Effective 1/1/2024

53B-28-506.  Penalties.

(1)  A third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing, or use of student data under this part:

Attorney's Note

Under the Utah Code, punishments for crimes depend on the classification. In the case of this section:
ClassPrisonFine
class A misdemeanorup to 364 daysup to $2,500
For details, see Utah Code § 76-3-204

Terms Used In Utah Code 53B-28-506 v2

  • Board: means the Utah Board of Higher Education described in Section 53B-1-402. See Utah Code 53B-1-101.5
  • Contract: A legal written agreement that becomes binding when signed.
  • Damages: Money paid by defendants to successful plaintiffs in civil cases to compensate the plaintiffs for their injuries.
  • Education entity: means the Utah Board of Higher Education or an institution. See Utah Code 53B-28-501
  • Institution: means an institution of higher education described in Section 53B-1-102. See Utah Code 53B-28-501
  • Jurisdiction: (1) The legal authority of a court to hear and decide a case. Concurrent jurisdiction exists when two courts have simultaneous responsibility for the same case. (2) The geographic area over which the court has authority to decide cases.
  • Minor: means a person younger than 18 years old. See Utah Code 53B-28-501
  • Student: means an individual enrolled in an institution. See Utah Code 53B-28-501
  • Student data: means information about a student at the individual student level. See Utah Code 53B-28-501
  • Third-party contractor: means a person who:
    (a) is not an institution or an employee of an institution; and
    (b) pursuant to a contract with an education entity, collects or receives student data in order to provide a product or service, as described in the contract, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service. See Utah Code 53B-28-501
    (a)  except as provided in Subsection (1)(d), may not enter into a future contract with an institution; and

    (b)  may be required by the board to pay a civil penalty of up to $25,000.

    (c)  may be required to pay:

    (i)  an institution’s cost of notifying parents and students of the unauthorized sharing or use of student data; and

    (ii)  any expense incurred by the institution as result of the unauthorized sharing or use of student data.

    (d)  An education entity may enter into a contract with a third-party contractor that knowingly or recklessly permitted unauthorized collecting, sharing, or use of student data if:

    (i)  the education entity determines that the third-party contractor has corrected the errors that caused the unauthorized collecting, sharing, or use of student data; and

    (ii)  the third-party contractor demonstrates:

    (A)  if the third-party contractor is under contract with the education entity, current compliance with this part; or

    (B)  an ability to comply with the requirements of this part.

    (e)  The board may bring an action in the district court of the county in which the office of the education entity is located, if necessary, to enforce payment of the civil penalty described in Subsection (1)(b).

    (f)  An individual who knowingly or intentionally permits unauthorized collecting, sharing, or use of student data may be found guilty of a class A misdemeanor.

(2) 

(a)  A student or a minor student’s parent may bring an action against a third-party contractor in a court of competent jurisdiction for damages caused by a knowing or reckless violation of Section 53B-28-505 by a third-party contractor.

(b)  If the court finds that a third-party contractor has violated Section 53B-28-505, the court may award to the parent or student:

(i)  damages; and

(ii)  costs.

Amended by Chapter 381, 2023 General Session