R277-487-11. Application to Third Parties

  (1) The Board and LEAs shall set policies that govern a third party contractor's access to personally identifiable student data and public school enrollment verification data consistent with Section 53E-9-301, et seq.

  (2) An LEA may release personally identifiable student data and public school enrollment verification data to a third party contractor if:

  (a) the release is allowed by, and released in accordance with, Section 53E-9-308, FERPA, and FERPA's implementing regulations; and

  (b) the LEA complies with the requirements of Subsection R277-487-3(6).

  (4) All Board contracts shall include sanctions for contractors or third party providers who violate provisions of state policies regarding unauthorized use and release of student and employee data.

  (5) The Superintendent shall recommend that LEA policies include sanctions for contractors who violate provisions of federal or state privacy law and LEA policies regarding unauthorized use and release of student and employee data.