HB 55 — Privacy Compliance for Education Technology Vendors

55 Enrolled Copy contractor did not use student data, shared by or collected on behalf of an education entity, to market the educational application or product;

(c) use a recommendation engine to recommend to a student:

(i) content that relates to learning or employment, within the third-party contractor's application, if the recommendation is not motivated by payment or other consideration from another party;

or (ii) services that relate to learning or employment, within the third-party contractor's application, if the recommendation is not motivated by payment or other consideration from another party;

[(d) respond to a student request for information or feedback, if the content of the response is not motivated by payment or other consideration from another party;] [(e)] (d) use student data to allow or improve operability and functionality of the third-party contractor's application;

or [(f)] (e) identify for a student nonprofit institutions of higher education or scholarship providers that are seeking students who meet specific criteria if the criteria does not include a personal identity characteristic as that term is defined in Section 53B-1-118:

(i) regardless of whether the identified nonprofit institutions of higher education or scholarship providers provide payment or other consideration to the third-party contractor;

and (ii) only if the third-party contractor obtains authorization in writing from:

(A) a student's parent through the student's school or LEA;

or (B) for an adult student, the student.

(5) At the completion of a contract with an education entity, if the contract has not been renewed, a third-party contractor shall return or delete [upon the education entity's request ]all personally identifiable student data under the control of the education entity unless [a student or ]the student's parent [consents] gives written consent to the third-party contractor's maintenance of the personally identifiable student data.

(6)(a) A third-party contractor may not:

(i) except as provided in Subsection (6)(b), sell student data;

(ii) collect, use, or share student data, if the collection, use, or sharing of the student data is inconsistent with the third-party contractor's contract with the education entity;

or (iii) use student data for targeted advertising.

(b) A person may obtain student data through the purchase of, merger with, or otherwise - 4 - Enrolled Copy H.B.

55 acquiring a third-party contractor if the third-party contractor remains in compliance with this section.

(7) The provisions of this section do not:

(a) apply to the use of a general audience application, including the access of a general audience application with login credentials created by a third-party contractor's application;

(b) apply if the student data is shared in accordance with the education entity's directory information policy, as described in 34 C.F.R.

99.37;

(c) apply to the providing of Internet service;

or (d) impose a duty on a provider of an interactive computer service, as defined in 47 U.S.C.

6501 et seq., and any associated regulations, provide notice to the third-party contractor of:

{(A)} {the violation of the relevant state or federal privacy law;

and} {(B)} {the education entity's or government agency's duty to terminate the contract under Subsection (2)(a)(iii);

and} (iii) {no sooner than 30 days after the day on which the education entity or government agency provides the notice described in Subsection (2)(a)(ii), terminate the contract with the third-party contractor if the contractor does not:} {(A)} {remedy the privacy violation to the greatest extent practicable, in the determination of the education entity or government agency;

and} {(B)} {establish processes and procedures to prevent the failure of compliance from re-occurring.} - 4 - HB0055 compared with HB0055S01 {(b)} A third-party contractor may not impose a fee, seek damages, or otherwise assert any financial liability against an education entity or government agency that terminates a contract as a consequence of the contractor's unauthorized { Ĥ→ {} {[} {sale} A third-party contractor may:{]} usage} (a) { ←Ĥ } of student data or information in violation of a relevant state or federal privacy law under Subsection (2)(a)(iii).

80a Ĥ→ {(c)} {(i) A person may submit a report of a suspected violation directly to the state board student data privacy team, through a reporting process that state board policy establishes.} 80d {(ii) Upon receipt of a report described in Subsection (2)(c)(i), the state board student data privacy team shall, in accordance with state board policies and procedures:} 80g {(A) {conduct an initial review to determine whether the report is credible, relevant, and sufficiently specific to warrant action;

and} 80i {(B)} if the report meets the standard described in Subsection ((2)(c)(ii)(A), initiate a compliance audit or investigation of the relevant { Ĥ→ {} {[} {vendor or} use student data for adaptive learning or customized student learning purposes;{]} third-party} (b) { ←Ĥ } contractor.{{ ←Ĥ } 80k { Ĥ→ [(d)} { Ĥ→ } {} {The state board, through } market an educational application or product to a parent of a student if the {state board's } third-party contractor did not use student data {privacy team} , shared by or collected on behalf of an education entity, {in } to market the educational application or product;]} (c) {{ ←Ĥ } { Ĥ→ } {} {[} {conjunction with the relevant LEA, and in accordance with state board policies and } use a recommendation engine to recommend to a student:]} (i) {{ ←Ĥ } { Ĥ→ } {} {[} {procedures} content that relates to learning or employment, {shall conduct a compliance audit } within {six months of:} the third-party contractor's application, if the recommendation is not motivated by payment or other consideration from another party;

or]} (ii) {{ ←Ĥ } 80n {[(i)} { Ĥ→ } {} {the execution of any new or renewed contract between an LEA and a } services that relate to learning or employment, within the third-party contractor's application, if the recommendation is not motivated by payment or other consideration from another party;]} - 5 - HB0055 compared with HB0055S01 [(d) {{ ←Ĥ } { Ĥ→ } {} [} {third-party contractor that is subject } respond to {this section;

or} a student request for information or feedback, if the content of the response is not motivated by payment or other consideration from another party;{]{} { ←Ĥ } 80p {[(ii)} { Ĥ→ } } ] [(e)] (d) {the creation } use student data to allow or improve operability and functionality of the third- party contractor's application;

or {revision of a data privacy agreement.]} [(f)] (e) {{ ←Ĥ } 80pi {(d)} {To combat data protection misunderstandings or misconceptions, state board staff shall create materials or resources to be made available to third-party contractors.}{} { ←Ĥ } {(3)} As authorized by law or court order, } identify for a {third-party contractor shall share } student {data as requested by law enforcement.} nonprofit institutions of higher education or scholarship providers that are seeking students who meet specific criteria {(4)} if the criteria does not include a personal identity characteristic as that term is defined in Section 53B-1-118{A third-party contractor may} :

{(a)} (i) {use student data for adaptive learning } regardless of whether the identified nonprofit institutions of higher education or {customized student learning purposes;} scholarship providers provide payment or other consideration to the third-party contractor;

and {(b)} (ii) {market an educational application or product to a parent of a student } only if the third- party contractor {did not use student data, shared by or collected on behalf of an education entity, to market the educational application or product;} obtains authorization in writing from:

{(c)} (A) {use } a {recommendation engine to recommend to a student:} student's parent through the student's school or LEA;

or {(i)} (B) {content that relates to learning or employment} for an adult student, {within the third-party contractor's application, if the recommendation is not motivated by payment or other consideration from another party;

or} the student.

{(ii)} (5) {services that relate to learning or employment, within the third-party contractor's application} At the completion of a contract with an education entity, if the {recommendation is } contract has not {motivated by payment or other consideration from another party;} been renewed, a third-party contractor shall return or delete {[(d)} [{respond to a student request for information or feedback, if } upon the {content of the response is not motivated by payment or other consideration from another party;} education entity's request ] - 6 - HB0055 compared with HB0055S01 {[(e)] (d)} use } all personally identifiable student data {to allow or improve operability and functionality } under the control of the {third-party contractor's application;

or} education entity unless {[(f)] (e)} [{identify for } a student {nonprofit institutions of higher education or scholarship providers that are seeking students who meet specific criteria} or ]{ if the criteria does not include a personal identity characteristic as that term is defined in Section 53B-1-118:} the student's parent {(i)} [{regardless of whether the identified nonprofit institutions of higher education or scholarship providers provide payment or other consideration to the third-party contractor;

and} consents {(ii)} ] gives written consent{only if } to the {third-party contractor obtains authorization in writing from:

{(A)} third-party contractor's {a student's parent through } maintenance of the {student's school or LEA;

or} personally identifiable student data.

{(B)} (6) (a) {for an adult student, the student.} A third-party contractor may not:

{(5)} (i) {At the completion of a contract with an education entity} except as provided in Subsection (6)(b), {if the contract has not been renewed, a third-party contractor shall return or delete } sell student data;

(ii) { Ĥ→ {} {[} {upon } collect, use, or share student data, if the collection, use, or sharing of the student data is inconsistent with the third-party contractor's contract with the education {entity's } entity;

or (iii) {request } use student data for targeted advertising.{]} (b) {{ ←Ĥ } all personally identifiable } A person may obtain student data {under } through the {control } purchase of {the education entity unless } , merger with, or otherwise acquiring a third-party contractor if the third-party contractor remains in compliance with this section.

(7) { Ĥ→ {} {[} {a student or } The provisions of this section do not:]} (a) {{ ←Ĥ } the student's parent } apply to the use of a general audience application, including the access of a general audience application with login credentials created by a third-party contractor's application;

(b) { Ĥ→ {} {[} {consents} apply if the student data is shared in accordance with the education entity's directory information policy, as described in 34 C.F.R.

99.37;{]} gives written consent} - 7 - HB0055 compared with HB0055S01 (c) { ←Ĥ } apply to the providing of Internet service;

or (d) { Ĥ→ {} {third-party contractor's }{} { ←Ĥ } maintenance } impose a duty on a provider of {the personally identifiable student data} an interactive computer service, as defined in 47 U.S.C.

Sec.

{(6)} (8) {(a)} A {provisionprovision of this section that relates to a student's student data does not apply to a } third-party contractor {ifif the education entity or third-party contractor obtains authorization from the following individual, in writing, to waive that provision}provision: may not:

{(i)} (a) {except as provided in Subsection (6)(b)} the student's parent, {sell } if the student is not an adult studentstudent; {data} ;or {(ii)} (b) {collect, use, or share } the student {data} , if the {collection, use, or sharing of the student data } student is {inconsistent with the third-party contractor's contract with the education entity;

or}or (b) the student, if the student is an adult student.

(iii)Section {use2. student data for targeted advertising.} {(b)} {A person may obtain student data through the purchase of, merger with, or otherwise acquiring a third-party contractor if the third-party contractor remains in compliance with this section.} {(7)} {The provisions of this section do not:} {(a)} {apply to the use of a general audience application, including the access of a general audience application with login credentials created by a third-party contractor's application;} {(b)} {apply if the student data is shared in accordance with the education entity's directory information policy, as described in 34 C.F.R.

99.37;} {(c)} {apply to the providing of Internet service;

or} {(d)} {impose a duty on a provider of an interactive computer service, as defined in 47 U.S.C.

Sec.

230, to review or enforce compliance with this section.} {(8)} {A provision of this section that relates to a student's student data does not apply to a third-party contractor if the education entity or third-party contractor obtains authorization from the following individual, in writing, to waive that provision:} {(a)} {the student's parent, if the student is not an adult student;

or} {(b)} {the student, if the student is an adult student.} Section 2.

Section 2 is enacted to read:

53F-2-402.5.

Rural school district transportation grants.

- 8 - HB0055 compared with HB0055S01 (1) As used in this section:

(a) "Eligible school" means a public school within a school district:

(i) located in a county of the fourth, fifth, or sixth class, as defined in Section 17-50-501;

or (ii) with fewer than 3,000 students enrolled in the school district.

(b) "Extended trip" means a school bus trip to a school-sponsored event, including an athletic competition, academic competition, or club activity, that requires a student in grades 7 through 12 to travel more than 60 minutes one-way.

(c) "Rural school district" means a school district that operates one or more eligible schools.

(2) Subject to legislative appropriations, the state board shall distribute grant money to rural school districts to install and operate internet connectivity systems on school buses used for extended trips.

(3) A rural school district may apply to the state board for a grant under this section.

(4) The state board may award a grant to a rural school district that:

(a) operates one or more school bus routes that qualify as extended trips under Subsection (1)(b);

(b) submits an application in accordance with state board rule;

and (c) agrees to the requirements in Subsection (7).

(5) In awarding grants under this section, the state board shall give preference to rural school districts that do not currently have internet connectivity systems on school buses used for extended trips.

(6) Notwithstanding Subsection (5):

(a) subject to legislative appropriations, the state board shall ensure each eligible rural school district receives funding for at least two school buses;

and (b) the state board may not award a grant to a district in an amount that exceeds the total cost to:

(i) retrofit two school buses with internet connectivity systems;

and (ii) pay for internet connectivity services for two school buses for one year.

(7) A rural school district that receives a grant under this section shall:

(a) use grant money to:

(i) retrofit school buses with internet connectivity systems;

and (ii) provide internet access through a terrestrial wireless provider or a satellite internet service provider;

(b) assume responsibility for the cost of internet connectivity services after the grant money for services described in Subsection (7)(a)(ii) is expended;

(c) maintain internet connectivity systems and services on the retrofitted school buses for at least three years after receiving the grant;

- 9 - HB0055 compared with HB0055S01 (d) where applicable, coordinate with the Utah Education and Telehealth Network in the implementation and operation of internet connectivity systems;

(e) ensure that internet connectivity provided on school buses under this section complies with the same content filtering and internet safety policies that apply to internet access in the district's school buildings;

and (f) comply with reporting requirements established by the state board in rule under Subsection (10).

(8) A rural school district may:

(a) use grant money awarded under this section in combination with the district's own funds to:

(i) retrofit more than two school buses with internet connectivity systems;

or (ii) pay for more than one year of internet connectivity services for school buses;

and (b) if the cost of internet connectivity systems and services is less than the grant award amount, use remaining grant funds to:

(i) retrofit additional school buses with internet connectivity systems;

(ii) pay for additional years of internet connectivity services;

or (iii) retrofit school buses other than those used for extended trips, after at least two school buses used for extended trips have been retrofitted.

(9) If a grant recipient fails to maintain internet connectivity systems and services for the three-year period required under Subsection (7)(c), the state board may require the district to repay all or a portion of the grant money.

(10) The state board shall make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to implement this section, including rules that establish:

(a) the grant application process and timeline;

(b) required elements of a grant application;

(c) a methodology for determining:

(i) the total cost to retrofit two school buses with internet connectivity systems;

and (ii) the annual cost for internet connectivity services for two school buses for one year for purposes of the cap described in Subsection (6)(b);

and (d) reporting requirements for grant recipients.

Section .

FY 2027 Appropriations.

The following sums of money are appropriated for the fiscal year beginning July 1, 2026, and ending June 30, 2027.

These are additions to amounts previously appropriated for - 10 - HB0055 compared with HB0055S01 fiscal year 2027.

Subsection 3(a).

Operating and Capital Budgets Under the terms and conditions of Title 63J, Chapter 1, Budgetary Procedures Act, the Legislature appropriates the following sums of money from the funds or accounts indicated for the use and support of the government of the state of Utah.

TEM 1 To State Board of Education - Contracted Initiatives and Grants From Public Education Economic Stabilization Restricted Account, One-time 325,000 Schedule of Programs:

Contracts and Grants 325,000 Section 4.

Effective date.

2-11-26 4:06 PM - 115 -