§ 22-16-109 — School service contract provider - use of data

(1) (a) A school
service contract provider may collect, use, and share student personally identifiable
information only for the purposes authorized in the contract between the school
service contract provider and a public education entity or with the consent of the
student who is the subject of the information or the student's parent.

(b) A school service contract provider must obtain the consent of the student
or the student's parent before using student personally identifiable information in a
manner that is materially inconsistent with the school service contract provider's
privacy policy or materially inconsistent with the contract between the school
service contract provider and the public education entity that applies to the
collection of the student personally identifiable information.

(2) A school service contract provider shall not:

(a) Sell student personally identifiable information; except that this
prohibition does not apply to the purchase, merger, or other type of acquisition of a
school service contract provider, or any assets of a school service contract provider,
by another entity, so long as the successor entity continues to be subject to the
provisions of this article with respect to student personally identifiable information
that the school service contract provider acquired while subject to the provisions of
this article;

(b) Use or share student personally identifiable information for purposes of
targeted advertising to students; or

(c) Use student personally identifiable information to create a personal
profile of a student other than for supporting purposes authorized by the
contracting public education entity or with the consent of the student or the
student's parent.

(3) Notwithstanding any provision of paragraph (b) of subsection (1) or of
subsection (2) of this section to the contrary:

(a) (I) A school service contract provider may use or disclose student
personally identifiable information to:

(A) Ensure legal or regulatory compliance or to take precautions against
liability;

(B) Respond to or participate in the judicial process;

(C) Protect the safety of users or others on the school service contract
provider's website, online service, online application, or mobile application; or

(D) Investigate a matter related to public safety.

(II) If a school service contract provider uses or discloses student personally
identifiable information as allowed in subparagraph (I) of this paragraph (a), the
contract provider shall notify the contracting public education entity as soon as
possible after the use or disclosure of the information.

(b) A school service contract provider may use, or disclose student
personally identifiable information to, a subcontractor only if the school service
contract provider contractually requires the subcontractor to comply with section
22-16-108, this section, and sections 22-16-110 and 22-16-111. The provisions of this
paragraph (b) apply to the ability of an initial or subsequent subcontractor to
further subcontract. If a public education entity determines that an initial or
subsequent subcontractor has committed a material breach of the contract that
involves the misuse or unauthorized release of student personally identifiable
information, the public education entity shall comply with the requirements of
section 22-16-105 (5)(a) or 22-16-107 (2)(a), as applicable; except that the public
education entity is not required to consider terminating the contract if the school
service contract provider terminates the contract with the subcontractor as soon as
possible after the contract provider knows or has reason to know of the initial or
subsequent subcontractor's material breach.

(4) For purposes of this section and section 22-16-110, a student may consent
to the use, sharing, or retention of the student's student personally identifiable
information only if the student is at least eighteen years of age or legally
emancipated.

Legislative History

Source: L. 2016: Entire article added, (HB 16-1423), ch. 355, p. 1471, � 1, effective August 10.