Utah Code Title 53E. Public Education System--State Administration § 53E-9-309. Third-party contractors

(a) requirements and restrictions related to the collection, use, storage, or sharing of student data by the third-party contractor that are necessary for the education entity to ensure compliance with the provisions of this part and state board rule;

(b) a description of a person, or type of person, including an affiliate of the third-party contractor, with whom the third-party contractor may share student data;

(c) provisions that, at the request of the education entity, govern the deletion of the student data received by the third-party contractor;

(d) except as provided in Subsection (4) and if required by the education entity, provisions that prohibit the secondary use of personally identifiable student data by the third-party contractor; and

(e) an agreement by the third-party contractor that, at the request of the education entity that is a party to the contract, the education entity or the education entity’s designee may audit the third-party contractor to verify compliance with the contract.

(a) use student data for adaptive learning or customized student learning purposes;

(b) market an educational application or product to a parent of a student if the third-party contractor did not use student data, shared by or collected on behalf of an education entity, to market the educational application or product;

(c) use a recommendation engine to recommend to a student:

(d) respond to a student request for information or feedback, if the content of the response is not motivated by payment or other consideration from another party;

(e) use student data to allow or improve operability and functionality of the third-party contractor’s application; or

(f) identify for a student nonprofit institutions of higher education or scholarship providers that are seeking students who meet specific criteria:

(6)(a) A third-party contractor may not:

(b) A person may obtain student data through the purchase of, merger with, or otherwise acquiring a third-party contractor if the third-party contractor remains in compliance with this section.

(a) apply to the use of a general audience application, including the access of a general audience application with login credentials created by a third-party contractor’s application;

(b) apply if the student data is shared in accordance with the education entity’s directory information policy, as described in 34 C.F.R. 99.37;

(c) apply to the providing of Internet service; or

(d) impose a duty on a provider of an interactive computer service, as defined in 47 U.S.C. Sec. 230, to review or enforce compliance with this section.

(a) the student’s parent, if the student is not an adult student; or

(b) the student, if the student is an adult student.