Student Consent Amendments

13
53E-9-311
53H-7-1001
53H-7-1002
53E-9-311
53H-7-1001
53H-7-1002
0
Student Consent Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Kirk A. Cullimore
House Sponsor: Stephanie Gricius
LONG TITLE
General Description:
This bill enacts provisions related to a student's educational data and informed consent.
Highlighted Provisions:
This bill:
defines terms;
enacts certain rights regarding student data;
requires an education entity and institution of higher education to:
disclose student data under certain circumstances;
offer a secure, digital mechanism for obtaining informed consent; and
follow certain procedures when obtaining a student's informed consent;
allows an education entity and an institution of higher education to impose certain
limitations;
prohibits an education entity and an institution of higher education from:
restricting a student's ability to grant informed consent;
requiring a student to waive certain rights; or
imposing certain limitations on a student's informed consent;
requires a parent to provide informed consent on behalf of the parent's minor student;
creates a private right of action; and
allows the State Board of Education and the Utah Board of Higher Education to issue best
practices for informed consent.
Money Appropriated in this Bill:
None
Other Special Clauses:
This bill provides a special effective date.
Utah Code Sections Affected:
ENACTS:
53E-9-311
, Utah Code Annotated 1953
53H-7-1001
, Utah Code Annotated 1953
53H-7-1002
, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section
53E-9-311
is enacted to read:
53E-9-311
. Disclosure of educational data -- Informed consent -- Access and
disclosure.
(1)
As used in this section:
(a)
"Educational data" means a student's:
(i)
transcript data;
(ii)
enrollment information;
(iii)
course history; and
(iv)
academic credentials.
(b)
"Informed consent" means the same as that term is defined in Section
53H-7-1001
.
(2)
In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C. Sec.
1232g, this chapter, and other relevant state and federal privacy laws, a student who is
currently enrolled in, or has previously been enrolled in, an education entity, or a parent
if the student is under 18 years old, has the right to:
(a)
access the student's educational data; and
(b)
authorize access to the student's educational data in accordance with this section.
(3)
An education entity shall:
(a)
subject to Subsection
(9)
, disclose a student's educational data;
(b)
beginning July 1, 2027, offer a secure digital or electronic mechanism as the primary
method for obtaining informed consent under this section;
(c)
allow informed consent in written form if a digital or electronic mechanism is not
reasonably available to the student;
(d)
when obtaining a student's consent through a digital or electronic consent mechanism:
(i)
allow the student to review all consent information before authorization; and
(ii)
prohibit the bundling of unrelated terms or conditions with the consent request;
and
(e)
regarding a limitation imposed under Subsection
(5)(b)
:
(i)
clearly disclose the limitation at the time the entity grants access; and
(ii)
provide a reasonable mechanism that allows a student to re-access educational
data after the expiration of a time-based or session-based limitation.
(4)
An education entity may impose reasonable time-based or session-based limitations on
a student's technical method of access to educational data.
(5)
An education entity may not:
(a)
deny, delay, or restrict a student's ability to grant informed consent that complies
with this section;
(b)
require a student to waive unrelated rights or agree to unrelated terms as a condition
of granting informed consent; and
(c)
impose a limitation under Subsection
(5)(b)
that:
(i)
restricts the student's underlying right to access the student's educational data;
(ii)
prevents the student from requesting renewed access; or
(iii)
limits the student's ability to provide informed consent for disclosure of the
student's educational data.
(6)
(a)
If a student is under 18 years old and the disclosure is to a party other than the
student, an education entity shall obtain the parent's consent in accordance with this
section.
(b)
The restrictions described in Subsection
(5)
apply to a parent of a student if the
student is under 18 years old.
(7)
This section does not alter, limit, or supersede any right or obligation under:
(a)
the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g;
(b)
this chapter; or
(c)
any other applicable state or federal privacy law.
(8)
The state board may issue nonbinding guidance regarding best practices for consent
mechanisms that comply with the requirements of this section.
(9)
Except as provided in the Family Educational Rights and Privacy Act, 20 U.S.C. Sec.
1232g, an education entity shall disclose a student's educational data to a third party
under this section only:
(a)
with the informed consent of the student;
(b)
according to the terms of the document expressing the student's informed consent;
and
(c)
subject to the agreement of the third party receiving the student's educational data:
(i)
to use the student's educational data only as provided in the document expressing
the student's informed consent to the disclosure; and
(ii)
to not redisclose the student's educational data to any other party.
(10)
A third party that receives the educational data of more than 10 students is subject to:
(a)
the data privacy requirements described in Title 53E, Chapter 9, Part 3, Student Data
Protection; and
(b)
policies and administrative rules the state board adopts to protect student data.
(11)
(a)
A student whose educational data is shared as a result of a violation of a third
party's failure to comply with the requirements of this section has a private right of
action against the third party.
(b)
A student described in Subsection
(11)(a)
does not have a private right of action
against the education entity.
Section 2. Section
53H-7-1001
is enacted to read:
10. Student Data
53H-7-1001
. General provisions -- Definitions.
As used in this part:
(1)
"Educational data" means a student's:
(a)
transcript data;
(b)
enrollment information;
(c)
course history; and
(d)
academic credentials.
(2)
"Informed consent" means voluntary, affirmative, written authorization complying with
the requirements of 34 C.F.R. Sec. 99.30 that a student provides after the individual is
presented, in a clear manner, with sufficient information to reasonably understand:
(a)
the educational data that is subject to access or disclosure;
(b)
the purpose of the disclosure of the educational data;
(c)
the recipient of the educational data disclosure;
(d)
that the student has the right to revoke consent of disclosure of the educational data
at any time;
(e)
the scope and duration of the authorization to disclose the educational data; and
(f)
whether consent is a condition of the student's participation in any educational
program or activity.
Section 3. Section
53H-7-1002
is enacted to read:
53H-7-1002
. Disclosure of educational data -- Informed consent -- Access and
disclosure.
(1)
In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C. Sec.
1232g, and other relevant state and federal privacy laws, a student who is currently
enrolled in, or has previously been enrolled in, an institution has the right to:
(a)
access the student's educational data; and
(b)
authorize access to the student's educational data in accordance with this section.
(2)
An institution shall:
(a)
subject to Subsection
(3)
, disclose a student's educational data;
(b)
beginning July 1, 2027, offer a secure digital or electronic mechanism as the primary
method for obtaining informed consent under this section;
(c)
allow informed consent in written form if a digital or electronic mechanism is not
reasonably available to the student;
(d)
when obtaining a student's informed consent:
(i)
allow the student to review all consent information before authorization;
(ii)
allow the student to revoke consent at any time; and
(iii)
prohibit the bundling of unrelated terms or conditions with the consent request;
and
(e)
regarding a limitation imposed under Subsection
(5)(b)
:
(i)
clearly disclose the limitation at the time the institution grants access; and
(ii)
provide a reasonable mechanism that allows a student to re-access educational
data after the expiration of a time-based or session-based limitation.
(3)
Except as provided in the Family Educational Rights and Privacy Act, 20 U.S.C. Sec.
1232g, an institution shall disclose a student's educational data under this section only:
(a)
with the informed consent of the student;
(b)
according to the terms of the document expressing the informed consent of the
student; and
(c)
subject to the agreement of the third party receiving the student's educational data:
(i)
to use the student's educational data only as provided in the document expressing
the informed consent of the student to the disclosure; and
(ii)
to not redisclose the student's educational data to any other party.
(4)
A third party that receives the educational data of more than 10 students is subject to:
(a)
data privacy requirements the Utah Board of Higher Education makes under
Subsection
53H-14-502(5)
; and
(b)
policies regarding the protection of student data the institution adopts under
Subsection
53H-14-502(1)
.
(5)
An institution may impose reasonable time-based or session-based limitations on a
student's technical method of access to educational data.
(6)
An institution may not:
(a)
deny, delay, or restrict a student's ability to grant informed consent that complies
with this section;
(b)
require a student to waive unrelated rights or agree to unrelated terms as a condition
of granting informed consent; and
(c)
impose a limitation under Subsection
(5)(b)
that:
(i)
restricts the student's underlying right to access the student's educational data;
(ii)
prevents the student from requesting renewed access; or
(iii)
limits the student's ability to provide informed consent for disclosure of the
student's educational data.
(7)
This section does not alter, limit, or supersede any right or obligation under:
(a)
the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g; or
(b)
any other applicable state or federal privacy law.
(8)
The Utah Board of Higher Education may issue nonbinding guidance regarding best
practices for consent mechanisms that comply with the requirements of this section.
(9)
(a)
A student whose educational data is shared as a result of a violation of a third
party's failure to comply with the requirements of this section has a private right of
action against the third party.
(b)
A student described in Subsection
(9)(a)
does not have a private right of action
against the institution.
Section 4.
Effective Date.
This bill takes effect on
July 1, 2026
.
3-11-26 3:27 PM