School service providers: limits on collecting, using, disclosing, selling and retaining pupil data

A school service is an Internet website, online service or mobile application that collects or maintains personally identifiable information concerning a pupil, is used primarily for educational purposes, and is designed and marketed for use in public schools and used at the direction of teachers and other educational personnel. A school service provider is a person that operates a school service, to the extent the provider is operating in that capacity.

A school service does not include an Internet website, online service or mobile application that is designed or marketed for use by a general audience, even if it is also marketed to public schools. Nor does it include an internal database, system or program maintained or operated by a school district, charter school or university school for profoundly gifted pupils.

Nor does it include a school service whose provider has been designated by a school district, a charter school sponsor, the governing body of a university school for profoundly gifted pupils or the Department as a school official under the Family Educational Rights and Privacy Act, has entered into a contract with that body, and has agreed to comply with and be subject to that Act's provisions relating to personally identifiable information.

Examinations administered under NRS 390.105, the college and career readiness assessment administered under NRS 390.610, and any instructional programs purchased by a school district, a charter school, the governing body of a university school for profoundly gifted pupils or the Department are also outside the term. Personally identifiable information has the meaning given to it in 34 C.F.R. 99.3.

Targeted advertising means presenting advertisements to a pupil that are selected based on information obtained or inferred from the pupil's online behavior, the pupil's use of applications or personally identifiable information concerning the pupil, and does not include advertising to a pupil at an online location based on the pupil's current visit to that location or a single search query, without collecting and retaining the pupil's online activities over time.

Before the persons or governmental entities described in subsection 3 begin using a school service, a school service provider must give them a written disclosure in language that is easy to understand of the types of personally identifiable information it collects, the manner in which that information is used, and its plan for the security of data concerning pupils.

That disclosure must go to the board of trustees of a school district, the governing body of a charter school or university school for profoundly gifted pupils that uses the school service, and to any teacher who uses it. Before it makes a material change to its plan for the security of data concerning pupils, a school service provider must give notice to the same boards, governing bodies and teachers.

A school service provider must allow a pupil who is at least 18 years of age and the parent or legal guardian of any pupil to review the personally identifiable information it maintains about the pupil, and must establish a process for correcting that information.

A school service provider may collect, use, allow access to or transfer personally identifiable information concerning a pupil only for purposes inherent to a teacher's classroom use of the school service or authorized by the school's governing body, as federal or state law requires, in response to a court subpoena, to protect the safety of a user, or with the consent the school's policy requires.

A school service provider that transfers pupil personally identifiable information to a third-party service provider must give the required notice, contractually prohibit the third party from using it for any purpose other than the contracted school services and from disclosing it without authorization, and require the third party to comply with NRS 388.281 to 388.296.

A school service provider must delete a pupil's personally identifiable information within a reasonable time not to exceed 30 days after the board of trustees or governing body of the pupil's school asks it to.

The board of trustees or governing body must have a policy that allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review that information and request its deletion, and where no such policy exists the provider must delete the information at the request of the pupil's parent or legal guardian.

Any agreement a school service provider enters into that provides for the disclosure of personally identifiable information must require the person or governmental entity receiving it to abide by NRS 388.292. A school service provider must not use pupil personally identifiable information to engage in targeted advertising within the school service or on any other website, online service or mobile application if the advertising is based on information acquired from use of the school service.

A school service provider must not sell pupil personally identifiable information, but may transfer it to an entity that acquires the school service if the acquiring entity becomes subject to NRS 388.281 to 388.296. A school service provider must not use pupil personally identifiable information to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the required consent.

A school service provider must not use pupil personally identifiable information in a manner inconsistent with any contract governing its activities for the school service in effect when the information is collected, or in a manner that violates NRS 388.281 to 388.296. A school service provider must not knowingly retain pupil personally identifiable information without the required consent beyond the period authorized by the contract governing its activities.

NRS 388.292 does not prohibit use of pupil information for adaptive learning or personalized education, maintaining or improving the school service, recommending additional content or services within it, responding to a pupil's request for information, soliciting feedback, research required by federal or state law, research authorized by federal or state law that is performed under the direction of a public school, school district or the Department and does not use the information for advertising or a profile unrelated to instruction, or allowing an adult pupil or a parent or legal guardian to download, transfer or otherwise maintain data concerning a pupil.

A school service provider may use and disclose information derived from pupil personally identifiable information to demonstrate the effectiveness of its products or services, including in advertising or marketing, and to develop and improve its services, so long as the information is aggregated or presented in a manner that does not disclose the identity of the pupil.

A school service provider that violates NRS 388.292 is subject to a civil penalty not to exceed $5,000 per violation, which the Attorney General may recover in a civil action brought in the name of the State of Nevada. A person or governmental entity may not waive or modify any right, obligation or liability set forth in NRS 388.281 to 388.296, and a contract provision that conflicts with those sections is void and unenforceable.

In the Nevada Revised Statutes, unless a particular statute provides otherwise or the context requires otherwise, a person means a natural person, any form of business or social organization or any other nongovernmental legal entity, and does not include a government, governmental agency or political subdivision of a government. Senate Bill 463 of the 2015 session, the act that created the school service provider sections, became effective on July 1, 2015.

The 2019 act on school service providers and pupil technology revised the targeted advertising prohibition to reach targeted advertising within the school service or on any other Internet website, online service or mobile application if it is based on information gathered from the school service, and authorized a school service provider to use pupil personally identifiable information to perform certain research required or authorized by federal or state law.

The same act authorized a school service provider to use aggregated, deidentified information derived from pupil personally identifiable information to develop and improve its products. That act became effective on July 1, 2020 for all purposes other than adopting regulations and performing administrative tasks.