C.R.S. § 22-16-101 Short title
22-16-101. Short title. The short title of this article is the "Student Data Transparency and Security Act".
Student Data Transparency and Security
C.R.S. tit. 22, art. 16
in effectC.R.S. § 22-16-102 Legislative declaration
22-16-102. Legislative declaration. The general assembly recognizes that, with the increasing use of technology in education, it is imperative that information that identifies individual students and their families is vigilantly protected from misappropriation and misuse that could harm students or their families. The general assembly also finds, however, that there are many positive ways in which a student's personally identifiable information may be used to improve the quality of the education the student receives and to positively impact the educational and career outcomes that the student achieves. The general assembly finds, therefore, that student data can be both protected and positively applied by increasing the level of transparency regarding, and specifying and enforcing limitations on, the collection, use, storage, and destruction of student data.
C.R.S. § 22-16-103 Definitions
22-16-103. Definitions. As used in this article, unless the context otherwise requires:
(1) "Aggregate data" means data collected and reported at the group, cohort, or institutional level that is aggregated using protocols that are effective for preserving the anonymity of each individual included in the data.
(2) "Department" means the department of education created and existing pursuant to section 24-1-115, C.R.S.
(3) "Destroy" means to remove student personally identifiable information so that it is permanently irretrievable in the normal course of business.
(4) "Local education provider" means a school district, a charter school authorized by a school district pursuant to part 1 of article 30.5 of this title, a charter school authorized by the state charter school institute pursuant to part 5 of article 30.5 of this title, or a board of cooperative services created and operating pursuant to article 5 of this title that operates one or more public schools.
(5) "Parent" means a student's biological or adoptive parent or the student's legal guardian.
(6) "Public education entity" means the department, a local education provider, the state charter school institute established in section 22-30.5-503, or a public school.
(7) (a) "School service" means an internet website, online service, online application, or mobile application that:
(I) Is designed and marketed primarily for use in a preschool, elementary school, or secondary school;
(II) Is used at the direction of teachers or other employees of a local education provider; and
(III) Collects, maintains, or uses student personally identifiable information.
(b) "School service" does not include an internet website, online service, online application, or mobile application that is designed and marketed for use by individuals or entities generally, even if it is also marketed to a United States preschool, elementary school, or secondary school.
(8) "School service contract provider" or "contract provider" means an entity, other than a public education entity or an institution of higher education, that enters into a formal, negotiated contract with a public education entity to provide a school service.
(9) "School service on-demand provider" or "on-demand provider" means an entity, other than a public education entity, that provides a school service on occasion to a public education entity, subject to agreement by the public education entity, or an employee of the public education entity, to standard, non-negotiable terms and conditions of service established by the providing entity.
(10) "Small rural school district" means a school district that the department identifies as rural, based on the geographic size of the school district and the distance of the school district from the nearest large, urbanized area, and that enrolls fewer than one thousand students in kindergarten through twelfth grade.
(11) "State board" means the state board of education created in section 1 of article IX of the state constitution.
(12) "Student data system" means the Colorado department of education student data collection system.
(13) "Student personally identifiable information" means information that, alone or in combination, personally identifies an individual student or the student's parent or family, and that is collected, maintained, generated, or inferred by a public education entity, either directly or through a school service, or by a school service contract provider or school service on-demand provider.
(14) "Targeted advertising" means selecting and sending advertisements to a student based on information obtained or inferred over time from the student's online behavior, use of applications, or personally identifiable information. "Targeted advertising" does not include:
, either directly or through a school service, or by a school service contract provider or school service on-demand provider.
(14) "Targeted advertising" means selecting and sending advertisements to a student based on information obtained or inferred over time from the student's online behavior, use of applications, or personally identifiable information. "Targeted advertising" does not include:
(a) Advertising to a student:
(I) At an online location based on the student's current visit to that location or in response to the student's request for information or feedback; and
(II) Without the collection and retention of a student's online activities over time;
(b) Adaptive learning, personalized learning, or customized education; or
(c) With the consent of a student or the student's parent, using the student's personally identifiable information to identify for the student institutions of higher education or scholarship providers that are seeking students who meet specific criteria.
(15) "Unique student identifier" means the number assigned by the department pursuant to section 22-16-105 (1) to each student enrolled in a public school.
(16) "Vendor" means a business or other organization with which a public education entity contracts for a product or service. "Vendor" includes a school service contract provider.
C.R.S. § 22-16-104 State board of education - duties - rules
22-16-104. State board of education - duties - rules. (1) The state board shall:
(a) Create, publish, and make publicly available a data inventory and dictionary or index of data elements with definitions of individual student data fields used in the student data system including:
(I) Individual student personally identifiable information that school districts and public schools are required to report by state and federal education mandates; and
(II) Individual student personally identifiable information that is proposed for inclusion in the student data system with a statement regarding the purpose or reason for the proposed collection and the use of the collected data;
(b) Develop, publish, and make publicly available policies and procedures to comply with the federal "Family Educational Rights and Privacy Act of 1974", 20 U.S.C. sec. 1232g, and other relevant privacy laws and policies, including but not limited to policies that restrict access to student personally identifiable information in the student data system to:
(I) The authorized staff of the department that require access to perform assigned or contractual duties, including staff and contractors from the office of information and technology that are assigned to the department;
(II) The department's contractors that require access to perform assigned or contractual duties that comply with the requirements specified in paragraph (g) of this subsection (1);
(III) School district administrators, teachers, and school personnel who require access to perform assigned duties;
(IV) Students and their parents; and
(V) The authorized staff of other state agencies, including public institutions of higher education, as required by law or defined by interagency data-sharing agreements;
(c) Develop user-friendly information for the public related to the department's data-sharing agreements that is posted on the department's website as provided in section 22-16-105 (4);
(d) Develop a detailed data security plan that includes:
(I) Guidance for authorizing access to the student data system and to individual student personally identifiable information, including guidance for authenticating authorized access;
(II) Privacy compliance standards;
(III) Privacy and security audits;
(IV) Security breach planning, notice, and procedures;
(V) Student personally identifiable information retention and destruction policies, which must include specific requirements for identifying when and how the student personally identifiable information will be destroyed;
(VI) Guidance for school districts and staff regarding student personally identifiable information use;
(VII) Consequences for security breaches; and
(VIII) Staff training regarding the policies;
(e) Ensure routine and ongoing compliance by the department with the federal "Family Educational Rights and Privacy Act of 1974", 20 U.S.C. sec. 1232g, other relevant privacy laws and policies, and the privacy and security policies and procedures developed under the authority of this article, including the performance of compliance audits;
aches; and
(VIII) Staff training regarding the policies;
(e) Ensure routine and ongoing compliance by the department with the federal "Family Educational Rights and Privacy Act of 1974", 20 U.S.C. sec. 1232g, other relevant privacy laws and policies, and the privacy and security policies and procedures developed under the authority of this article, including the performance of compliance audits;
(f) Ensure that agreements involving the disclosure of student personally identifiable information for research conducted on behalf of the department to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction must:
(I) Specify the purpose, scope, and duration of the study or studies and the information to be disclosed;
(II) Require the entity, and any subcontractors or employees of the entity, to use student personally identifiable information from education records only to meet the purpose or purposes of the study as stated in the written agreement;
(III) Require the entity, and any subcontractors or employees of the entity, to conduct the study in a manner that does not permit access to the student personally identifiable information of parents and students by anyone other than representatives of the entity with legitimate interests;
(IV) Require the entity, and any subcontractors or employees of the entity, to destroy all student personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and to specify the time period in which the information must be destroyed; and
(V) Require the entity, and any subcontractors or employees of the entity, to comply with the requirements specified in sections 22-16-109 (1), (2), and (3)(b) and 22-16-110 (1) and (3) that are imposed on school service contract providers;
(g) Develop requirements that any department contracts that affect databases, assessments, or instructional supports that include student personally identifiable information and are outsourced to vendors include express provisions that safeguard privacy and security, including specifying that student personally identifiable information may be used only for the purpose specified in the contract and must be destroyed when no longer needed for the purpose specified in the contract; specifying the time period in which the information must be destroyed; prohibiting further disclosure of the student personally identifiable information or its use for commercial purposes that are outside the scope of the contract; and specifying penalties for noncompliance, which must include termination of the contract as required in section 22-16-105 (5); and
(h) Promulgate rules as necessary to implement the provisions of this article.
C.R.S. § 22-16-105 Department of education - duties
22-16-105. Department of education - duties. (1) The department shall assign to each student who is enrolled in a public school a unique student identifier that must neither be nor include the social security number of a student in whole or in sequential part.
(2) (a) The department shall develop a process to consider and review all outside requests for student personally identifiable information, other than aggregate student information already publicly available, by individuals not employed by the state who seek to conduct research using school system data or student personally identifiable information already collected by the department. The department shall implement the process subject to approval by the state board.
(b) (I) Before allowing an individual to receive student personally identifiable information for research purposes, the department must enter into an agreement with the individual that includes the entity that sponsors the individual or with which the individual is affiliated. At a minimum, the agreement must include the items specified in section 22-16-104 (1)(f) and require the individual to comply with the requirements specified in sections 22-16-109 (1), (2), and (3)(b) and 22-16-110 (1) and (3) that are imposed on school service contract providers.
(II) The provisions of this paragraph (b) do not apply to an individual who is seeking only aggregate student information. For each request for aggregate student information, the department shall determine whether the size of the group, cohort, or institution is too small to preserve the anonymity of the individuals included in the data, in which case the student data does not qualify as aggregate data.
(III) Notwithstanding the provisions of subparagraph (I) of this paragraph (b), an individual who conducts research through an institution of higher education may demonstrate to the department compliance with the institution review board practices and requirements, as regulated by federal law, in lieu of the terms specified in section 22-16-104 (1)(f).
(c) The department may enter into a data-sharing agreement with a public institution of higher education to allow the sharing of student personally identifiable information for the purpose of satisfying requirements imposed on the public institution of higher education by the institution's accrediting body. At a minimum, the data-sharing agreement must include the items specified in section 22-16-104 (1)(f) and require the public institution of higher education to comply with the requirements specified in sections 22-16-109 (1), (2), and (3)(b) and 22-16-110 (1) and (3) that are imposed on school service contract providers. For purposes of these requirements, the accrediting body is considered a subcontractor of the public institution of higher education.
(3) (a) The department shall not require a local education provider to provide student personally identifiable information that is not required by state or federal law; except that it may require student personally identifiable information not mandated by state or federal law that is associated with a grant proposal, or the department may ask a local education provider to voluntarily submit data or information as a condition of receiving a benefit, such as grant funding or special designations.
(b) Unless required by state or federal law, the department shall not collect:
(I) Juvenile delinquency records;
(II) Criminal records;
(III) Medical and health records;
(IV) Student social security numbers;
(V) Student biometric information; and
(VI) Information concerning the political affiliations or the beliefs or attitudes of students and their families.
unding or special designations.
(b) Unless required by state or federal law, the department shall not collect:
(I) Juvenile delinquency records;
(II) Criminal records;
(III) Medical and health records;
(IV) Student social security numbers;
(V) Student biometric information; and
(VI) Information concerning the political affiliations or the beliefs or attitudes of students and their families.
(c) Unless otherwise approved by the state board, the department shall not transfer student personally identifiable information to a federal, state, or local agency or other entity, which agency or entity is outside of the state, except under the following circumstances:
(I) If a student transfers to an education entity in state or out of state or if a school or school district seeks help in locating a student who transfers out of state;
(II) If a student seeks to enroll in or to attend an out-of-state institution of higher education or training program;
(III) If a student participates in a program or assessment for which a data transfer is a condition of participation;
(IV) If a student is classified as "migrant" for federal reporting purposes;
(V) If the department enters into a contract with an out-of-state vendor or researcher that affects databases, assessments, special education, or instructional support related to an audit or evaluation of federal- or state-supported education programs; for the enforcement of or compliance with federal legal requirements that relate to those programs; or for conducting studies for or on behalf of the department to develop, validate, or administer predictive tests, administer student aid programs, or improve instruction; or
(VI) If the disclosure is to comply with a judicial order or lawfully issued subpoena or in connection with a health or safety emergency.
(d) The department shall not sell, trade, gift, or monetize student personally identifiable information for commercial use or investment interests.
(4) The department shall publish and maintain on its website a list of all of the entities or individuals, including but not limited to vendors, individual researchers, research organizations, institutions of higher education, and government agencies, that the department contracts with or has agreements with and that hold student personally identifiable information and a copy of each contract or agreement. The list must include:
(a) The name of the entity or individual. In naming an individual, the list must include the entity that sponsors the individual or with which the individual is affiliated, if any. If the individual is conducting research at an institution of higher education, the list may include the name of the institution of higher education and a contact person in the department that is associated with the research in lieu of the name of the researcher.
(b) The purpose and scope of the contract or agreement;
(c) The duration of the contract or agreement;
(d) The types of student personally identifiable information that the entity or individual holds under the contract or agreement;
(e) The use of the student personally identifiable information under the contract; and
that is associated with the research in lieu of the name of the researcher.
(b) The purpose and scope of the contract or agreement;
(c) The duration of the contract or agreement;
(d) The types of student personally identifiable information that the entity or individual holds under the contract or agreement;
(e) The use of the student personally identifiable information under the contract; and
(f) The length of time for which the entity or individual may hold the student personally identifiable information.
(5) (a) The department shall ensure that the terms of each contract that the department enters into or renews with a school service contract provider on and after August 10, 2016, at a minimum, require the contract provider to comply with the requirements in sections 22-16-108 to 22-16-110. If the contract provider commits a material breach of the contract that involves the misuse or unauthorized release of student personally identifiable information, the department shall determine whether to terminate the contract in accordance with a policy adopted by the state board. At a minimum, the policy must require the state board, within a reasonable time after the department identifies the existence of a material breach, to hold a public hearing that includes discussion of the nature of the material breach, an opportunity for the contract provider to respond concerning the material breach, public testimony, and a decision as to whether to direct the department to terminate or continue the contract.
(b) The department shall ensure that the terms of each contract or other agreement that the department enters into or renews on and after August 10, 2016, which contract or agreement includes access to or use of student personally identifiable information by an individual or entity other than a contract provider, at a minimum, require the individual or entity to comply with the requirements in sections 22-16-109 (1), (2), and (3)(b) and 22-16-110 (1) and (3). If the individual or entity commits a material breach of the contract or agreement that involves the misuse or unauthorized release of student personally identifiable information, the department shall determine whether to terminate the contract or agreement in accordance with the state board policy described in paragraph (a) of this subsection (5).
(c) Notwithstanding any provision of law to the contrary, on and after August 10, 2016, the department shall not enter into or renew:
(I) A contract with a school service contract provider that refuses to accept the terms specified in paragraph (a) of this subsection (5) or that has substantially failed to comply with one or more of the requirements in sections 22-16-108 to 22-16-110; or
(II) A contract or other agreement, which includes access to or use of student personally identifiable information, with an individual or entity other than a contract provider, that refuses to accept the terms specified in paragraph (b) of this subsection (5) or that has substantially failed to comply with one or more of the requirements in section 22-16-109 (1), (2), or (3)(b) or 22-16-110 (1) or (3).
C.R.S. § 22-16-106 Department - support for local education providers
22-16-106. Department - support for local education providers. (1) The department shall develop data security guidance that may be used by local education providers. The department's data security guidance must include:
(a) Guidance for authorizing access to the student data system and to student personally identifiable information, including guidance for authenticating authorized access;
(b) Privacy compliance standards;
(c) Best practices for privacy and security audits;
(d) Security breach planning, notice, and procedures;
(e) Data retention and destruction procedures;
(f) Data collection and sharing procedures;
(g) Recommendations that any contracts that affect databases, assessments, or instructional supports that include student personally identifiable information and are outsourced to vendors include express provisions that safeguard privacy and security and include penalties for noncompliance;
(h) Best security practices for privacy when using online education services, including websites and applications;
(i) Guidance for contracts involving the outsourcing of educational services;
(j) Guidance for contracts involving online education services;
(k) Guidance for publishing a list of vendors that local education providers contract with that hold student personally identifiable information;
(l) Consequences for security breaches; and
(m) Examples of staff training regarding the procedures.
(2) Based on the data security guidance adopted pursuant to subsection (1) of this section, on or before March 1, 2017, the department shall create and make available to local education providers a sample student information privacy and protection policy. The department shall annually review the sample policy and revise it as necessary to ensure that it remains current and adequate to protect the privacy of student personally identifiable information in light of advances in data technology and dissemination. At a minimum, the sample policy must include protocols for:
(a) Creating and maintaining a student data index;
(b) Retaining and destroying student personally identifiable information;
(c) Using student personally identifiable information for purposes internal to a local education provider;
(d) Preventing breaches in the security of student personally identifiable information and for responding to any security breaches that occur;
(e) Contracting with school service contract providers and using school services provided by school service on-demand providers;
(f) Disclosing student personally identifiable information to school service contract providers, school service on-demand providers, or other third parties;
(g) Notifying parents regarding collection of, retention of, and access to student personally identifiable information; and
(h) Providing training in student information security and privacy to employees of a local education provider.
(3) The department shall prepare and make available to local education providers sample contract language for use in contracting with school service contract providers. The department shall update the sample contract language as necessary to ensure that it remains current and adequate to protect the privacy of student personally identifiable information in light of advances in data technology and dissemination.
(4) The department shall identify and make available to local education providers resources that the local education providers may use in training employees with regard to student information security and privacy. At the request of a local education provider, the department shall provide training related to student information security and privacy.
f advances in data technology and dissemination.
(4) The department shall identify and make available to local education providers resources that the local education providers may use in training employees with regard to student information security and privacy. At the request of a local education provider, the department shall provide training related to student information security and privacy.
(5) If the department receives notice that a local education provider has ceased using a school service on-demand provider for reasons described in section 22-16-107 (3), the department shall post the notice on the department's website. The department shall also post any written response from an on-demand provider that the local education provider may submit. The department shall post the notices and written responses for twenty-four months following the date received.
C.R.S. § 22-16-107 Local education provider - data collection - data security policy
22-16-107. Local education provider - data collection - data security policy. (1) (a) Each local education provider shall post and maintain on its website clear information that is understandable by a layperson explaining the data elements of student personally identifiable information that the local education provider collects and maintains in the local education provider's data system, not including the student personally identifiable information that the local education provider transmits to the department. The list must explain how the local education provider uses and shares the student personally identifiable information. The local education provider shall include on its website a link to the data inventory and dictionary or index of data elements that the state board publishes as required in section 22-16-104 (1)(a).
(b) Each local education provider shall post and maintain on its website a list of the school service contract providers that the local education provider contracts with and a copy of each contract.
(2) (a) Each local education provider shall ensure that the terms of each contract that the local education provider enters into or renews with a school service contract provider on and after August 10, 2016, at a minimum, require the contract provider to comply with the requirements in sections 22-16-108 to 22-16-110. If the contract provider commits a material breach of the contract that involves the misuse or unauthorized release of student personally identifiable information, the local education provider shall determine whether to terminate the contract in accordance with a policy adopted by the governing body of the local education provider. At a minimum, the policy must require the governing body, within a reasonable time after the local education provider identifies the existence of a material breach, to hold a public hearing that includes discussion of the nature of the material breach, an opportunity for the contract provider to respond concerning the material breach, public testimony, and a decision as to whether to direct the local education provider to terminate or continue the contract.
(b) On and after August, 10, 2016, a local education provider shall not enter into or renew a contract with a school service contract provider that refuses to accept the terms specified in paragraph (a) of this subsection (2) or that has substantially failed to comply with one or more of the requirements in sections 22-16-108 to 22-16-110.
(3) (a) Each local education provider shall post on its website, to the extent practicable, a list of the school service on-demand providers that the local education provider or an employee of the local education provider uses for school services. At a minimum, the local education provider shall update the list of school service on-demand providers at the beginning and mid-point of each school year. The local education provider, upon the request of a parent, shall assist the parent in obtaining the data privacy policy of a school service on-demand provider that the local education provider or an employee of the local education provider uses.
(b) If a parent has evidence demonstrating that a school service on-demand provider that the local education provider or an employee of the local education provider uses does not substantially comply with the on-demand provider's privacy policy or does not meet the requirements specified in section 22-16-109 (2) or 22-16-110 (1), the parent may notify the local education provider and provide the evidence for the parent's conclusion.
rating that a school service on-demand provider that the local education provider or an employee of the local education provider uses does not substantially comply with the on-demand provider's privacy policy or does not meet the requirements specified in section 22-16-109 (2) or 22-16-110 (1), the parent may notify the local education provider and provide the evidence for the parent's conclusion.
(c) If a local education provider has evidence demonstrating that a school service on-demand provider does not substantially comply with the on-demand provider's privacy policy or does not meet the requirements specified in section 22-16-109 (2) or 22-16-110 (1), the local education provider is strongly encouraged to cease using or refuse to use the school service on-demand provider and prohibit employees of the local education provider from using the on-demand provider. The local education provider shall notify the on-demand provider that it is ceasing or refusing to use the on-demand provider pursuant to this paragraph (c), and the on-demand provider may submit a written response to the local education provider. The local education provider shall publish and maintain on its website a list of any school service on-demand providers that it ceases using or refuses to use for the reasons described in this paragraph (c), with any written responses that it receives from the on-demand providers. The local education provider shall notify the department if it ceases using an on-demand provider for the reasons described in this paragraph (c) and provide a copy of any written response the on-demand provider may submit.
(d) Each local education provider that uses on-demand school service providers shall post on its website a notice to on-demand providers that, if the local education provider ceases using or refuses to use an on-demand school service provider pursuant to paragraph (c) of this subsection (3), the local education provider will post on its website the name of the on-demand provider, with any written response that the on-demand provider may submit, and will notify the department, which will post on its website the on-demand provider's name and any written response.
(4) (a) On or before December 31, 2017, each local education provider shall adopt a student information privacy and protection policy that, at a minimum, addresses the issues specified in section 22-16-106 (1). The local education provider shall annually review the policy and revise it as necessary to ensure that it remains current and adequate to protect student personally identifiable information privacy in light of advances in data technology and dissemination.
(b) Notwithstanding the provisions of paragraph (a) of this subsection (4), a local education provider that is a small rural school district shall adopt the student information privacy and protection policy by July 1, 2018.
(c) Each local education provider shall make copies of the student information privacy and protection policy available upon request to the parent of a student enrolled by the local education provider and shall post a current copy of the student information privacy protection policy on the local education provider's website.
C.R.S. § 22-16-108 School service contract provider - data transparency
22-16-108. School service contract provider - data transparency. (1) Each school service contract provider shall provide clear information that is understandable by a layperson explaining the data elements of student personally identifiable information that the school service contract provider collects, the learning purpose for which the school service contract provider collects the student personally identifiable information, and how the school service contract provider uses and shares the student personally identifiable information. The information must include all student personally identifiable information that the school service contract provider collects regardless of whether it is initially collected or ultimately held individually or in the aggregate. The school service contract provider shall provide the information to each public education entity that the school service contract provider contracts with in a format that is easily accessible through a website, and the public education entity shall post the information on its website. The school service contract provider shall update the information as necessary to maintain accuracy.
(2) Each school service contract provider shall provide clear notice to each public education entity that it contracts with before making material changes to its privacy policy for school services.
(3) Each school service contract provider shall facilitate access to and correction of any factually inaccurate student personally identifiable information by a contracting local education provider in response to a request for correction that the local education provider receives and responds to in accordance with section 22-16-112 (1)(c).
(4) Upon discovering the misuse or unauthorized release of student personally identifiable information held by the contract provider, a subcontractor of the contract provider, or a subsequent subcontractor, the contract provider shall notify the contracting public education entity as soon as possible, regardless of whether the misuse or unauthorized release is a result of a material breach of the terms of the contract.
C.R.S. § 22-16-109 School service contract provider - use of data
22-16-109. School service contract provider - use of data. (1) (a) A school service contract provider may collect, use, and share student personally identifiable information only for the purposes authorized in the contract between the school service contract provider and a public education entity or with the consent of the student who is the subject of the information or the student's parent.
(b) A school service contract provider must obtain the consent of the student or the student's parent before using student personally identifiable information in a manner that is materially inconsistent with the school service contract provider's privacy policy or materially inconsistent with the contract between the school service contract provider and the public education entity that applies to the collection of the student personally identifiable information.
(2) A school service contract provider shall not:
(a) Sell student personally identifiable information; except that this prohibition does not apply to the purchase, merger, or other type of acquisition of a school service contract provider, or any assets of a school service contract provider, by another entity, so long as the successor entity continues to be subject to the provisions of this article with respect to student personally identifiable information that the school service contract provider acquired while subject to the provisions of this article;
(b) Use or share student personally identifiable information for purposes of targeted advertising to students; or
(c) Use student personally identifiable information to create a personal profile of a student other than for supporting purposes authorized by the contracting public education entity or with the consent of the student or the student's parent.
(3) Notwithstanding any provision of paragraph (b) of subsection (1) or of subsection (2) of this section to the contrary:
(a) (I) A school service contract provider may use or disclose student personally identifiable information to:
(A) Ensure legal or regulatory compliance or to take precautions against liability;
(B) Respond to or participate in the judicial process;
(C) Protect the safety of users or others on the school service contract provider's website, online service, online application, or mobile application; or
(D) Investigate a matter related to public safety.
(II) If a school service contract provider uses or discloses student personally identifiable information as allowed in subparagraph (I) of this paragraph (a), the contract provider shall notify the contracting public education entity as soon as possible after the use or disclosure of the information.
(b) A school service contract provider may use, or disclose student personally identifiable information to, a subcontractor only if the school service contract provider contractually requires the subcontractor to comply with section 22-16-108, this section, and sections 22-16-110 and 22-16-111. The provisions of this paragraph (b) apply to the ability of an initial or subsequent subcontractor to further subcontract. If a public education entity determines that an initial or subsequent subcontractor has committed a material breach of the contract that involves the misuse or unauthorized release of student personally identifiable information, the public education entity shall comply with the requirements of section 22-16-105 (5)(a) or 22-16-107 (2)(a), as applicable; except that the public education entity is not required to consider terminating the contract if the school service contract provider terminates the contract with the subcontractor as soon as possible after the contract provider knows or has reason to know of the initial or subsequent subcontractor's material breach.
h the requirements of section 22-16-105 (5)(a) or 22-16-107 (2)(a), as applicable; except that the public education entity is not required to consider terminating the contract if the school service contract provider terminates the contract with the subcontractor as soon as possible after the contract provider knows or has reason to know of the initial or subsequent subcontractor's material breach.
(4) For purposes of this section and section 22-16-110, a student may consent to the use, sharing, or retention of the student's student personally identifiable information only if the student is at least eighteen years of age or legally emancipated.
C.R.S. § 22-16-110 School service contract provider - data security - data destruction
22-16-110. School service contract provider - data security - data destruction. (1) Each school service contract provider shall maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personally identifiable information. The information security program must make use of appropriate administrative, technological, and physical safeguards.
(2) During the term of a contract between a school service contract provider and a public education entity, if the contracting public education entity requests destruction of a student's student personally identifiable information collected, generated, or inferred as a result of the contract, the contracting school service contract provider shall destroy the information as soon as practicable after the date of the request unless:
(a) The school service contract provider obtains the consent of the student or the student's parent to retain the student's student personally identifiable information; or
(b) The student has transferred to another public education entity and the receiving public education entity has requested that the school service contract provider retain the student's student personally identifiable information.
(3) Following the termination or conclusion of a contract between a school service contract provider and a public education entity, the school service contract provider shall, within the time period specified in the contract, destroy all student personally identifiable information collected, generated, or inferred as a result of the contract. If the contract does not specify a period for destruction of student personally identifiable information, the contract provider shall destroy the information when the information is no longer needed for the purpose of the contract between the contract provider and the public education entity. The contract provider shall notify the public education entity of the date upon which all of the student personally identifiable information is destroyed.
C.R.S. § 22-16-111 Use of data - exceptions - application of article
22-16-111. Use of data - exceptions - application of article. (1) Notwithstanding any provision of this article to the contrary, this article does not prohibit the use of student personally identifiable information to:
(a) Use adaptive learning or design personalized or customized education;
(b) Maintain, develop, support, improve, or diagnose a school service contract provider's website, online service, online application, or mobile application;
(c) Provide recommendations for school, educational, or employment purposes within a school service, so long as the response is not determined in whole or in part by payment or other consideration from a third party;
(d) Respond to a student's request for information or for feedback so long as the information or response is not determined in whole or in part by payment or other consideration from a third party;
(e) Identify for the student, only with the written consent of the student or the student's parent, institutions of higher education or scholarship providers that are seeking students who meet specific criteria, regardless of whether the identified institutions of higher education or scholarship providers provide consideration to the school service contract provider;
(f) In accordance with the terms of a contract between the school service contract provider and a public education entity, produce and distribute, free or for consideration, student class photos and yearbooks only to the public education entity, students, parents, or individuals authorized by parents; or
(g) Provide for the student, only with the express written consent of the student or the student's parent given in response to clear and conspicuous notice, access to employment opportunities, educational scholarships or financial aid, or postsecondary education opportunities, regardless of whether the school service contract provider receives consideration from one or more third parties in exchange for the student personally identifiable information. This exception applies only to school service contract providers that provide nationally recognized assessments that postsecondary institutions of higher education use in making admissions decisions.
(2) This article does not:
(a) Impose a duty on a provider of an interactive computer service, as defined in 47 U.S.C. sec. 230, to review or enforce compliance with this article by school service contract providers or school service on-demand providers;
(b) Impede the ability of a student to download, export, or otherwise save or maintain his or her own student personally identifiable information or documents;
(c) Limit internet service providers from providing internet connectivity to public schools or to students and their families;
(d) Prohibit a school service contract provider from marketing educational products directly to parents so long as the marketing does not result from the use of student personally identifiable information obtained by the school service contract provider as a result of providing its website, online service, online application, or mobile application; or
(e) Impose a duty on a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance with this article on that software or those applications.
(3) The requirements specified in sections 22-16-108 to 22-16-110 apply to school service contract providers that enter into or renew contracts with public education entities on or after August 10, 2016.
C.R.S. § 22-16-112 Parent rights - complaint policy
22-16-112. Parent rights - complaint policy. (1) The parent of a student enrolled by a local education provider has the right:
(a) To inspect and review his or her child's student personally identifiable information maintained by the local education provider;
(b) To request from the local education provider a paper or electronic copy of his or her child's student personally identifiable information, including student personally identifiable information maintained by a school service contract provider. If a parent requests an electronic copy of the parent's child's student personally identifiable information, the local education provider shall provide an electronic copy of the student personally identifiable information unless the local education provider does not maintain student personally identifiable information in electronic format and reproducing the student personally identifiable information in an electronic format would be unduly burdensome.
(c) To request corrections to factually inaccurate student personally identifiable information maintained by a local education provider. After receiving a request for correction that documents the factual inaccuracy, the local education provider that maintains the student personally identifiable information shall correct the factual inaccuracy and confirm the correction to the parent within a reasonable amount of time.
(2) (a) The governing board of each local education provider shall adopt a policy for hearing complaints from parents regarding the local education provider's compliance with the requirements of this article. At a minimum, the policy must provide a parent the opportunity to submit information to the governing board and receive a hearing by the governing board and must require the governing board to take action on the parent's complaint within sixty days after the hearing.
(b) If a local education provider does not comply with the requirements specified in this article, a student's parent may submit a complaint to the governing board of the local education provider in accordance with the complaint policy adopted in accordance with paragraph (a) of this subsection (2).
Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-22.docxFetched: 10/6/2026