Law / United States / 
Utah
Student Data Protection: contract terms an education entity must require of a third-party contractor, and its duty to give notice and terminate after a privacy violation
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Contract terms, Governance, Reporting
What it requires
- If you are an education entity, or a government agency contracting on behalf of one, require in every contract with a third-party contractor the provisions listed in Utah Code 53E-9-309(2)(a)(i): collection, use, storage and sharing restrictions, the persons the contractor may share student data with, deletion at your request, a bar on secondary use if you require it, your right to audit, and the termination terms with no fee or financial liability.
- Within 30 days after you discover a third-party contractor's unauthorized usage of student data in violation of state or federal privacy laws, give the contractor notice of the violation and of your duty to terminate (Utah Code 53E-9-309(2)(a)(ii)).
- Terminate the contract no sooner than 30 days after that notice if the contractor does not remedy the violation to the greatest extent practicable and establish processes and procedures to prevent it from recurring (Utah Code 53E-9-309(2)(a)(iii)).
These lines are LexLint's reading of the law's text.
What this law does
When contracting with a third-party contractor, an education entity, or a government agency contracting on behalf of an education entity, must require the provisions that section 53E-9-309(2)(a)(i) lists in the contract.
The required provisions are the requirements and restrictions on the contractor's collection, use, storage, or sharing of student data that the education entity needs to ensure compliance, a description of the persons with whom the contractor may share student data, deletion provisions at the education entity's request, a bar on secondary use of personally identifiable student data if the education entity requires it, an agreement that the education entity may audit the contractor, and a description of the entity's statutory duty to terminate the contract after a privacy violation without any fee or financial liability for the termination.
Within 30 days after it discovers a third-party contractor's unauthorized usage of student data in violation of state or federal privacy laws, the education entity or government agency must give the contractor notice of the violation and of the duty to terminate the contract.
No sooner than 30 days after that notice, the education entity or government agency must terminate the contract if the contractor does not remedy the privacy violation to the greatest extent practicable and establish processes and procedures to prevent the failure of compliance from re-occurring. On a credible report of a suspected violation, the state board student data privacy team must initiate a compliance audit or investigation of the relevant third-party contractor.
A third-party contractor is a person who is not an education entity and who, under a contract with an education entity, collects or receives student data to provide a product or service, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .