§ 53H-14-502 — State student data protection governance.

(1) The state privacy auditor shall establish a higher education privacy advisory group to advise institutions and institution boards of trustees on student data protection.
(2) The advisory group shall consist of:
(2)(a) the state privacy auditor;
(2)(b) the higher education privacy officer; and
(2)(c) the following members, appointed by the commissioner:
(2)(c)(i) at least one Utah System of Higher Education employee; and
(2)(c)(ii) at least one representative of the Utah Board of Higher Education.
(3) The advisory group shall:
(3)(a) discuss and make recommendations to the board and institutions regarding:
(3)(a)(i) existing and proposed:
(3)(a)(i)(A) board rules; or
(3)(a)(i)(B) board policies of the Utah Board of Higher Education or institutions; and
(3)(a)(ii) training on protecting student data privacy; and
(3)(b) perform other tasks related to student data protection as designated by the Utah Board of Higher Education.
(4) The higher education privacy officer shall:
(4)(a) provide training and support to institution boards and employees; and
(4)(b) produce:
(4)(b)(i) resource materials;
(4)(b)(ii) model data governance plans;
(4)(b)(iii) model forms for institution student data protection governance; and
(4)(b)(iv) a model data collection notice.
(5) The board shall:
(5)(a) (5)(a)(i) create and maintain a data governance plan; and
(5)(a)(ii) annually publish the data governance plan on the Utah System of Higher Education website; and
(5)(b) establish standards for:
(5)(b)(i) institution policies to protect student data;
(5)(b)(ii) institution data governance plans; and
(5)(b)(iii) a third-party contractor's use of student data.

Legislative History

Renumbered and Amended by Chapter 8, 2025 Special Session 1