Law / United States / 
Utah
Student Data Protection: no sharing of personally identifiable student data without written consent, with the authorized exceptions and the student data manager's role
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Governance
What it requires
- If you are an education entity, do not share personally identifiable student data without written consent, and do not share student data with a federal agency, except as Utah Code 53E-9-308(1)(b) and the Family Educational Rights and Privacy Act allow (Utah Code 53E-9-308(1)).
- Have your student data manager authorize and manage the sharing of personally identifiable student data outside your education entity (Utah Code 53E-9-308(2)(a)).
- Share student data for research or evaluation only after verifying that the request meets the requirements of 34 CFR 99.31(a)(6), submitting it to your research review process, and fulfilling the instructions that result (Utah Code 53E-9-308(6)(a)).
- If you receive personally identifiable student data in response to a court subpoena, use it only for the use described in the subpoena (Utah Code 53E-9-308(5)(b)).
These lines are LexLint's reading of the law's text.
What this law does
An education entity, including a student data manager, may not share personally identifiable student data without written consent or share student data with a federal agency, except as the section provides. An education entity may share personally identifiable student data in accordance with the Family Education Rights and Privacy Act, as required by federal law, and as the section's other subsections describe.
A student data manager must authorize and manage the sharing, outside of its education entity, of personally identifiable student data for the entity, and must act as the primary local point of contact for the state student data officer.
A student data manager may share student data for research or evaluation only if the manager verifies that the request meets the requirements of 34 CFR 99.31(a)(6), submits it to the education entity's research review process, and fulfills the instructions that result from that process. A person who receives personally identifiable student data in response to a court subpoena may not use it outside of the use described in the subpoena.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .