Law / United States / 
Kentucky
Prohibited uses of personally identifiable student information by a cloud computing service provider
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Consent
As of .
What it requires
- If you operate a cloud computing service for a kindergarten-to-grade-12 educational institution, do not process student data for any purpose other than providing, improving, developing or maintaining the integrity of the service unless the student's parent gives express permission (KRS 365.734(2)).
- Do not process student data to advertise or facilitate advertising, to create or correct an individual or household profile for any advertisement purpose, or to sell, disclose or otherwise process it for any commercial purpose (KRS 365.734(2)).
- When you agree to provide cloud computing services to an educational institution, certify in writing to the institution that you will comply with the use limits in subsection (2) (KRS 365.734(3)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A cloud computing service provider, any person other than an educational institution that operates a service marketed and designed to give an educational institution serving students in kindergarten to grade twelve account-based access to online computing resources, may not process student data for any purpose other than providing, improving, developing, or maintaining the integrity of its cloud computing services, unless the provider receives express permission from the student's parent.
A provider may assist an educational institution to conduct educational research as the Family Educational Rights and Privacy Act of 1974 permits. A provider may not in any case process student data to advertise or facilitate advertising or to create or correct an individual or household profile for any advertisement purpose, and may not sell, disclose, or otherwise process student data for any commercial purpose.
A provider that enters into an agreement to provide cloud computing services to an educational institution must certify in writing to the institution that it will comply. The Kentucky Board of Education may promulgate administrative regulations to carry out the section. The section took effect on .
When LexLint raises it
When your app profile says your app serves under-18s.