Section 6-18-2606 - School service contract provider - Use of data(a)(1) A school service contract provider may collect, use, and share student personally identifiable information only: (A) For the purposes authorized in the contract between the school service contract provider and a public education entity; or(B) With the consent of the student who is the subject of the information or the student's parent.(2) A school service contract provider shall obtain the consent of a student or a student's parent before using student personally identifiable information in a manner that is materially inconsistent with the contract between the school service contract provider and the public education entity that applies to the collection of the student personally identifiable information.(b)(1) A school service contract provider shall not: (A) Sell student personally identifiable information;(B) Use or share student personally identifiable information for purposes of targeted advertising to students; or(C) Use student personally identifiable information to create a personal profile of a student other than for supporting purposes authorized by the contracting public education entity or with the consent of the student or the student's parent.(2) Notwithstanding anything in this subchapter to the contrary, selling student personally identifiable information does not include a school service contract provider's use, sharing, or transfer of student personally identifiable information:(A) With or to an affiliate of the school service contract provider;(B) For any purpose permitted under subdivision (a)(1) of this section;(C) With or to a third party that processes the student personally identifiable information on behalf of the school service contract provider;(D) For any purpose at the direction of the contracting public education entity or with the consent of the student or the student's parent; or(E) In connection with the purchase, merger, or other type of acquisition of a school service contract provider, or any assets of a school service contract provider, by another entity, so long as the successor entity continues to be subject to the provisions of this subchapter with respect to student personally identifiable information that the school service contract provider acquired while subject to this subchapter.(c) Notwithstanding subdivision (a)(2) or subsection (b) of this section to the contrary, a school service contract provider may use or disclose student personally identifiable information:(1)(A) To:(i) Ensure legal or regulatory compliance or to take precautions against liability;(ii) Respond to or participate in the judicial process;(iii) Protect the safety of users or others on the school service contract provider's website, online service, online application, or mobile application; or(iv) Investigate a matter related to public safety.(B) If a school service contract provider uses or discloses student personally identifiable information as permitted under subdivision (c)(1)(A) of this section, the school service contract provider shall notify the contracting public education entity as soon as possible after the use or disclosure of the student personally identifiable information; and(2)(A) To a subcontractor only if the school service contract provider contractually requires the subcontractor to comply with this subchapter.(B) Subdivision (c)(2)(A) of this section shall apply to the ability of an initial or subsequent subcontractor to further subcontract.(C)(i) If a public education entity determines that an initial or subsequent subcontractor has committed a material breach of contract that involves the misuse or unauthorized disclosure of student personally identifiable information, the public education entity shall comply with the requirements of § 6-18-2604.(ii) However, the public education entity is not required to consider terminating the contract if the school service contract provider terminates the contract with the subcontractor as soon as possible after the school service contract provider knows or has reason to know of the initial or subsequent subcontractor's material breach.(d) A student may consent to the use, sharing, or retention of the student's student personally identifiable information only if the student is eighteen (18) years of age or older or legally emancipated for purposes of this section.Added by Act 2023, No. 754,§ 1, eff. 6/1/2024.