Law / United States / 
Utah
Disclosure of educational data: a student's right to access it, informed consent before an institution discloses it, and limits on a third party that receives it
Utah Code 53H-7-1001 and 53H-7-1002
In force since .
A data subject rights rule binding public and private bodies.
- Private right of action
- Yes
- Obligation class
- Data subject rights, Consent, Disclosure
What it requires
- If you are a Utah public college, university or technical college, disclose a student's educational data only with the student's informed consent, according to the terms of the consent document, and subject to the receiving third party's agreement to use the data only as the document provides and not to redisclose it, except as the Family Educational Rights and Privacy Act provides (Utah Code 53H-7-1002(3)).
- When obtaining consent, allow the student to review all consent information and to revoke consent at any time, and do not bundle unrelated terms or conditions with the request; from offer a secure digital or electronic mechanism as the primary method for obtaining informed consent, and allow written consent where a digital mechanism is not reasonably available (Utah Code 53H-7-1002(2)(b) to (d)).
- Do not deny, delay, or restrict a student's ability to grant informed consent, do not require a student to waive unrelated rights or agree to unrelated terms as a condition of consent, and do not impose an access limitation that restricts the student's underlying right to access the data, prevents a request for renewed access, or limits the student's ability to give consent (Utah Code 53H-7-1002(6)).
- If you are a third party that receives a student's educational data from a Utah public college, university or technical college, use it only as the consent document provides and do not redisclose it; if you receive the educational data of more than 10 students, comply with the data privacy requirements of the Utah Board of Higher Education and the institution's student data protection policies (Utah Code 53H-7-1002(3)(c) and (4)).
These lines are LexLint's reading of the law's text.
What this law does
A student who is currently enrolled in, or was previously enrolled in, an institution has the right to access the student's educational data and to authorize access to it.
Except as the Family Educational Rights and Privacy Act provides, an institution may disclose a student's educational data only with the student's informed consent, according to the terms of the consent document, and subject to the receiving third party's agreement to use the data only as the document provides and not to redisclose it.
Beginning , an institution must offer a secure digital or electronic mechanism as the primary method for obtaining informed consent, and must allow written consent if a digital or electronic mechanism is not reasonably available to the student. When obtaining consent, an institution must allow the student to review all consent information before authorization and to revoke consent at any time, and must not bundle unrelated terms or conditions with the consent request.
An institution may not deny, delay, or restrict a student's ability to grant informed consent, may not require a student to waive unrelated rights or agree to unrelated terms as a condition of granting consent, and may not impose an access limitation that restricts the student's underlying right to access the data, prevents the student from requesting renewed access, or limits the student's ability to give consent.
A third party that receives the educational data of more than 10 students is subject to the data privacy requirements the Utah Board of Higher Education makes and to the policies regarding the protection of student data the institution adopts. A student whose educational data is shared because a third party failed to comply with the section has a private right of action against the third party and has none against the institution. Educational data means a student's transcript data, enrollment information, course history, and academic credentials.
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .