As used in this part:
(1) "Adult student" means a student who:
(1)(a) is at least 18 years old;
(1)(b) is an emancipated student; or
(1)(c) qualifies under the McKinney-Vento Homeless Education Assistance Improvements Act of 2001, 42 U.S.C. Sec. 11431 et seq.
(2) "Aggregate data" means data that:
(2)(a) are totaled and reported at the group, cohort, school, school district, region, or state level with at least 10 individuals in the level;
(2)(b) do not reveal personally identifiable student data; and
(2)(c) are collected in accordance with state board rule.
(3) (3)(a) "Biometric identifier" means a:
(3)(a)(i) retina or iris scan;
(3)(a)(ii) fingerprint;
(3)(a)(iii) human biological sample used for valid scientific testing or screening; or
(3)(a)(iv) scan of hand or face geometry.
(3)(b) "Biometric identifier" does not include:
(3)(b)(i) a writing sample;
(3)(b)(ii) a written signature;
(3)(b)(iii) a voiceprint;
(3)(b)(iv) a photograph;
(3)(b)(v) demographic data; or
(3)(b)(vi) a physical description, such as height, weight, hair color, or eye color.
(4) "Biometric information" means information, regardless of how the information is collected, converted, stored, or shared:
(4)(a) based on an individual's biometric identifier; and
(4)(b) used to identify the individual.
(5) "Data breach" means an unauthorized release of or unauthorized access to personally identifiable student data that is maintained by an education entity.
(6) "Data governance plan" means an education entity's comprehensive plan for managing education data that:
(6)(a) incorporates reasonable data industry best practices to maintain and protect student data and other education-related data;
(6)(b) describes the role, responsibility, and authority of an education entity data governance staff member;
(6)(c) provides for necessary technical assistance, training, support, and auditing;
(6)(d) describes the process for sharing student data between an education entity and another person;
(6)(e) describes the education entity's data expungement process, including how to respond to requests for expungement;
(6)(f) describes the data breach response process; and
(6)(g) is published annually and available on the education entity's website.
(7) "Education entity" means:
(7)(a) the state board;
(7)(b) a local school board;
(7)(c) a charter school governing board;
(7)(d) a school district;
(7)(e) a charter school; or
(7)(f) the Utah Schools for the Deaf and the Blind.
(8) "Expunge" means to seal or permanently delete data, as described in state board rule made in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, under Section 53E-9-306.
(9) "General audience application" means an Internet website, online service, online application, mobile application, or software program that:
(9)(a) is not specifically intended for use by an audience member that attends kindergarten or a grade from 1 to 12, although an audience member may attend kindergarten or a grade from 1 to 12; and
(9)(b) is not subject to a contract between an education entity and a third-party contractor.
(10) "Local education agency" or "LEA" means:
(10)(a) a school district;
(10)(b) a charter school; or
(10)(c) the Utah Schools for the Deaf and the Blind.
(11) "Metadata dictionary" means a record that:
(11)(a) defines and discloses all personally identifiable student data collected and shared by the education entity;
(11)(b) comprehensively lists all recipients with whom the education entity has shared personally identifiable student data, including:
(11)(b)(i) the purpose for sharing the data with the recipient;
(11)(b)(ii) the justification for sharing the data, including whether sharing the data was required by federal law, state law, or a local directive; and
(11)(b)(iii) how sharing the data is permitted under federal or state law; and
(11)(c) without disclosing personally identifiable student data, is displayed on the education entity's website.
(12) "Necessary student data" means data required by state statute or federal law to conduct the regular activities of an education entity, including:
(12)(a) name;
(12)(b) date of birth;
(12)(c) sex;
(12)(d) parent contact information;
(12)(e) custodial parent information;
(12)(f) contact information;
(12)(g) a student identification number;
(12)(h) local, state, and national assessment results or an exception from taking a local, state, or national assessment;
(12)(i) courses taken and completed, credits earned, and other transcript information;
(12)(j) course grades and grade point average;
(12)(k) grade level and expected graduation date or graduation cohort;
(12)(l) degree, diploma, credential attainment, and other school exit information;
(12)(m) attendance and mobility;
(12)(n) drop-out data;
(12)(o) immunization record or an exception from an immunization record;
(12)(p) race;
(12)(q) ethnicity;
(12)(r) tribal affiliation;
(12)(s) remediation efforts;
(12)(t) an exception from a vision screening required under Section 53G-9-404 or information collected from a vision screening described in Section 53G-9-404;
(12)(u) information related to the Utah Registry of Autism and Developmental Disabilities, described in Section 26B-7-115;
(12)(v) student injury information;
(12)(w) a disciplinary record created and maintained as described in Section 53E-9-306;
(12)(x) juvenile delinquency records;
(12)(y) English language learner status; and
(12)(z) child find and special education evaluation data related to initiation of an IEP.
(13) (13)(a) "Optional student data" means student data that is not:
(13)(a)(i) necessary student data; or
(13)(a)(ii) student data that an education entity may not collect under Section 53E-9-305.
(13)(b) "Optional student data" includes:
(13)(b)(i) information that is:
(13)(b)(i)(A) related to an IEP or needed to provide special needs services; and
(13)(b)(i)(B) not necessary student data;
(13)(b)(ii) biometric information; and
(13)(b)(iii) information that is not necessary student data and that is required for a student to participate in a federal or other program.
(14) "Parent" means:
(14)(a) a student's parent;
(14)(b) a student's legal guardian; or
(14)(c) an individual who has written authorization from a student's parent or legal guardian to act as a parent or legal guardian on behalf of the student.
(15) (15)(a) "Personally identifiable student data" means student data that identifies or is used by the holder to identify a student.
(15)(b) "Personally identifiable student data" includes:
(15)(b)(i) a student's first and last name;
(15)(b)(ii) the first and last name of a student's family member;
(15)(b)(iii) a student's or a student's family's home or physical address;
(15)(b)(iv) a student's email address or other online contact information;
(15)(b)(v) a student's telephone number;
(15)(b)(vi) a student's social security number;
(15)(b)(vii) a student's biometric identifier;
(15)(b)(viii) a student's health or disability data;
(15)(b)(ix) a student's education entity student identification number;
(15)(b)(x) a student's social media user name and password or alias;
(15)(b)(xi) if associated with personally identifiable student data, the student's persistent identifier, including:
(15)(b)(xi)(A) a customer number held in a cookie; or
(15)(b)(xi)(B) a processor serial number;
(15)(b)(xii) a combination of a student's last name or photograph with other information that together permits a person to contact the student online;
(15)(b)(xiii) information about a student or a student's family that a person collects online and combines with other personally identifiable student data to identify the student; and
(15)(b)(xiv) information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.
(16) "School official" means an employee or agent of an education entity, if the education entity has authorized the employee or agent to request or receive student data on behalf of the education entity.
(17) (17)(a) "Student data" means information about a student at the individual student level.
(17)(b) "Student data" does not include aggregate or de-identified data.
(18) "Student data manager" means:
(18)(a) the state student data officer; or
(18)(b) an individual designated as a student data manager by an education entity under Section 53E-9-303, who fulfills the duties described in Section 53E-9-308.
(19) (19)(a) "Targeted advertising" means presenting advertisements to a student where the advertisement is selected based on information obtained or inferred over time from that student's online behavior, usage of applications, or student data.
(19)(b) "Targeted advertising" does not include advertising to a student:
(19)(b)(i) at an online location based upon that student's current visit to that location; or
(19)(b)(ii) in response to that student's request for information or feedback, without retention of that student's online activities or requests over time for the purpose of targeting subsequent ads.
(20) "Third-party contractor" means a person who:
(20)(a) is not an education entity; and
(20)(b) pursuant to a contract with an education entity, collects or receives student data in order to provide a product or service, as described in the contract, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service.
(21) "Written consent" means written authorization to collect or share a student's student data, from:
(21)(a) the student's parent, if the student is not an adult student; or
(21)(b) the student, if the student is an adult student.