Law / United States / 
Utah
Student Data Protection: student access to educational data, informed consent to its disclosure to third parties, and a private right of action against a noncompliant third party
In force since .
A sensitive categories rule binding public and private bodies.
- Private right of action
- Yes
- Obligation class
- Consent, Disclosure, Data subject rights
What it requires
- If you are an education entity, let a currently or previously enrolled student, or a parent if the student is under 18, access the student's educational data and authorize access to it (Utah Code 53E-9-311(2)).
- Disclose a student's educational data to a third party only with the student's informed consent, according to the terms of the consent document, and subject to the third party's agreement to use the data only as the document provides and not to redisclose it (Utah Code 53E-9-311(9)).
- Beginning , offer a secure digital or electronic mechanism as the primary method for obtaining informed consent, and allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student (Utah Code 53E-9-311(3)(b) and (c)).
- When you obtain a student's consent through a digital or electronic consent mechanism, let the student review all consent information before authorizing, and do not bundle unrelated terms or conditions with the consent request (Utah Code 53E-9-311(3)(d)).
- Do not deny, delay, or restrict a student's ability to grant informed consent that complies with the section, and do not require a student to waive unrelated rights or agree to unrelated terms as a condition of granting informed consent (Utah Code 53E-9-311(5)(a) and (b)).
- If the student is under 18 years old and the disclosure is to a party other than the student, obtain the parent's consent (Utah Code 53E-9-311(6)(a)).
- If you are a third party that receives the educational data of more than 10 students, meet the data privacy requirements of the Student Data Protection part and the policies and administrative rules the state board adopts to protect student data (Utah Code 53E-9-311(10)).
These lines are LexLint's reading of the law's text.
What this law does
A student who is currently enrolled in or was previously enrolled in an education entity, or a parent if the student is under 18 years old, has the right to access the student's educational data and to authorize access to it. Educational data means a student's transcript data, enrollment information, course history, and academic credentials.
Except as the Family Educational Rights and Privacy Act provides, an education entity may disclose a student's educational data to a third party only with the student's informed consent, according to the terms of the consent document, and subject to the third party's agreement to use the data only as the document provides and not to redisclose it. Beginning , an education entity must offer a secure digital or electronic mechanism as the primary method for obtaining informed consent.
When it obtains consent through a digital mechanism, an education entity must allow the student to review all consent information before authorization and may not bundle unrelated terms or conditions with the consent request. A third party that receives the educational data of more than 10 students is subject to the data privacy requirements of the Student Data Protection part and to the policies and administrative rules the state board adopts to protect student data.
A student whose educational data is shared as a result of a third party's failure to comply with the section has a private right of action against the third party and has none against the education entity. An education entity must allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student.
An education entity may not deny, delay, or restrict a student's ability to grant informed consent that complies with the section, or require a student to waive unrelated rights or agree to unrelated terms as a condition of granting informed consent. If a student is under 18 years old and the disclosure is to a party other than the student, an education entity must obtain the parent's consent in accordance with the section.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .