Section 6-18-2604 - Local education agency - Vendor security and transparency(a) Each local education agency shall ensure that all contracts that disclose or make available student personally identifiable information to vendors, including school service contract providers, school service on-demand providers, and other third parties, including without limitation subcontractors of contract providers, include express provisions that safeguard the privacy and security of student personally identifiable information.(b)(1)(A) Each local education agency shall maintain a list of the school service contract providers that the local education agency contracts with for school services that include or make available student personally identifiable information.(B) A local education agency shall: (i) At a minimum, update the list of school service contract providers required under subdivision (b)(1)(A) of this section at the beginning and midpoint of each school year;(ii) Upon the request of a parent, provide a copy of the list required under subdivision (b)(1)(A) of this section; and(iii) Maintain a copy of each contract between the local education agency and a school service contract provider.(2)(A) A local education agency shall ensure that the terms of a contract entered into or renewed by the local education agency with a school service contract provider on and after June 1, 2024, at a minimum, require the school service contract provider to comply with the requirements in § 6-18-2605 and § 6-18-2607.(B)(i) If a school service contract provider commits a material breach of a contract that involves the misuse or unauthorized release of student personally identifiable information, the local education agency shall determine whether to terminate the contract at the direction of, or in accordance with a policy adopted by, the governing body of the local education agency.(ii) At a minimum, within a reasonable time after the local education agency identifies the existence of a material breach of contract, the local education agency shall: (a) Investigate the nature of the material breach;(b) Provide an opportunity for the school service contract provider to respond concerning the alleged material breach;(c) Obtain the advice and direction of the governing body of the local education agency; and(d) Determine whether to terminate or continue the contract with the school service contract provider.(3) On and after June 1, 2024, a local education agency shall not enter into or renew a contract with a school service contract provider that:(A) Refuses to accept the terms specified in subdivision (b)(2) of this section; or(B) Has substantially failed to comply with one (1) or more of the requirements in § 6-18-2605 and § 6-18-2607.(c)(1)(A) Each local education agency shall maintain a list of the school service on-demand providers that the local education agency or an employee of the local education agency uses for school services that include or make available student personally identifiable information.(B) A local education agency shall: (i) At a minimum, update the list of school service on-demand providers required under subdivision (c)(1)(A) of this section at the beginning and midpoint of each school year; and(ii) Upon the request of a parent, provide a copy of the list required under subdivision (c)(1)(A) of this section and, upon further request of the parent, assist the parent in obtaining the data privacy policy of the school service on-demand providers.(2) If a parent has evidence demonstrating that a school service on-demand provider with which a local education agency or an employee of a local education agency acting on behalf of a local education agency contracts does not substantially comply with the school service on-demand provider's privacy policy or does not meet the requirements in § 6-18-2606(b) and § 6-18-2607(a), the parent may notify the local education agency and provide the evidence for the parent's conclusion.(3)(A) If a local education agency has evidence demonstrating that a school service on-demand provider does not substantially comply with the school service on-demand provider's privacy policy or does not meet the requirements in § 6-18-2606(b) and § 6-18-2607(a), the local education agency may cease using or refuse to use the school service on-demand provider and prohibit employees of the local education agency from using the school service on-demand provider.(B) The local education agency shall notify the school service on-demand provider that the: (i) Local education agency is ceasing or refusing to use the school service on-demand provider under subdivision (c)(3)(A) of this section; and(ii) School service on-demand provider may submit a written response to the local education agency.(C) The local education agency shall:(i) Notify the Department of Education if the local education agency ceases using a school service on-demand provider for the reasons described in subdivision (c)(3)(A) of this section; and(ii) Provide a copy of any written response that a school service on-demand provider submits to the local education agency under subdivision (c)(3)(B)(ii) of this section.Added by Act 2023, No. 754,§ 1, eff. 6/1/2024.