) A description of the plan for the security of data concerning pupils which has been established by the school service provider pursuant to NRS 388.293.
- Before a school service provider makes a material change to the plan for the security of data concerning pupils established pursuant to NRS 388.293, the school service provider must provide notice to the persons or governmental entities set forth in subsection 3.
- The disclosure or notice provided pursuant to subsection 1 or 2, as applicable, must be provided to:
- (a) The board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, that uses the school service of the school service provider; and
- (b) Any teacher who uses the school service.
- (a) Allow a pupil who is at least 18 years of age and the parent or legal guardian of any pupil to review personally identifiable information concerning the pupil that is maintained by the school service provider; and
- (b) Establish a process, in accordance with any contract governing the activities of a school service provider and which is consistent with the provisions of NRS 388.281 to 388.296, inclusive, for the correction of such information upon the request of:
- (1) A pupil who is at least 18 years of age or the parent or legal guardian of any pupil; or
- (2) The teacher of the pupil or the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable.
NRS 388.292 Collection and uses of personally identifiable information by school service provider; limitations; requirements for transfer or disclosure of personally identifiable information; redaction of personally identifiable information upon request; penalty for violation of provisions.
- Except as otherwise provided in subsections 2 and 5, a school service provider may collect, use, allow access to or transfer personally identifiable information concerning a pupil only:
- (a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;
- (b) If required by federal or state law;
- (c) In response to a subpoena issued by a court of competent jurisdiction;
- (d) To protect the safety of a user of the school service; or
- (e) With the consent of any person required in a policy of the school district, charter school or university school for profoundly gifted pupils, as applicable, or, if none, with the consent of the pupil, if the pupil is at least 18 years of age, or the parent or legal guardian of the pupil if the pupil is less than 18 years of age.
- A school service provider may transfer personally identifiable information concerning a pupil to a third-party service provider if the school service provider provides notice to any person designated in a policy of the school district, charter school or university school for profoundly gifted pupils, as applicable, to receive such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:
- (a) Contractually prohibits the third-party service provider from using any such information for any purpose other than providing the contracted school services to, or on behalf of, the school service provider;
- (b) Prohibits the third-party service provider from disclosing any personally identifiable information concerning a pupil unless the disclosure is authorized pursuant to subsection 1; and
- (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive.
- A school service provider shall delete any personally identifiable information concerning a pupil that is collected or maintained by the school service provider and that is under the control of the school service provider within a reasonable time not to exceed 30 days after receiving a request from the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable. The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review such information and request that such information about the pupil be deleted. The school service provider shall delete such information upon the request of the parent or legal guardian of a pupil if no such policy exists.
- Any agreement entered into by a school service provider that provides for the disclosure of personally identifiable information must require that the person or governmental entity to whom the information will be disclosed abide by the requirements imposed pursuant to this section.
- A school service provider shall not:
- (a) Use personally identifiable information to engage in targeted advertising within the school service or on any other Internet website, online service or mobile application if the targeted advertising is based upon any information acquired from use of the school service.
- (b) Except as otherwise provided in this paragraph, sell personally identifiable information concerning a pupil. A school service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.
- (c) Use personally identifiable information concerning a pupil to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.
- (d) Use personally identifiable information concerning a pupil in a manner that is inconsistent with any contract governing the activities of the school service provider for the school service in effect at the time the information is collected or in a manner that violates any of the provisions of NRS 388.281 to 388.296, inclusive.
- (e) Knowingly retain, without the consent of the appropriate person described in paragraph (e) of subsection 1, personally identifiable information concerning a pupil beyond the period authorized by the contract governing the activities of the school service provider.
- This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or maintained by a school service provider for the purposes of:
- (a) Adaptive learning or providing personalized or customized education;
- (b) Maintaining or improving the school service;
- (c) Recommending additional content or services within a school service;
- (d) Responding to a request for information by a pupil;
- (e) Soliciting feedback regarding a school service;
- (f) Performing research which:
- (1) Is required by federal or state law; or
- (2) Is authorized by federal or state law, is performed under the direction of a public school, school district or the Department and does not use any personally identifiable information concerning a pupil for any purpose relating to advertising or creating a profile of the pupil for any purpose not related to the instruction of the pupil; or
- (g) Allowing a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to download, transfer, or otherwise maintain data concerning a pupil.
- A school service provider that violates the provisions of this section is subject to a civil penalty in an amount not to exceed $5,000 per violation. The Attorney General may recover the penalty in a civil action brought in the name of the State of Nevada in any court of competent jurisdiction.
NRS 388.293 Plan for security of data concerning pupils; successor entities of school service providers; notice of security breach.
- A school service provider shall establish and carry out a detailed plan for the security of any data concerning pupils that is collected or maintained by the school service provider. The plan must include, without limitation:
- (a) Procedures for protecting the security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil; and
- (b) Appropriate administrative, technological and physical safeguards to ensure the security of data concerning pupils.
- A school service provider shall ensure that any successor entity understands that it is subject to the provisions of NRS 388.281 to 388.296, inclusive, and agrees to abide by all privacy and security commitments related to personally identifiable information concerning a pupil collected and maintained by the school service provider before allowing a successor entity to access such personally identifiable information.
- A school service provider shall provide notice to a school district, charter school or university school for profoundly gifted pupils, as applicable, or a private school pursuant to NRS 394.1616, of any breach of the security of the system data in violation of the plan and any actions taken or being taken by the school service provider to address the breach. The notice must be provided as soon as practicable and without unreasonable delay.
- A school district, charter school, university school for profoundly gifted pupils or private school that receives a notice pursuant to subsection 3 shall provide the notice to each pupil affected by the breach or, if a pupil is less than 18 years of age, the parent or legal guardian of the pupil. The notice must be provided as soon as practicable and without unreasonable delay.
- As used in this section, “breach of the security of the system data” means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of data concerning pupils that is collected or maintained by the school service provider. The term does not include the good faith acquisition of data concerning pupils by an employee or agent of the school service provider for a legitimate purpose of the school service provider, so long as the data is not used for a purpose unrelated to the school service provider or subject to further unauthorized disclosure.
NRS 388.294 Professional development regarding use of school service providers and security of data concerning pupils.
- Each school district and the governing body of a charter school or a university school for profoundly gifted pupils, as applicable, shall annually provide professional development regarding the use of school service providers and the security of data concerning pupils.
- Teachers and other licensed educational personnel employed by a school district, charter school or university school for profoundly gifted pupils shall complete the professional development provided pursuant to subsection 1.
NRS 388.295 School service provider authorized to use and disclose certain aggregated information to develop, improve or demonstrate effectiveness of products or services.
A school service provider may use and disclose information derived from personally identifiable information concerning a pupil to demonstrate the effectiveness of the products or services of the school service provider, including, without limitation, for use in advertising or marketing regarding the school service, and to develop and improve a school service or any other Internet website, online service or mobile application of the school service provider so long as the information is aggregated or is presented in a manner which does not disclose the identity of the pupil about whom the information relates.
NRS 388.2955 Duty of public school to provide information concerning school service providers and data security.
- Before a public school, including, without limitation, a charter school and a university school for profoundly gifted pupils, allows a pupil to use any school service or provides a pupil with any technology, the public school must post on the Internet website of the public school information that:
- (a) Summarizes the laws governing school service providers set forth in this section and NRS 388.281 to 388.296, inclusive;
- (b) Lists each school service provider for the school;
- (c) Confirms that each such school service provider for the school has created a plan for the security of any data concerning pupils, including, without limitation, covered information and personally identifiable information pursuant to NRS 388.293 and informs about the circumstances under which notification will be provided pursuant to that section if a breach of the security of the system data is discovered;
- (d) Describes any other actions taken by the public school, the school district or the governing body of the charter school or university school for profoundly gifted pupils, as applicable, to protect the security of any data collected by a school service provider, including, without limitation, covered information and personally identifiable information, concerning pupils; and
- (e) Describes the manner in which a pupil or the parent or legal guardian of a pupil may report any suspicious activity relating to the use of a school service by a pupil.
- At the beginning of each school year, each public school, including, without limitation, a charter school and a university school for profoundly gifted pupils, shall communicate to the pupils enrolled at the school and the parents and legal guardians of such pupils the availability of the information described in subsection 1 and the manner in which to locate the information.
- As used in this section:
- (a) “Covered information” means the personally identifiable information of a pupil or any information that is linked to the personally identifiable information of a pupil which is:
- (1) Created by or provided to a school service provider by a pupil or the parent or legal guardian of a pupil through the use of a school service;
- (2) Created by or provided to a school service provider by an employee of a public school, a school district or the governing body of a charter school; or
- (3) Gathered by a school service provider from any other source and associated with the identity of a pupil.
- (b) “Personally identifiable information” has the meaning ascribed to it in 34 C.F.R. § 99.3.
- (c) “School service” has the meaning ascribed to it in NRS 388.283.
- (d) “School service provider” has the meaning ascribed to it in NRS 388.284.
NRS 388.296 Waiver or modification of any right, obligation or liability of provisions prohibited.
A person or governmental entity may not waive or modify any right, obligation or liability set forth in NRS 388.281 to 388.296, inclusive. Any condition, stipulation or provision in a contract which seeks to do so or which in any way conflicts with the provisions of NRS 388.281 to 388.296, inclusive, is against public policy and is void and unenforceable.
Sources
- Nevada Legislature — NRS chapter 388, System of Public Instruction, part "Privacy of Data Concerning Pupils", subheading "School Service Providers" — reached through the Internet Archive capture 20261006034857
- Extracted-text SHA-256:
b68e332a4a59d97758a2b2482e99e9f28650118f64d4376f0c9e51a7940437bb