Law / United States / 
Montana
Pupil records: terms a school district must put in a contract with a provider of digital storage or digital educational software
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Contract terms, Prohibition, Retention
- Audit expectation
- none
What it requires
- If you are a school district that contracts with a third party for cloud-based or other digital storage, management and retrieval of pupil records, or for digital educational software that accesses, stores and uses them, adopt a trustee policy for the contract and ensure the contract contains the terms the section lists (section 20-7-1326(1) and (2)).
- Ensure the contract states that pupil records continue to be the property of and under the control of the school district, describes, if applicable, how pupils may retain possession and control of their own pupil-generated content, and prohibits the third party from using any information in pupil records for any purpose other than those the contract requires or specifically permits (section 20-7-1326(2)(a) to (c)).
- Ensure the contract prohibits the third party from using personally identifiable information in pupil records to engage in targeted advertising (section 20-7-1326(2)(i)).
- Ensure the contract describes how a parent, legal guardian or eligible pupil may review and correct personally identifiable information in the pupil's records, the actions the third party will take to secure pupil records, including the designation and training of responsible individuals, and the procedures for notifying the affected parent, legal guardian or pupil of an unauthorized disclosure (section 20-7-1326(2)(d) to (f)).
- Ensure the contract certifies that pupil records will not be retained or available to the third party when the contract ends, describes how the certification will be enforced, and describes how the district and the third party will jointly ensure compliance with the Family Educational Rights and Privacy Act (section 20-7-1326(2)(g) and (h)).
- If a contract fails to comply and the noncompliant party does not cure the defect after notice and a reasonable opportunity to cure, the contract is void and all parties must return all pupil records in their possession to the school district (section 20-7-1326(3)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 20-7-1326 requires a school district to put listed terms in a contract with a provider of digital storage of pupil records or digital educational software, including a description of the third party's security actions and a certification that pupil records are not retained when the contract ends. Those are contract terms and a certification, not a log or a record kept of processing, and the section sets no log, retention period, audit or regulator access. The section states no territorial test.
- Kind
- None
- As of
What this law does
A school district may, under a policy its trustees adopt, contract with a third party to provide cloud-based or other digital storage, management and retrieval of pupil records, or digital educational software that authorizes the provider to access, store and use pupil records. A school district that makes such a contract shall ensure the contract contains a statement that pupil records continue to be the property of and under the control of the school district.
The contract must prohibit the third party from using any information in pupil records for any purpose other than those required or specifically permitted by the contract. The contract must also prohibit the third party from using personally identifiable information in pupil records to engage in targeted advertising.
The contract must describe the actions the third party will take, including the designation and training of responsible individuals, to ensure the security and confidentiality of pupil records, and the procedures for notifying the affected parent, legal guardian or pupil of an unauthorized disclosure.
The contract must also contain a description of the means by which pupils may retain possession and control of their own pupil-generated content, if applicable, a description of the procedures by which a parent, legal guardian or eligible pupil may review and correct personally identifiable information in the pupil's records, a certification that pupil records will not be retained or available to the third party when the contract ends, which does not apply to pupil-generated content a pupil chooses to store in an account with the third party, and a description of how the school district and the third party will jointly ensure compliance with the federal Family Educational Rights and Privacy Act.
A contract that fails to comply with the section is void if, upon notice and a reasonable opportunity to cure, the noncompliant party fails to come into compliance and cure any defect, and all parties to a voided contract shall return all pupil records in their possession to the school district.
Compliance with the security description does not, in itself, absolve the third party of liability in the event of an unauthorized disclosure of pupil records, and nothing in the section imposes liability on a third party for content provided by any other third party. The section does not apply to a contract in effect before until the agreement expires or is amended or renewed. Section 20-7-1326 was enacted by section 4 of chapter 369, Laws of 2019. Chapter 369, Laws of 2019 took effect on as to all sections.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .