Utah § 53E-9-310 Penalties.

Utah Statutes

§ 53E-9-310 — Penalties.

Utah·Title 53E Public Education System -- State Administration·Ch. 53E-9 Student Privacy and Data Protection·Part 53E-9-3 Student Data Protection

(1)(1)(a) A third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing, or use of student data under this part:

(1)(a)(i) except as provided in Subsection (1)(b), may not enter into a future contract with an education entity;

(1)(a)(ii) may be required by the state board to pay a civil penalty of up to $25,000; and

(1)(a)(iii) may be required to pay:

(1)(a)(iii)(A) the education entity's cost of notifying parents and students of the unauthorized sharing or use of student data; and

(1)(a)(iii)(B) expenses incurred by the education entity as a result of the unauthorized sharing or use of student data.

(1)(b) An education entity may enter into a contract with a third-party contractor that knowingly or recklessly permitted unauthorized collecting, sharing, or

Free access — add to your briefcase to read the full text and ask questions with AI

(1) (1)(a) A third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing, or use of student data under this part:
(1)(a)(i) except as provided in Subsection (1)(b), may not enter into a future contract with an education entity;
(1)(a)(ii) may be required by the state board to pay a civil penalty of up to $25,000; and
(1)(a)(iii) may be required to pay:
(1)(a)(iii)(A) the education entity's cost of notifying parents and students of the unauthorized sharing or use of student data; and
(1)(a)(iii)(B) expenses incurred by the education entity as a result of the unauthorized sharing or use of student data.
(1)(b) An education entity may enter into a contract with a third-party contractor that knowingly or recklessly permitted unauthorized collecting, sharing, or use of student data if:
(1)(b)(i) the state board or education entity determines that the third-party contractor has corrected the errors that caused the unauthorized collecting, sharing, or use of student data; and
(1)(b)(ii) the third-party contractor demonstrates:
(1)(b)(ii)(A) if the third-party contractor is under contract with an education entity, current compliance with this part; or
(1)(b)(ii)(B) an ability to comply with the requirements of this part.
(1)(c) The state board may assess the civil penalty described in Subsection (1)(a)(ii) in accordance with Title 63G, Chapter 4, Administrative Procedures Act.
(1)(d) (1)(d)(i) The state board may bring an action in a court with jurisdiction under Title 78A, Judiciary and Judicial Administration, if necessary, to enforce payment of the civil penalty described in Subsection (1)(a)(ii).
(1)(d)(ii) Notwithstanding Title 78B, Chapter 3a, Venue for Civil Actions, the state board shall bring an action described in Subsection (1)(d)(i) in the county in which the office of the state board is located if the action is brought in the district court.
(1)(e) An individual who knowingly or intentionally permits unauthorized collecting, sharing, or use of student data may be found guilty of a class A misdemeanor.
(2) (2)(a) A parent or adult student may bring an action in a court with jurisdiction under Title 78A, Judiciary and Judicial Administration, for damages caused by a knowing or reckless violation of Section 53E-9-309 by a third-party contractor.
(2)(b) If the court finds that a third-party contractor has violated Section 53E-9-309, the court may award to the parent or student:
(2)(b)(i) damages; and
(2)(b)(ii) costs.