Law / United States / 
Arkansas
Student Data Vendor Security Act: duties of a school service contract provider
Student Data Vendor Security Act (Act 754 of 2023), school service contract provider duties
In force since .
A sensitive categories rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Breach notice, Consent, Disclosure, Prohibition, Retention, Security
- Audit expectation
- none
What it requires
- If you sell a website, online service, online application or mobile application designed and marketed primarily for use in a preschool, elementary school or secondary school, used at the direction of a school's teachers or employees, and you enter a formal, negotiated contract with a public education entity (the Department of Education, a public school or an open-enrollment public charter school) to provide it, provide clear information a layperson can understand on the elements of student personally identifiable information you collect, why you collect them, and how you use and share them, and keep it accurate and available to each public education entity you contract with (Act 754 of 2023, Sec. 1, school service contract provider data transparency section, subsections (a)(1) to (3)).
- Give each public education entity you contract with clear notice before you make a material change to your privacy policy for school services that would materially reduce the privacy and security of student personally identifiable information (data transparency section, subsection (b)(1)).
- Facilitate access to and correction of factually inaccurate student personally identifiable information by a contracting local education agency that has responded to a correction request (data transparency section, subsection (b)(2)).
- Notify the contracting public education entity as soon as possible after you discover the misuse or unauthorized release of student personally identifiable information that you, a subcontractor or a later subcontractor holds, whether or not it results from a material breach of contract (data transparency section, subsection (d)).
- Collect, use and share student personally identifiable information only for the purposes the contract authorizes or with the consent of the student or the student's parent, and obtain consent before using it in a manner materially inconsistent with the contract (use of data section, subsection (a)).
- Do not sell student personally identifiable information, use or share it for targeted advertising to students, or use it to create a personal profile of a student other than for supporting purposes the contracting public education entity authorizes or with the consent of the student or the student's parent (use of data section, subsection (b)(1)). Selling does not include a use, sharing or transfer with an affiliate, with a third party that processes the information on your behalf, for a purpose the contract authorizes, at the entity's direction or with consent, or in a merger or acquisition whose successor stays subject to the subchapter (subsection (b)(2)).
- Disclose student personally identifiable information to a subcontractor only if you contractually require the subcontractor to comply with the subchapter, and notify the contracting public education entity as soon as possible after a disclosure made to ensure legal compliance, respond to judicial process, protect safety or investigate a public safety matter (use of data section, subsection (c)).
- Maintain a comprehensive information security program, reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information, that uses appropriate administrative, technological and physical safeguards (data security and destruction section, subsection (a)).
- If the contracting public education entity requests destruction of a student's information during the contract, destroy it as soon as practicable unless the student or parent consents to retention or the student has moved to another public education entity that has asked you to keep it (data security and destruction section, subsection (b)).
- After the contract ends, destroy all student personally identifiable information collected, generated or inferred as a result of the contract within the period the contract specifies, or as soon as practicable after it is no longer needed if the contract names no period, and tell the public education entity the date of destruction if it asks (data security and destruction section, subsection (c)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The subchapter requires a school service contract provider to explain what it collects, to notify the public education entity of misuse, to keep a security program and to destroy information at the entity's request or contract end, and to tell the entity the destruction date on request. It requires no log or record and names no reader of one.
- Kind
- None
- As of
What this law does
Act 754 of 2023 creates the Student Data Vendor Security Act, whose purpose is to increase security and transparency in the sharing and use of student data with and by third-party vendors. The Act takes effect on . A school service contract provider is an entity, other than a local education agency or an institution of higher education, that enters into a formal, negotiated contract with a public education entity to provide a school service.
A school service is a website, online service, online application or mobile application that is designed and marketed primarily for use in a preschool, elementary school or secondary school, is used at the direction of teachers or other employees of a local education agency, and collects, maintains or uses student personally identifiable information.
A school service contract provider must provide clear information, understandable by a layperson, on the elements of student personally identifiable information it collects, the purpose of collecting them, and how it uses and shares them. A school service contract provider must notify the contracting public education entity as soon as possible upon discovering the misuse or unauthorized release of student personally identifiable information it or a subcontractor holds.
A school service contract provider may collect, use and share student personally identifiable information only for the purposes the contract with a public education entity authorizes, or with the consent of the student or the student's parent.
A school service contract provider may not sell student personally identifiable information, use or share it for targeted advertising to students, or use it to create a personal profile of a student other than for supporting purposes the contracting public education entity authorizes or with consent. A school service contract provider may disclose student personally identifiable information to a subcontractor only if it contractually requires the subcontractor to comply with the subchapter.
A school service contract provider must maintain a comprehensive information security program reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information.
During the term of a contract, a school service contract provider must destroy a student's information as soon as practicable after the public education entity requests destruction, unless the student or parent consents to retention or the student has transferred to another public education entity that requests retention.
After a contract ends, a school service contract provider must destroy all student personally identifiable information collected, generated or inferred as a result of the contract within the time period the contract specifies. The requirements on transparency and on security and destruction apply to a school service contract provider that enters or renews a contract with a public education entity on or after .
A school service does not include a website, online service, online application or mobile application designed and marketed for use by individuals or entities generally, even if it is also marketed to a preschool, elementary school or secondary school.
Selling student personally identifiable information does not include its use, sharing or transfer with or to an affiliate, for a purpose the contract authorizes, with or to a third party that processes it on the provider's behalf, at the direction of the contracting public education entity or with consent, or in a purchase, merger or other acquisition whose successor remains subject to the subchapter.
A school service contract provider may use or disclose student personally identifiable information to ensure legal or regulatory compliance or take precautions against liability, to respond to or participate in the judicial process, to protect the safety of users or others on its service, or to investigate a matter related to public safety, and must then notify the contracting public education entity as soon as possible.
A student may consent to the use, sharing or retention of the student's personally identifiable information only if the student is eighteen years of age or older or legally emancipated.
The subchapter does not prohibit the use of student personally identifiable information for adaptive learning or personalized or customized education, to maintain, develop, support, improve or diagnose the provider's service, to provide recommendations for school, educational or employment purposes within a school service, or to respond to a student's request for information or feedback, where the recommendation or response is not determined by payment or other consideration from a third party.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .