SB 296 — Student Consent Amendments

and (D){(iv)} academic credentials.

(b){(c)} "Informed consent" means the same as that term is defined in Section 53H-7-1001.

{(2) {Educational data is the property of a student.} } (3){(2)} In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C.

Sec.

1232g, this chapter, and other relevant state and federal privacy laws, {a } student who is currently enrolled in, or has previously been enrolled in, an education entity has the right to:

(a) access the student's educational data;and {(b) {disclose the student's educational data;

and} } (c){(b)} authorize access to the student's educational data in accordance with this section.

(4){(3)} An education entity shall:

(a) {honor } subject to Subsection (9), disclose a student's {informed consent to disclose } educational data {to a third-party the student designates} ;

(c){(d)}(d) when obtaining a student's consent through a digital or electronic consent mechanism:

and (d){(e)}(e) regarding a limitation imposed under Subsection (5)(b):

(i)- clearly2 disclose- theEnrolled limitationCopy atS.B. the time the entity grants access;

296 (i) clearly disclose the limitation at the time the entity grants access;

{(5)(4) {AnAn education entity may:}may }impose {(a)reasonable {allowtime-based informedor consentsession-based inlimitations writtenon form only if a digitalstudent's ortechnical electronicmethod mechanismof isaccess not reasonably available to theeducational student;data.

and}(5) } (b){(4)} An education entity may imposenot: reasonable time-based or session-based limitations on a student's technical method of access to educational data.

(6){(5)} An education entity may not:

- 3 - SB0296 compared with SB0296S01 (b) require a student to waive unrelated rights or agree to unrelated terms as a condition of granting informed consent;

(7){(6)}(6)(a) If a student is {a minor} under 18 years old and the disclosure is to a party other than the student, an education entity shall obtain the parent's consent on behalf of the student in accordance with this section.

(8){(7)}(b) ThisThe sectionrestrictions doesdescribed notin alter,Subsection limit,(5) orapply supersedeto anya rightparent orof obligationa under:student if the student is under 18 years old.

(7) This section does not alter, limit, or supersede any right or obligation under:

(9){(8)}(8) The state board may issue nonbinding guidance regarding best practices for consent mechanisms that comply with the requirements of this section.

(9) AnExcept educationas entityprovided shallin disclosethe aFamily student'sEducational educationalRights dataand toPrivacy aAct, third20 partyU.S.C. under this section only:

Sec.

1232g, an education entity shall disclose a student's educational data to a third party under this section only:

and (c) ifsubject to the purposeagreement of the disclosurethird statedparty inreceiving the document expressing the student's informed consent to the disclosure demonstrates a bona fide educational purposedata: in the student's educational data;

and(i) (d) subject to use the agreementstudent's ofeducational thedata thirdonly partyas receivingprovided in the student'sdocument educationalexpressing data:- 3 - S.B.

(i)296 toEnrolled useCopy the student's educational data only as provided in the document expressing the student's informed consent to the disclosure;

(11)(11)(a) - 4 - SB0296 compared with SB0296S01 (a) A student whose educational data is shared as a result of a violation of a third party's failure to comply with the requirements of this section has a private right of action against the third party.

Section 253H-7-1001 is enacted to read:

53H-7-1001.Part 10.

Student Data 53H-7-1001 .

10.As used in this part:

Student(1) Data"Educational Asdata" usedmeans ina thisstudent's: part:

{(1)(a) }transcript {(a)data; {"Educational data" means, regarding access to or disclosure of the student's data, personally identifiable information an institution maintains from a studenteducation record, as defined in the Family Educational Rights and Privacy Act, 20 U.S.C.

(b) enrollment information;

(c) course history;

and (d) academic credentials.

(2) "Informed consent" means voluntary, affirmative, written authorization complying with the requirements of 34 C.F.R.

1232g.} } (1) "Bona fide educational purpose" means the same as that term is defined in Section 53E-9-311.

(b){(2)} "Educational data" {includes} means a student's:

(i){(a)} transcript data;

(ii){(b)} enrollment information;

(iii){(c)} course history;

and (iv){(d)} academic credentials.

(2){(3)} "Informed consent" means voluntary, affirmative {authorization an individual } , written authorization complying with the requirements of 34 C.F.R.

Sec.

(b){(c)}(c) the {potential } recipient of the educational data disclosure;

(c){(d)}(d) that the student has the right to revoke consent of disclosure of the educational data at any time;

{and}(e) (d){(e)} the scope and duration of the authorization{.}authorization to disclose the educational data;

Section 353H-7-1002 is enacted to read:

53H-7-1002.53H-7-1002 .

{Student ownership } Disclosure of educational data -- Informed consent -- Access and disclosure.

- 54 - SB0296Enrolled comparedCopy withS.B. SB0296S01 {(1) {Educational data is the property of a student.} } (2){(1)} In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C.

296 (1) In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C.

(a) access the student's educational data;and {(b) {disclose the student's educational data;

and}and }(b) (c){(b)} authorize access to the student's educational data in accordance with this section.

(3){(2)}(2) An institution shall:

(a) {honor } subject to Subsection (3), disclose a student's {informed consent to disclose } educational datadata; {to a third-party the student designates} ;

(c) shall allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student;

(c){(d)}(d) when obtaining a student's {consent through a digital or electronic } informed consentconsent: {mechanism} :

{and} (ii) allow the student to revoke consent at any time;

and (ii){(iii)}(iii) prohibit the bundling of unrelated terms or conditions with the consent request;

and (d){(e)}(e) regarding a limitation imposed under Subsection {(4)(b)} (5)(b):

(4){(3)}(3) AnExcept institutionas {may}provided shallin disclosethe aFamily student'sEducational educationalRights dataand underPrivacy thisAct, section20 only:U.S.C.

(a)Sec. {allow } with the informed consent {in written form only if a digital or electronic mechanism is not reasonably available to } of the student;

{and}1232g, (b)an accordinginstitution toshall thedisclose termsa ofstudent's theeducational documentdata expressingunder thethis informedsection consentonly: of the student;

(c)(a) ifwith the purpose of the disclosure stated in the document expressing the informed consent of the studentstudent; to the disclosure demonstrates a bona fide educational purpose for the student's educational data;

and(b) (d)according subject to the agreementterms of the thirddocument partyexpressing receiving the student'sinformed educationalconsent data:of the student;

-and 6(c) -subject SB0296 compared with SB0296S01 (i) to use the student'sagreement educationalof data only as provided in the documentthird expressingparty thereceiving informed consent of the studentstudent's toeducational thedata: disclosure;

(i) to use the student's educational data only as provided in the document expressing the informed consent of the student to the disclosure;

(b){(5)}- An5 institution- mayS.B. impose reasonable time-based or session-based limitations on a student's technical method of access to educational data.

(5){(6)}296 Enrolled Copy (5) An institution may not:impose reasonable time-based or session-based limitations on a student's technical method of access to educational data.

(6) An institution may not:

and (c) impose a limitation under Subsection {(4)(b) } (5)(b) that:

{(6) {If a student is a minor, an institution shall obtain the parent's consent on behalf of the student in accordance with this section.} } (7) This section does not alter, limit, or supersede any right or obligation under:

(9)(9)(a) (a) A student whose educational data is shared as a result of a violation of a third party's failure to comply with the requirements of this section has a private right of action against the third party.

- 7 - SB0296 compared with SB0296S01 Section 4.

Effective date.

3-2-26 12:49 PM - 86 -