Enter to open, tab to navigate, enter to select
Utah Amends Student Data Privacy and Related Laws
Practical Law Legal Update w-038-8972 (Approx. 3 pages)
Utah Amends Student Data Privacy and Related Laws
by Practical Law Data Privacy & Cybersecurity
| Published on 21 Mar 2023 • Utah |
Utah has enacted SB 265, which amends its student data privacy and related laws in various ways, including creating a timeline for existing third-party contracting requirements, applying penalties directly to third-party contractors for violations, and limiting student data sharing with federal agencies.
On March 17, 2023, Utah Governor Spencer Cox signed SB 265, amending the state's student data privacy and related laws (Utah Code §§ 53B-28-505, 53B-28-506, 53E-3-511, 53E-9-302, and 53E-9-308). The amendments:
- Create a timeline for existing third-party contracting requirements, applying them to education entity and agency agreements made with third-party contractors on or after January 1, 2024.
- Effective January 1, 2024, apply penalties directly to third-party contractors for knowingly or recklessly permitting unauthorized collecting, sharing, or use of student data, including:
- prohibiting them from entering into future contracts unless an education entity determines that they have remediated the prior violations and can demonstrate current compliance;
- levying a potential civil penalty of up to $25,000;
- requiring them to pay an institution's costs to notify parents and students of the unauthorized student data sharing or use and other expenses it incurs as a result of that sharing or use; and
- creating a private cause of action for a student or minor student's parent to recover damages and costs from the third-party contractor.
- Extend the deadline for the State Board of Education to integrate data collected in specified state systems with local education agencies and make it available in an easily accessible viewing format to a student's parent and authorized agency users to July 1, 2024.
- Effective July 1, 2023:
- require the State Board of Education to implement security measures ensuring that authorized local education agency users share only aggregate or de-identified student data from specified state student data systems, except under limited circumstances;
- limit education entities' student data sharing with federal agencies to only when required by federal law; and
- make other technical changes.