Law / United States / 
Connecticut
Student data privacy: operators of school services and contractors of boards of education
Conn. Gen. Stat. §§ 10-234aa to 10-234dd
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Security, Prohibition, Retention, Data subject rights, Breach notice, Contract terms
As of .
What it requires
- If you are an operator of an Internet web site, online service or mobile application used for school purposes, implement and maintain security procedures and practices that meet or exceed industry standards to protect student information, student records and student-generated content (section 10-234cc(a)(1)).
- Delete student information, student records or student-generated content within a reasonable time when a student, parent, legal guardian or local or regional board of education with the right to control it requests deletion, unless state or federal law bars deletion or requires retention, or the data sits in an inaccessible disaster recovery copy (section 10-234cc(a)(2)).
- Do not knowingly engage in targeted advertising based on student information or persistent unique identifiers acquired through school use, collect, store or use student information for purposes other than school purposes, or sell, rent or trade it except in an acquisition where the successor stays bound, and disclose it only on the grounds section 10-234cc(b)(4) lists (section 10-234cc(b)).
- If you are a contractor of a local or regional board of education, sign a written contract that carries the statements section 10-234bb(a) requires, including that the data is not the contractor's property, may be used only as the contract authorizes, is deleted on request and is not retained after the contract expires (section 10-234bb(a)).
- As a contractor, implement and maintain security procedures and practices designed to protect student information, student records and student-generated content, using technologies consistent with federal guidance under section 13402(h)(2) of Public Law 111-5, technical safeguards consistent with 45 CFR 164.312, and otherwise meeting or exceeding industry standards. Do not use the data for purposes other than the contract, or use personally identifiable information in it for targeted advertising (section 10-234bb(c) and (d)).
- After discovering a breach of security that results in unauthorized release, disclosure or acquisition of student information, notify the local or regional board of education without unreasonable delay and within thirty days, or within sixty days where the data is directory information, student records or student-generated content (section 10-234dd(a)).
- If you are an operator holding student data from a student's use of your service, notify the student or the student's parents or guardians of such a breach without unreasonable delay and within thirty days, or sixty days for directory information, student records or student-generated content (section 10-234dd(b)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
What this law does
Under sections 10-234aa to 10-234dd, an operator is a person who operates an Internet web site, online service or mobile application with actual knowledge that it is used for school purposes and was designed and marketed for school purposes, to the extent it collects, maintains or uses student information.
Under sections 10-234aa to 10-234dd, a contractor is an operator or consultant that is in possession of or has access to student information, student records or student-generated content as a result of a contract with a local or regional board of education.
Under sections 10-234aa to 10-234dd, an operator must implement and maintain security procedures and practices that meet or exceed industry standards to protect student information, student records and student-generated content from unauthorized access, destruction, use, modification or disclosure.
Under sections 10-234aa to 10-234dd, an operator may not knowingly engage in targeted advertising on its own service or on any other service based on student information or persistent unique identifiers acquired through school use. An operator may not knowingly collect, store and use student information for purposes other than the furtherance of school purposes, or sell, rent or trade it except in an acquisition where the successor operator remains subject to sections 10-234aa to 10-234dd.
Under sections 10-234aa to 10-234dd, a contractor must implement and maintain security procedures and practices designed to protect student information, student records and student-generated content from unauthorized access, destruction, use, modification or disclosure.
Under sections 10-234aa to 10-234dd, a contractor may not use student information, student records or student-generated content for any purpose other than those the contract authorizes, or use personally identifiable information in them to engage in targeted advertising.
Under sections 10-234aa to 10-234dd, a local or regional board of education must enter into a written contract with a contractor whenever it shares or provides access to student information, student records or student-generated content, and a contract that lacks a required provision is void if the contractor fails within a reasonable time after notice to amend it.
Under sections 10-234aa to 10-234dd, on discovering a breach of security that results in unauthorized release, disclosure or acquisition of student information, a contractor must notify the board of education without unreasonable delay and within thirty days.
Under sections 10-234aa to 10-234dd, an operator that holds student data from a student's use of its service must notify the student or the student's parents or guardians of such a breach without unreasonable delay and within thirty days for student information, and within sixty days for directory information, student records or student-generated content.
Public Act 17-200 replaced with in subsections (a), (e) and (f) of section 10-234bb, so the contract requirements apply to contracts entered into on or after . Public Act 16-189, which added sections 10-234aa to 10-234dd, took effect on .
When LexLint raises it
When your app profile says your app serves under-18s.