§ 53E-9-302 — State student data protection governance.

(1) (1)(a) An education entity or a third-party contractor who collects, uses, stores, shares, or deletes student data shall protect student data as described in this part.
(1)(b) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the state board shall make rules to administer this part, including student data protection standards for public education employees, student aides, and volunteers.
(2) The state board shall oversee the preparation and maintenance of:
(2)(a) a statewide data governance plan; and
(2)(b) a state-level metadata dictionary.
(3) (3)(a) The state board shall establish a student data protection advisory group to oversee student data protection in the state.
(3)(b) The student data protection advisory group shall be composed of:
(3)(b)(i) members from the Legislature;
(3)(b)(ii) members from the state board;
(3)(b)(iii) the state student data officer;
(3)(b)(iv) one or more LEAs;
(3)(b)(v) state board employees; and
(3)(b)(vi) others who use student data at the local level.
(3)(c) The student data protection advisory group shall:
(3)(c)(i) make recommendations to the state board regarding:
(3)(c)(i)(A) enacted or proposed legislation; and
(3)(c)(i)(B) state and local student data protection policies across the state;
(3)(c)(ii) review and monitor the state student data governance plan; and
(3)(c)(iii) perform other tasks related to student data protection as directed by the state board.
(4) (4)(a) The state board shall designate a state student data officer.
(4)(b) The state student data officer shall:
(4)(b)(i) act as the primary point of contact for state student data protection administration in assisting the state board to administer this part;
(4)(b)(ii) ensure compliance with student privacy laws throughout the public education system, including:
(4)(b)(ii)(A) providing training and support to applicable state board and LEA employees; and
(4)(b)(ii)(B) producing resource materials, model plans, and model forms for local student data protection governance, including a model student data collection notice;
(4)(b)(iii) investigate complaints of alleged violations of this part;
(4)(b)(iv) report violations of this part to:
(4)(b)(iv)(A) the state board;
(4)(b)(iv)(B) an applicable education entity; and
(4)(b)(iv)(C) the student data protection advisory group; and
(4)(b)(v) act as a state level student data manager.
(5) The state board shall designate:
(5)(a) at least one support manager to assist the state student data officer; and
(5)(b) a student data protection auditor to assist the state student data officer.
(6) The state board shall establish a research review process for a request for data for the purpose of research or evaluation.

Legislative History

Amended by Chapter 20, 2024 General Session