Student Data Transparency and Security Act: local education provider contracts, postings and student privacy policy

A local education provider is a school district, a charter school authorized by a school district or by the State Charter School Institute, or a board of cooperative services that operates one or more public schools. Each local education provider must post and maintain on its website clear information, understandable by a layperson, on the data elements of student personally identifiable information that it collects and maintains in its data system and on how it uses and shares them.

Each local education provider must post and maintain on its website a list of the school service contract providers that it contracts with and a copy of each contract. Each local education provider must ensure that the terms of each contract it enters into or renews with a school service contract provider require the provider, at a minimum, to comply with sections 22-16-108 to 22-16-110.

A local education provider may not enter into or renew a contract with a school service contract provider that refuses to accept those terms or that has substantially failed to comply with one or more of the requirements in sections 22-16-108 to 22-16-110.

If a school service contract provider commits a material breach of the contract that involves the misuse or unauthorized release of student personally identifiable information, the local education provider must determine whether to terminate the contract under a policy that requires its governing body to hold a public hearing.

Each local education provider must post on its website, to the extent practicable, a list of the school service on-demand providers that it or its employees use for school services, and update the list at the beginning and mid-point of each school year.

If a local education provider has evidence that a school service on-demand provider does not substantially comply with its own privacy policy or with section 22-16-109(2) or 22-16-110(1), it is strongly encouraged to cease or refuse to use the provider and to prohibit its employees from using it.

A local education provider that ceases or refuses to use an on-demand provider for that reason must notify the provider, publish and maintain on its website a list of the on-demand providers it ceases or refuses to use with any written responses it receives, and notify the department.

Each local education provider that uses on-demand providers must post on its website a notice that it will post the name of any on-demand provider it ceases or refuses to use, with any written response, and will notify the department. Each local education provider must adopt a student information privacy and protection policy that addresses the issues in section 22-16-106(1), review it annually, and revise it as necessary.

Each local education provider must post a current copy of the student information privacy and protection policy on its website and make copies available on request to the parent of a student it enrolls.