We are rolling out a new project that helps schools send out contracts to EdTech vendors to follow Student Data Privacy requirements. The Utah State Legislature, Title 53E-9-309: Third-party Contractors, requires schools to include student data privacy provisions in all third-party agreements that receive student personally-identifiable information (PII). The Utah DPA was developed in collaboration with legal counsel, Local Education Agencies (LEAs), and vendors.
Districts are encouraged to use this agreement as the de facto K-12 data privacy agreement for Utah. Vendors may additionally choose to sign the General Offer of Privacy Terms, Exhibit E, making the Utah DPA essentially a piggy-backable or umbrella agreement, requiring only the additional signature of the LEA to make it binding and eliminating any further privacy negotiations for that particular resource.
In addition to a Utah Data Privacy Agreement, the Utah State Board of Education has created a Utah Student Privacy Alliance (USPA). This houses all DPAs for all LEAs and has many other features available, including a lot of transparency so LEAs are able to see what is being done within Utah and also on a national level. It creates more of a collaborative effort in Utah around student data privacy and required contracting processes. This project seeks to take some of the workload off of districts and charters and streamline the workflow.
Utah law requires certain privacy protections be included when entering agreements with third-parties. Only when personally identifiable information (PII) from an education record is disclosed are requirements triggered. You can go through this flowchart to determine when you would obtain a DPA.
If you would like to join the Utah Student Privacy Alliance, you can request an account and schedule your 45 minute onboarding by e-mailing firstname.lastname@example.org.
We now have made it even easier to subscribe onto existing Utah DPAs. The Exhibit E Creator will allow you to piggy-back onto existing agreements with the click of a button. Here is a description of how to implement this new feature.
Now it’s even easier to renew existing Data Privacy Agreements through the Student Data Privacy Consortium (SDPC) Resource Registry.