Law / United States / 
Ohio
Technology provider student data and education records use
In force since .
A sensitive categories rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Breach notice, Retention, Prohibition, Security
As of .
What it requires
- This binds a technology provider, a person who contracts with a school district to provide a school-issued device for student use and creates, receives or maintains education records under that contract; a county board of developmental disabilities, educational service center, information technology center, assessment provider, curriculum provider, or city, local, exempted village or joint vocational school district that enters into a service contract with a school district that includes issuing school-issued devices to students is not a technology provider, except as the term is used in division (G) of section 3319.326 (sections 3319.325(F) and 3319.326).
- Comply with Chapter 1347 of the Revised Code with regard to the collection, use and protection of data as if you were a school district (section 3319.326, opening paragraph).
- Treat education records you create, receive, maintain or disseminate under the school district contract as solely the property of the school district (section 3319.326(A)).
- If education records you maintain are subject to a breach of the security of the data, as described in section 1347.12 of the Revised Code, disclose to the school district, following discovery, all information necessary to fulfill the requirements of that section (section 3319.326(B)).
- Unless renewal of the contract is reasonably anticipated, destroy or return to the school district all education records created, received or maintained under the contract within ninety days of the contract's expiration (section 3319.326(C)).
- Do not sell, share or disseminate education records, except as section 3319.326 provides or as part of a valid delegation or assignment of your contract with the school district (section 3319.326(D)).
- Do not use education records for any commercial purpose, including marketing or advertising to a student or parent; providing the specific services the school district contracted for is not a commercial purpose, and aggregate information removed of any personally identifiable information may be used to improve, maintain, develop, support or diagnose your site, service or operation (section 3319.326(E)).
- Contract with the school district for appropriate security safeguards for education records, including a restriction on unauthorized access by your employees or contractors and a requirement that they be authorized to access education records only as necessary to fulfill their official duties (section 3319.326(F)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 3319.325 of the Revised Code defines a technology provider as a person who contracts with a school district to provide a school-issued device for student use and creates, receives, or maintains education records pursuant or incidental to its contract with the district. A technology provider must comply with Chapter 1347 of the Revised Code with regard to the collection, use, and protection of data as if it were a school district.
Education records created, received, maintained, or disseminated by a technology provider pursuant or incidental to a contract with a school district are solely the property of the school district. If education records maintained by the technology provider are subject to a breach of the security of the data, as described in section 1347.12 of the Revised Code, the technology provider must disclose to the school district all information necessary to fulfill the requirements of that section.
Unless renewal of the contract is reasonably anticipated, a technology provider must destroy or return to the school district all education records within ninety days of the expiration of the contract. A technology provider must not sell, share, or disseminate education records, except as section 3319.326 provides or as part of a valid delegation or assignment of its contract with a school district.
A technology provider must not use education records for any commercial purpose, including marketing or advertising to a student or parent. A contract between a technology provider and a school district must ensure appropriate security safeguards for education records and restrict unauthorized access by the provider's employees or contractors.
The section was enacted by Senate Bill 29 of the 135th General Assembly, effective , and amended by House Bill 432 of the 135th General Assembly, effective .
When LexLint raises it
When your app profile says your app serves under-18s.