As used in this part:
(1)"Advisory group" means the institution of higher education privacy advisory group established by the state privacy auditor under Section 53H-14-502.
(2)"Aggregate data" means data that:
(2)(a) are totaled and reported at the group, cohort, class, course, institution, region, or state level, with at least 10 individuals in the level; and
(2)(b) do not reveal personally identifiable student data.
(3)"Data breach" means an unauthorized release of or unauthorized access to personally identifiable student data that an education entity maintains.
(4)"Data governance plan" means an education entity's comprehensive plan for managing education data that:
(4)(a) incorporates reasonable data industry best practices to maintain and protect student data and other education-
Free access — add to your briefcase to read the full text and ask questions with AI
As used in this part:
(1) "Advisory group" means the institution of higher education privacy advisory group established by the state privacy auditor under Section 53H-14-502.
(2) "Aggregate data" means data that:
(2)(a) are totaled and reported at the group, cohort, class, course, institution, region, or state level, with at least 10 individuals in the level; and
(2)(b) do not reveal personally identifiable student data.
(3) "Data breach" means an unauthorized release of or unauthorized access to personally identifiable student data that an education entity maintains.
(4) "Data governance plan" means an education entity's comprehensive plan for managing education data that:
(4)(a) incorporates reasonable data industry best practices to maintain and protect student data and other education-related data;
(4)(b) describes the role, responsibility, and authority of the board or an institution privacy officer;
(4)(c) provides for necessary technical assistance, training, support, and auditing;
(4)(d) describes the process for sharing student data between the education entity and another person;
(4)(e) describes the education entity's data expungement process, including how to respond to requests for expungement;
(4)(f) describes the data breach response process; and
(4)(g) is published annually and available on the institution's website or the Utah System of Higher Education's website.
(5) "Education entity" means the Utah Board of Higher Education or an institution.
(6) "Higher education privacy officer" means a privacy officer that the board designates under Section 53H-14-503.
(7) "Minor" means a person younger than 18 years old.
(8) (8)(a) "Personally identifiable student data" means student data that identifies or is used by the holder to identify a student.
(8)(b) "Personally identifiable student data" includes:
(8)(b)(i) a student's first and last name;
(8)(b)(ii) the first and last name of a student's family member;
(8)(b)(iii) a student's or a student's family's home or physical address;
(8)(b)(iv) a student's email address or other online contact information;
(8)(b)(v) a student's telephone number;
(8)(b)(vi) a student's social security number;
(8)(b)(vii) a student's biometric identifier;
(8)(b)(viii) a student's health or disability data;
(8)(b)(ix) a student's education entity student identification number;
(8)(b)(x) a student's social media user name and password or alias;
(8)(b)(xi) if associated with personally identifiable student data, the student's persistent identifier, including:
(8)(b)(xi)(A) a customer number held in a cookie; or
(8)(b)(xi)(B) a processor serial number;
(8)(b)(xii) a combination of a student's last name or photograph with other information that together permits a person to contact the student online;
(8)(b)(xiii) information about a student or a student's family that a person collects online and combines with other personally identifiable student data to identify the student; and
(8)(b)(xiv) information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.
(9) "State privacy auditor" means the state privacy auditor described in Section 67-3-13.
(10) "Student" means an individual enrolled in an institution.
(11) (11)(a) "Student data" means information about a student at the individual student level.
(11)(b) "Student data" does not include aggregate or de-identified data.
(12) "Third-party contractor" means a person who:
(12)(a) is not an institution or an employee of an institution; and
(12)(b) pursuant to a contract with an education entity, collects or receives student data in order to provide a product or service, as described in the contract, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service.