Law / United States / 
Idaho
SDATAA, student-data terms required in contracts with private vendors
Idaho Code § 33-133(3)(b)(iv), (vi), (3)(f)
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Contract terms, Consent, Retention, Governance
What it requires
- If you are a school district, primary or secondary school or similar institution that contracts with a private vendor for databases, online services, assessments, special education or instructional supports, include in each contract a provision that the vendor is permitted to use aggregated data, or an individual student's data for secondary uses but only if the vendor discloses the secondary uses in clear detail and receives written permission from the student's parent or legal guardian (Idaho Code 33-133(3)(b)(vi)).
- Include in each such contract either a prohibition on any secondary use of student data by the vendor, including sales, marketing or advertising, that still permits the vendor to process or monitor the data solely to provide and maintain the integrity of the service, or a requirement that the vendor disclose in detail any secondary uses, with the State Board of Education obtaining express parental consent for them before the vendor's services are deployed (Idaho Code 33-133(3)(b)(vi)(1) and (2)).
- Include in each contract that outsources databases, online services, assessments or instructional supports involving student data express provisions that safeguard privacy and security, the secondary-use restrictions above, a time frame for data destruction, and penalties for noncompliance (Idaho Code 33-133(3)(f)).
- If you are the State Board of Education or the State Department of Education, include in each of your contracts provisions requiring and governing data destruction dates and specific restrictions on the use of data, and ensure that every private vendor you engage complies with section 33-133 (Idaho Code 33-133(3)(b)(iv) and the closing paragraph of 33-133(3)(b)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Idaho State Board of Education and State Department of Education, either of which may bring a civil enforcement action under section 33-133 of the Idaho Code.
What this law does
Section 33-133 of the Idaho Code requires a school district, primary school, secondary school or similar institution that contracts with a private vendor for databases, online services, assessments, special education or instructional supports to include a provision that the vendor is permitted to use aggregated data, or an individual student's data for secondary uses but only if the vendor discloses the secondary uses in clear detail and receives written permission from the student's parent or legal guardian.
The contract must also include either a prohibition on any secondary use of student data by the private vendor, including sales, marketing or advertising, while permitting the vendor to process or monitor the data solely to provide and maintain the integrity of the service, or a requirement that the vendor disclose in detail any secondary uses, with the state board of education obtaining express parental consent for those secondary uses before the vendor's services are deployed.
The State Board of Education must ensure that any contract governing databases, online services, assessments or instructional supports that includes student data and is outsourced to a private vendor carries express provisions that safeguard privacy and security, the secondary-use restrictions of subsection (3)(b)(vi), a time frame for data destruction, and penalties for noncompliance.
Any contract entered into by the State Board of Education or the State Department of Education must include provisions requiring and governing data destruction dates and specific restrictions on the use of data. The State Board of Education and the State Department of Education must ensure that every private vendor they employ or otherwise engage complies with section 33-133.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .