Law / United States / 
Colorado
Student Data Transparency and Security Act: school service contract providers
C.R.S. sections 22-16-101 to 22-16-112 (HB 16-1423, 2016 Colo. Sess. Laws ch. 355)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Disclosure, Consent, Prohibition, Security, Retention, Data subject rights
As of .
What it requires
- If you are a school service contract provider, give each public education entity you contract with clear, layperson information, in a format easily accessible through a website, on the data elements of student personally identifiable information you collect, the learning purpose for which you collect it, and how you use and share it, and keep it accurate (section 22-16-108(1)).
- Give each public education entity you contract with clear notice before you make material changes to your privacy policy for school services (section 22-16-108(2)).
- Facilitate access to and correction of factually inaccurate student personally identifiable information by a contracting local education provider that has received a correction request from a parent (section 22-16-108(3)).
- On discovering a misuse or unauthorized release of student personally identifiable information held by you, a subcontractor or a subsequent subcontractor, notify the contracting public education entity as soon as possible, whether or not the misuse is a material breach of the contract (section 22-16-108(4)).
- Collect, use and share student personally identifiable information only for the purposes the contract authorizes or with the consent of the student or the student's parent, and obtain that consent before a use materially inconsistent with your privacy policy or the contract. A student can consent only if at least eighteen years old or legally emancipated (section 22-16-109(1) and (4)).
- Do not sell student personally identifiable information, except in an acquisition where the successor stays bound by the article. Do not use or share it for targeted advertising to students, and do not use it to build a personal profile of a student other than for purposes the contracting entity authorizes or with consent (section 22-16-109(2)).
- Disclose student personally identifiable information to a subcontractor only if you contractually require the subcontractor to comply with sections 22-16-108, 22-16-109, 22-16-110 and 22-16-111 (section 22-16-109(3)(b)).
- Maintain a comprehensive information security program reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information, using appropriate administrative, technological and physical safeguards (section 22-16-110(1)).
- Destroy a student's personally identifiable information as soon as practicable when the contracting public education entity requests it during the contract, unless the student or parent consents to retention or a receiving entity asks you to keep it. After the contract ends, destroy all of it within the period the contract specifies, or when it is no longer needed, and tell the entity the date of destruction (section 22-16-110(2) and (3)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The governing board of a local education provider, which must adopt a policy for hearing parent complaints about compliance with the article and act on a complaint within sixty days after the hearing, and which decides after a public hearing whether to terminate a contract with a school service contract provider that commits a material breach involving misuse or unauthorized release of student personally identifiable information.
Settledness
- As of
What this law does
Under the Student Data Transparency and Security Act, a school service is an internet website, online service, online application or mobile application that is designed and marketed primarily for use in a preschool, elementary school or secondary school, is used at the direction of teachers or other employees of a local education provider, and collects, maintains or uses student personally identifiable information.
Under the Student Data Transparency and Security Act, a school service contract provider must give each public education entity it contracts with clear, layperson information on the data elements of student personally identifiable information it collects, the learning purpose of the collection, and how the information is used and shared.
Under the Student Data Transparency and Security Act, on discovering a misuse or unauthorized release of student personally identifiable information, the provider must notify the contracting public education entity as soon as possible.
Under the Student Data Transparency and Security Act, a school service contract provider may collect, use and share student personally identifiable information only for the purposes the contract authorizes or with the consent of the student or the student's parent.
Under the Student Data Transparency and Security Act, a school service contract provider may not sell student personally identifiable information, except in an acquisition of the provider where the successor stays bound by the article.
Under the Student Data Transparency and Security Act, a school service contract provider may not use or share student personally identifiable information for targeted advertising to students, or use it to create a personal profile of a student other than for supporting purposes the contracting entity authorizes or with consent.
Under the Student Data Transparency and Security Act, a school service contract provider must maintain a comprehensive information security program reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information.
Under the Student Data Transparency and Security Act, after a contract ends the provider must destroy all student personally identifiable information collected, generated or inferred under it, within the period the contract specifies, and notify the public education entity of the date.
Under the Student Data Transparency and Security Act, a local education provider may not enter into or renew a contract with a school service contract provider that refuses the terms requiring compliance with sections 22-16-108 to 22-16-110, or that has substantially failed to comply with them.
Under the Student Data Transparency and Security Act, if a student's parent finds that a local education provider does not comply with the article, the parent may submit a complaint to the provider's governing board under its complaint policy. The Student Data Transparency and Security Act takes effect on the day following the ninety-day period after final adjournment of the General Assembly, which it gives as if adjournment sine die is on .
When LexLint raises it
When your app profile says your app serves under-18s.