Serves K-12 schools, in Arkansas

Student Data Vendor Security Act (Act 754 of 2023), school service contract provider duties · Read the law's page

• If you sell a website, online service, online application or mobile application designed and marketed primarily for use in a preschool, elementary school or secondary school, used at the direction of a school's teachers or employees, and you enter a formal, negotiated contract with a public education entity (the Department of Education, a public school or an open-enrollment public charter school) to provide it, provide clear information a layperson can understand on the elements of student personally identifiable information you collect, why you collect them, and how you use and share them, and keep it accurate and available to each public education entity you contract with (Act 754 of 2023, Sec. 1, school service contract provider data transparency section, subsections (a)(1) to (3)).
• Give each public education entity you contract with clear notice before you make a material change to your privacy policy for school services that would materially reduce the privacy and security of student personally identifiable information (data transparency section, subsection (b)(1)).
• Facilitate access to and correction of factually inaccurate student personally identifiable information by a contracting local education agency that has responded to a correction request (data transparency section, subsection (b)(2)).
• Notify the contracting public education entity as soon as possible after you discover the misuse or unauthorized release of student personally identifiable information that you, a subcontractor or a later subcontractor holds, whether or not it results from a material breach of contract (data transparency section, subsection (d)).
• Collect, use and share student personally identifiable information only for the purposes the contract authorizes or with the consent of the student or the student's parent, and obtain consent before using it in a manner materially inconsistent with the contract (use of data section, subsection (a)).
• Do not sell student personally identifiable information, use or share it for targeted advertising to students, or use it to create a personal profile of a student other than for supporting purposes the contracting public education entity authorizes or with the consent of the student or the student's parent (use of data section, subsection (b)(1)). Selling does not include a use, sharing or transfer with an affiliate, with a third party that processes the information on your behalf, for a purpose the contract authorizes, at the entity's direction or with consent, or in a merger or acquisition whose successor stays subject to the subchapter (subsection (b)(2)).
• Disclose student personally identifiable information to a subcontractor only if you contractually require the subcontractor to comply with the subchapter, and notify the contracting public education entity as soon as possible after a disclosure made to ensure legal compliance, respond to judicial process, protect safety or investigate a public safety matter (use of data section, subsection (c)).
• Maintain a comprehensive information security program, reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information, that uses appropriate administrative, technological and physical safeguards (data security and destruction section, subsection (a)).
• If the contracting public education entity requests destruction of a student's information during the contract, destroy it as soon as practicable unless the student or parent consents to retention or the student has moved to another public education entity that has asked you to keep it (data security and destruction section, subsection (b)).
• After the contract ends, destroy all student personally identifiable information collected, generated or inferred as a result of the contract within the period the contract specifies, or as soon as practicable after it is no longer needed if the contract names no period, and tell the public education entity the date of destruction if it asks (data security and destruction section, subsection (c)).

Ark. Code Ann. sec. 6-18-109 (Act 1196 of 2015) · Read the law's page

• If you operate a website, online service, online application or mobile application that you know is used primarily for public school purposes, designed and marketed for them, and operating at capacity, do not knowingly target advertising based on covered information about a public school student that you acquired through the service, unless the public school, the student or the student's parent or guardian gives affirmative consent in response to clear and conspicuous notice (Ark. Code Ann. sec. 6-18-109(b)(1) and (e)).
• Do not knowingly use covered information to compile a profile about a public school student except in furtherance of public school purposes or with affirmative consent given in response to clear and conspicuous notice (sec. 6-18-109(b)(2) and (e)).
• Do not knowingly sell a public school student's covered information, other than in the purchase, merger or other acquisition of your business by an entity that is subject to the section (sec. 6-18-109(b)(3)).
• Disclose a public school student's covered information only as the section allows, such as in furtherance of public school purposes, to comply with law, or to a service provider you bind by contract to use it only for the contracted service, to keep it from further disclosure and to maintain reasonable security, or with affirmative consent given in response to clear and conspicuous notice (sec. 6-18-109(b)(4) and (e)).
• Implement and maintain reasonable security measures appropriate to the nature of the covered information you obtain, and protect it from unauthorized access, destruction, use, modification or disclosure (sec. 6-18-109(d)(1)).
• Delete a public school student's covered information within a reasonable time frame if the school or school district requests the deletion of covered information under its control (sec. 6-18-109(d)(2)).