EdLaw
Utah — Student Data Protection (Utah Code §§53E-9-301 to 53E-9-311)
Part 3 of Utah's Student Privacy and Data Protection chapter, in full: the definitions, state and local data governance, ownership and breach notification, collection limits, use and expungement, security, sharing, the duties of third-party contractors and the contract terms an education entity must require, penalties, and disclosure of educational data.
Utah Code §53E-9-301. Definitions
- (1) "Adult student" means a student who:
- (2) "Aggregate data" means data that:
- (3)
- (4) "Biometric information" means information, regardless of how the information is collected, converted, stored, or shared:
- (5) "Data breach" means an unauthorized release of or unauthorized access to personally identifiable student data that is maintained by an education entity.
- (6) "Data governance plan" means an education entity's comprehensive plan for managing education data that:
- (a) incorporates reasonable data industry best practices to maintain and protect student data and other education-related data;
- (b) describes the role, responsibility, and authority of an education entity data governance staff member;
- (c) provides for necessary technical assistance, training, support, and auditing;
- (d) describes the process for sharing student data between an education entity and another person;
- (e) describes the education entity's data expungement process, including how to respond to requests for expungement;
- (f) describes the data breach response process; and
- (g) is published annually and available on the education entity's website.
- (7) "Education entity" means:
- (8) "Expunge" means to seal or permanently delete data, as described in state board rule made in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, under Section 53E-9-306.
- (9) "General audience application" means an Internet website, online service, online application, mobile application, or software program that:
- (10) "Local education agency" or "LEA" means:
- (11) "Metadata dictionary" means a record that:
- (a) defines and discloses all personally identifiable student data collected and shared by the education entity;
- (b) comprehensively lists all recipients with whom the education entity has shared personally identifiable student data, including:
- (c) without disclosing personally identifiable student data, is displayed on the education entity's website.
- (12) "Necessary student data" means data required by state statute or federal law to conduct the regular activities of an education entity, including:
- (a) name;
- (b) date of birth;
- (c) sex;
- (d) parent contact information;
- (e) custodial parent information;
- (f) contact information;
- (g) a student identification number;
- (h) local, state, and national assessment results or an exception from taking a local, state, or national assessment;
- (i) courses taken and completed, credits earned, and other transcript information;
- (j) course grades and grade point average;
- (k) grade level and expected graduation date or graduation cohort;
- (l) degree, diploma, credential attainment, and other school exit information;
- (m) attendance and mobility;
- (n) drop-out data;
- (o) immunization record or an exception from an immunization record;
- (p) race;
- (q) ethnicity;
- (r) tribal affiliation;
- (s) remediation efforts;
- (t) an exception from a vision screening required under Section 53G-9-404 or information collected from a vision screening described in Section 53G-9-404;
- (u) information related to the Utah Registry of Autism and Developmental Disabilities, described in Section 26B-7-115;
- (v) student injury information;
- (w) a disciplinary record created and maintained as described in Section 53E-9-306;
- (x) juvenile delinquency records;
- (y) English language learner status; and
- (z) child find and special education evaluation data related to initiation of an IEP.
- (13)
- (14) "Parent" means:
- (15)
- (a) "Personally identifiable student data" means student data that identifies or is used by the holder to identify a student.
- (b) "Personally identifiable student data" includes:
- (i) a student's first and last name;
- (ii) the first and last name of a student's family member;
- (iii) a student's or a student's family's home or physical address;
- (iv) a student's email address or other online contact information;
- (v) a student's telephone number;
- (vi) a student's social security number;
- (vii) a student's biometric identifier;
- (viii) a student's health or disability data;
- (ix) a student's education entity student identification number;
- (x) a student's social media user name and password or alias;
- (xi) if associated with personally identifiable student data, the student's persistent identifier, including:
- (xii) a combination of a student's last name or photograph with other information that together permits a person to contact the student online;
- (xiii) information about a student or a student's family that a person collects online and combines with other personally identifiable student data to identify the student; and
- (xiv) information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.
- (16) "School official" means an employee or agent of an education entity, if the education entity has authorized the employee or agent to request or receive student data on behalf of the education entity.
- (17)
- (18) "Student data manager" means:
- (19)
- (a) "Targeted advertising" means presenting advertisements to a student where the advertisement is selected based on information obtained or inferred over time from that student's online behavior, usage of applications, or student data.
- (b) "Targeted advertising" does not include advertising to a student:
- (20) "Third-party contractor" means a person who:
- (a) is not an education entity; and
- (b) in accordance with a contract with an education entity, collects or receives student data in order to provide a product or service, as described in the contract, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service.
- (21) "Threat assessment information" means data related to a credible threat made by a student that has been evaluated through a threat assessment process and determined to pose a potential risk to school safety, including threats of violence against students, school personnel, or school property.
- (22) "Written consent" means written authorization to collect or share a student's student data, from:
Utah Code §53E-9-302. State student data protection governance
- (1)
- (a) An education entity or a third-party contractor who collects, uses, stores, shares, or deletes student data shall protect student data as described in this part.
- (b) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the state board shall make rules to administer this part, including student data protection standards for public education employees, student aides, and volunteers.
- (2) The state board shall oversee the preparation and maintenance of:
- (3)
- (a) The state board shall establish a student data protection advisory group to oversee student data protection in the state.
- (b) The student data protection advisory group shall be composed of:
- (c) The student data protection advisory group shall:
- (4)
- (a) The state board shall designate a state student data officer.
- (b) The state student data officer shall:
- (i) act as the primary point of contact for state student data protection administration in assisting the state board to administer this part;
- (ii) ensure compliance with student privacy laws throughout the public education system, including:
- (iii) investigate complaints of alleged violations of this part;
- (iv) report violations of this part to:
- (v) act as a state level student data manager.
- (5) The state board shall designate:
- (6) The state board shall establish a research review process for a request for data for the purpose of research or evaluation.
Utah Code §53E-9-303. Local student data protection governance
- (1) An LEA shall adopt policies to protect student data in accordance with this part and state board rule, taking into account the specific needs and priorities of the LEA.
- (2)
- (3) An LEA shall create and maintain an LEA:
- (4) An LEA shall establish an external research review process for a request for data for the purpose of external research or evaluation.
Utah Code §53E-9-304. Student data ownership and access -- Notification in case of significant data breach
- (1)
- (2)
Utah Code §53E-9-305. Collecting student data -- Prohibition -- Student data collection notice -- Written consent
- (1) An education entity may not collect a student's:
- (2) Except as provided in Subsection (3), an education entity that collects student data shall, in accordance with this section, prepare and distribute to parents and students a student data collection notice statement that:
- (a) is a prominent, stand-alone document;
- (b) is annually updated and published on the education entity's website;
- (c) states the student data that the education entity collects;
- (d) states that the education entity will not collect the student data described in Subsection (1);
- (e) states the student data described in Section 53E-9-308 that the education entity may not share without written consent;
- (f) includes the following statement:"The collection, use, and sharing of student data has both benefits and risks. Parents and students should learn about these benefits and risks and make choices regarding student data accordingly.";
- (g) describes in general terms how the education entity stores and protects student data; and
- (h) states a student's rights under this part.
- (3) The state board may publicly post the state board's collection notice described in Subsection (2).
- (4) An education entity may collect the necessary student data of a student if the education entity provides a student data collection notice to:
- (5) An education entity may collect optional student data if the education entity:
- (6) An education entity may collect a student's biometric identifier or biometric information if the education entity:
- (a) provides, to an individual described in Subsection (4), a biometric information collection notice that is separate from a student data collection notice, which states:
- (b) obtains written consent to collect the biometric identifier or biometric information from an individual described in Subsection (4).
- (7) Except under the circumstances described in Subsection 53G-8-211(2), an education entity may not refer a student to an evidence-based alternative intervention described in Section 53G-8-211 without written consent.
- (8) Nothing in this section prohibits an education entity from including additional information related to student and parent privacy in the notice described in Subsection (2).
- (9) Notwithstanding any other provision of this section, an education entity may collect and share threat assessment information as authorized under Section 53G-8-807 without obtaining written consent if:
- (a) the collection and sharing is necessary to protect the safety of a student, school personnel, or school property;
- (b) the information is shared only with authorized personnel as described in Section 53G-8-807; and
- (c) the education entity complies with all procedural requirements in Section 53G-8-807.
Utah Code §53E-9-306. Using and expunging student data -- Rulemaking -- Disciplinary records
- (1) In accordance with Title 63G, Chapter 2, Government Records Access and Management Act, and Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the state board shall make rules regarding using and expunging student data, including:
- (a) a categorization of disciplinary records that includes the following levels of maintenance:
- (b) the types of student data that may be expunged, including:
- (c) the types of student data that may not be expunged, including:
- (d) the timeline and process for a prior student or parent of a prior student to request that an education entity expunge all of the prior student's student data.
- (2) In accordance with state board rule, an education entity may create and maintain a disciplinary record for a student.
- (3)
- (a) As recognized in Section 53E-9-304, and to ensure maximum student data privacy, an education entity shall, in accordance with state board rule, expunge a student's student data that is stored by the education entity.
- (b) An education entity shall retain and dispose of records in accordance with Section 63G-2-604 and state board rule.
Utah Code §53E-9-307. Securing and cataloguing student data
Title 63G, Chapter 3, Utah Administrative Rulemaking Act
- (1) using reasonable data industry best practices, prescribe the maintenance and protection of stored student data by:
- (2) state requirements for an education entity's metadata dictionary.
Utah Code §53E-9-308. Sharing student data -- Prohibition -- Requirements for student data manager -- Authorized student data sharing
- (1)
- (2) A student data manager shall:
- (a) authorize and manage the sharing, outside of the student data manager's education entity, of personally identifiable student data for the education entity as described in this section;
- (b) act as the primary local point of contact for the state student data officer described in Section 53E-9-302; and
- (c) fulfill other responsibilities described in the data governance plan of the student data manager's education entity.
- (3) A student data manager may share a student's personally identifiable student data with a caseworker or representative of the Department of Health and Human Services if:
- (4) The Department of Health and Human Services, a school official, or the Utah Juvenile Court may share personally identifiable student data to improve education outcomes for youth:
- (a) in the custody of, or under the guardianship of, the Department of Health and Human Services;
- (b) receiving services from the Division of Juvenile Justice and Youth Services;
- (c) in the custody of the Division of Child and Family Services;
- (d) receiving services from the Division of Services for People with Disabilities; or
- (e) under the jurisdiction of the Utah Juvenile Court.
- (5)
- (a) A student data manager may share personally identifiable student data in response to a subpoena issued by a court.
- (b) A person who receives personally identifiable student data under Subsection (5)(a) may not use the personally identifiable student data outside of the use described in the subpoena.
- (6)
- (a) A student data manager may share student data, including personally identifiable student data, in response to a request to share student data for the purpose of research or evaluation, if the student data manager:
- (b)
- (i) In accordance with state and federal law, and subject to Subsection (6)(b)(ii), the state board shall share student data, including personally identifiable student data, as requested by the Utah Registry of Autism and Developmental Disabilities described in Section 26B-7-115.
- (ii)
- (A) At least 30 days before the state board shares student data in accordance with Subsection (6)(b)(i), the education entity from which the state board received the student data shall provide notice to the parent of each student for which the state board intends to share student data.
- (B) The state board may not, for a particular student, share student data as described in Subsection (6)(b)(i) if the student's parent requests that the state board not share the student data.
- (iii) A person who receives student data under Subsection (6)(b)(i):
- (7) A student data manager may share threat assessment information described in Section 53G-8-807 if:
Utah Code §53E-9-309. Third-party contractors
- (1) A third-party contractor shall use personally identifiable student data received under a contract with an education entity strictly for the purpose of providing the contracted product or service within the negotiated contract terms.
- (2)
- (a) When contracting with a third-party contractor, an education entity, or a government agency contracting on behalf of an education entity, shall:
- (i) require the following provisions in the contract:
- (A) requirements and restrictions related to the collection, use, storage, or sharing of student data by the third-party contractor that are necessary for the education entity to ensure compliance with the provisions of this part and state board rule;
- (B) a description of a person, or type of person, including an affiliate of the third-party contractor, with whom the third-party contractor may share student data;
- (C) provisions that, at the request of the education entity, govern the deletion of the student data received by the third-party contractor;
- (D) except as provided in Subsection (4) and if required by the education entity, provisions that prohibit the secondary use of personally identifiable student data by the third-party contractor;
- (E) an agreement by the third-party contractor that, at the request of the education entity that is a party to the contract, the education entity or the education entity's designee may audit the third-party contractor to verify compliance with the contract; and
- (F) provisions describing the education entity's or government agency's statutory duty to terminate the contract in the case of a privacy violation in accordance with Subsection (2)(a)(iii) and prohibiting any fee or financial liability for the termination;
- (ii) within 30 days after the day on which the education entity or government agency discovers a third-party contractor's unauthorized usage of student data or information in violation of state or federal privacy laws, including this chapter, the Family Education Rights and Privacy Act and related provisions under 20 U.S.C. Secs. 1232g and 1232h, the Children's Online Privacy Protection Act, 15 U.S.C. Sec. 6501 et seq., and any associated regulations, provide notice to the third-party contractor of:
- (iii) no sooner than 30 days after the day on which the education entity or government agency provides the notice described in Subsection (2)(a)(ii), terminate the contract with the third-party contractor if the contractor does not:
- (i) require the following provisions in the contract:
- (b) A third-party contractor may not impose a fee, seek damages, or otherwise assert any financial liability against an education entity or government agency that terminates a contract as a consequence of the contractor's unauthorized usage of student data or information in violation of a relevant state or federal privacy law under Subsection (2)(a)(iii).
- (c)
- (i) A person may submit a report of a suspected violation directly to the state board student data privacy team, through a reporting process that state board policy establishes.
- (ii) Upon receipt of a report described in Subsection (2)(c)(i), the state board student data privacy team shall, in accordance with state board policies and procedures:
- (d) To combat data protection misunderstandings or misconceptions, state board staff shall create materials or resources to be made available to third-party contractors.
- (a) When contracting with a third-party contractor, an education entity, or a government agency contracting on behalf of an education entity, shall:
- (3) As authorized by law or court order, a third-party contractor shall share student data as requested by law enforcement.
- (4) A third-party contractor may:
- (a) use student data for adaptive learning or customized student learning purposes;
- (b) market an educational application or product to a parent of a student if the third-party contractor did not use student data, shared by or collected on behalf of an education entity, to market the educational application or product;
- (c) use a recommendation engine to recommend to a student:
- (i) content that relates to learning or employment, within the third-party contractor's application, if the recommendation is not motivated by payment or other consideration from another party; or
- (ii) services that relate to learning or employment, within the third-party contractor's application, if the recommendation is not motivated by payment or other consideration from another party;
- (d) use student data to allow or improve operability and functionality of the third-party contractor's application; or
- (e) identify for a student nonprofit institutions of higher education or scholarship providers that are seeking students who meet specific criteria if the criteria does not include a personal identity characteristic as that term is defined in Section 53B-1-118:
- (5) At the completion of a contract with an education entity, if the contract has not been renewed, a third-party contractor shall return or delete all personally identifiable student data under the control of the education entity unless the student's parent gives written consent to the third-party contractor's maintenance of the personally identifiable student data.
- (6)
- (7) The provisions of this section do not:
- (a) apply to the use of a general audience application, including the access of a general audience application with login credentials created by a third-party contractor's application;
- (b) apply if the student data is shared in accordance with the education entity's directory information policy, as described in 34 C.F.R. 99.37;
- (c) apply to the providing of Internet service; or
- (d) impose a duty on a provider of an interactive computer service, as defined in 47 U.S.C. Sec. 230, to review or enforce compliance with this section.
- (8) A provision of this section that relates to a student's student data does not apply to a third-party contractor if the education entity or third-party contractor obtains authorization from the following individual, in writing, to waive that provision:
Utah Code §53E-9-310. Penalties
- (1)
- (a) A third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing, or use of student data under this part:
- (b) An education entity may enter into a contract with a third-party contractor that knowingly or recklessly permitted unauthorized collecting, sharing, or use of student data if:
- (c) The state board may assess the civil penalty described in Subsection (1)(a)(ii) in accordance with Title 63G, Chapter 4, Administrative Procedures Act.
- (d)
- (i) The state board may bring an action in a court with jurisdiction under Title 78A, Judiciary and Judicial Administration, if necessary, to enforce payment of the civil penalty described in Subsection (1)(a)(ii).
- (ii) Notwithstanding Title 78B, Chapter 3a, Venue for Civil Actions, the state board shall bring an action described in Subsection (1)(d)(i) in the county in which the office of the state board is located if the action is brought in the district court.
- (e) An individual who knowingly or intentionally permits unauthorized collecting, sharing, or use of student data may be found guilty of a class A misdemeanor.
- (2)
- (a) A parent or adult student may bring an action in a court with jurisdiction under Title 78A, Judiciary and Judicial Administration, for damages caused by a knowing or reckless violation of Section 53E-9-309 by a third-party contractor.
- (b) If the court finds that a third-party contractor has violated Section 53E-9-309, the court may award to the parent or student:
Utah Code §53E-9-311. Disclosure of educational data -- Informed consent -- Access and disclosure
- (1) As used in this section:
- (2) In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g, this chapter, and other relevant state and federal privacy laws, a student who is currently enrolled in, or has previously been enrolled in, an education entity, or a parent if the student is under 18 years old, has the right to:
- (3) An education entity shall:
- (a) subject to Subsection (9), disclose a student's educational data;
- (b) beginning July 1, 2027, offer a secure digital or electronic mechanism as the primary method for obtaining informed consent under this section;
- (c) allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student;
- (d) when obtaining a student's consent through a digital or electronic consent mechanism:
- (e) regarding a limitation imposed under Subsection (5)(b):
- (4) An education entity may impose reasonable time-based or session-based limitations on a student's technical method of access to educational data.
- (5) An education entity may not:
- (6)
- (a) If a student is under 18 years old and the disclosure is to a party other than the student, an education entity shall obtain the parent's consent in accordance with this section.
- (b) The restrictions described in Subsection (5) apply to a parent of a student if the student is under 18 years old.
- (7) This section does not alter, limit, or supersede any right or obligation under:
- (8) The state board may issue nonbinding guidance regarding best practices for consent mechanisms that comply with the requirements of this section.
- (9) Except as provided in the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g, an education entity shall disclose a student's educational data to a third party under this section only:
- (10) A third party that receives the educational data of more than 10 students is subject to:
- (11)
- (a) A student whose educational data is shared as a result of a violation of a third party's failure to comply with the requirements of this section has a private right of action against the third party.
- (b) A student described in Subsection (11)(a) does not have a private right of action against the education entity.