Serves schools or universities, in Arkansas

Student Data Vendor Security Act (Act 754 of 2023), school service contract provider duties · Read the law's page

• If you sell a website, online service, online application or mobile application designed and marketed primarily for use in a preschool, elementary school or secondary school, used at the direction of a school's teachers or employees, and you enter a formal, negotiated contract with a public education entity (the Department of Education, a public school or an open-enrollment public charter school) to provide it, provide clear information a layperson can understand on the elements of student personally identifiable information you collect, why you collect them, and how you use and share them, and keep it accurate and available to each public education entity you contract with (Act 754 of 2023, Sec. 1, school service contract provider data transparency section, subsections (a)(1) to (3)).
• Give each public education entity you contract with clear notice before you make a material change to your privacy policy for school services that would materially reduce the privacy and security of student personally identifiable information (data transparency section, subsection (b)(1)).
• Facilitate access to and correction of factually inaccurate student personally identifiable information by a contracting local education agency that has responded to a correction request (data transparency section, subsection (b)(2)).
• Notify the contracting public education entity as soon as possible after you discover the misuse or unauthorized release of student personally identifiable information that you, a subcontractor or a later subcontractor holds, whether or not it results from a material breach of contract (data transparency section, subsection (d)).
• Collect, use and share student personally identifiable information only for the purposes the contract authorizes or with the consent of the student or the student's parent, and obtain consent before using it in a manner materially inconsistent with the contract (use of data section, subsection (a)).
• Do not sell student personally identifiable information, use or share it for targeted advertising to students, or use it to create a personal profile of a student other than for supporting purposes the contracting public education entity authorizes or with the consent of the student or the student's parent (use of data section, subsection (b)(1)). Selling does not include a use, sharing or transfer with an affiliate, with a third party that processes the information on your behalf, for a purpose the contract authorizes, at the entity's direction or with consent, or in a merger or acquisition whose successor stays subject to the subchapter (subsection (b)(2)).
• Disclose student personally identifiable information to a subcontractor only if you contractually require the subcontractor to comply with the subchapter, and notify the contracting public education entity as soon as possible after a disclosure made to ensure legal compliance, respond to judicial process, protect safety or investigate a public safety matter (use of data section, subsection (c)).
• Maintain a comprehensive information security program, reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information, that uses appropriate administrative, technological and physical safeguards (data security and destruction section, subsection (a)).
• If the contracting public education entity requests destruction of a student's information during the contract, destroy it as soon as practicable unless the student or parent consents to retention or the student has moved to another public education entity that has asked you to keep it (data security and destruction section, subsection (b)).
• After the contract ends, destroy all student personally identifiable information collected, generated or inferred as a result of the contract within the period the contract specifies, or as soon as practicable after it is no longer needed if the contract names no period, and tell the public education entity the date of destruction if it asks (data security and destruction section, subsection (c)).

Ark. Code Ann. sec. 6-18-109 (Act 1196 of 2015) · Read the law's page

• If you operate a website, online service, online application or mobile application that you know is used primarily for public school purposes, designed and marketed for them, and operating at capacity, do not knowingly target advertising based on covered information about a public school student that you acquired through the service, unless the public school, the student or the student's parent or guardian gives affirmative consent in response to clear and conspicuous notice (Ark. Code Ann. sec. 6-18-109(b)(1) and (e)).
• Do not knowingly use covered information to compile a profile about a public school student except in furtherance of public school purposes or with affirmative consent given in response to clear and conspicuous notice (sec. 6-18-109(b)(2) and (e)).
• Do not knowingly sell a public school student's covered information, other than in the purchase, merger or other acquisition of your business by an entity that is subject to the section (sec. 6-18-109(b)(3)).
• Disclose a public school student's covered information only as the section allows, such as in furtherance of public school purposes, to comply with law, or to a service provider you bind by contract to use it only for the contracted service, to keep it from further disclosure and to maintain reasonable security, or with affirmative consent given in response to clear and conspicuous notice (sec. 6-18-109(b)(4) and (e)).
• Implement and maintain reasonable security measures appropriate to the nature of the covered information you obtain, and protect it from unauthorized access, destruction, use, modification or disclosure (sec. 6-18-109(d)(1)).
• Delete a public school student's covered information within a reasonable time frame if the school or school district requests the deletion of covered information under its control (sec. 6-18-109(d)(2)).

Ark. Code Ann. sec. 6-60-104 (Act 998 of 2013) · Read the law's page

• If you are a public or private institution that provides postsecondary education or training, do not require, request, suggest or cause a current or prospective student or employee to disclose the username and password to a personal social media account (Ark. Code Ann. sec. 6-60-104(b)(1)).
• Do not require, request, suggest or cause a current or prospective student, as a condition of acceptance in curricular or extracurricular activities, to add an employee or volunteer of the institution to the contacts of a social media account or to change the account's privacy settings (sec. 6-60-104(b)(2)).
• Do not take action against, threaten, or penalize a current student, or refuse to admit or hire a prospective employee or student, for exercising those rights (sec. 6-60-104(c)).

Ark. Code Ann. secs. 6-68-101 to 6-68-104 and 6-68-108 (Act 758 of 2001) · Read the law's page

• If you publish or manufacture printed instructional materials for students attending an institution of higher education in Arkansas, provide the accredited institution, on a written request that meets the Act's certification conditions, any printed instructional material in an electronic format mutually agreed upon with the school, at no additional cost and in a timely manner (Ark. Code Ann. sec. 6-68-102).
• Make the computer files or electronic versions maintain the structural integrity of the printed instructional material, be compatible with commonly used braille translation and speech synthesis software, and include corrections and revisions as may be necessary (Ark. Code Ann. sec. 6-68-102).
• Where good faith efforts fail to produce an agreement on an electronic format, provide the instructional material in ASCII text and preserve as much of the structural integrity of the printed instructional material as possible (Ark. Code Ann. sec. 6-68-101(6)(B)).
• If you publish or manufacture nonprinted instructional materials for students attending an accredited institution of higher education in Arkansas, provide computer files or other electronic versions of them on the same conditions, when technology is available to convert them to a format that maintains their structural integrity and is compatible with braille translation and speech synthesis software (Ark. Code Ann. sec. 6-68-104).