Section 506 – Penalties.

• (1)
  • (a) An institution that contracts with a third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing, or use of student data under this part:
    • (i) except as provided in Subsection (1)(b), may not enter into a future contract with the third-party contractor; and
    • (ii) may be required by the board to pay a civil penalty of up to $25,000.
  • (b) An education entity may enter into a contract with a third-party contractor that knowingly or recklessly permitted unauthorized collecting, sharing, or use of student data if:
    • (i) the education entity determines that the third-party contractor has corrected the errors that caused the unauthorized collecting, sharing, or use of student data; and
    • (ii) the third-party contractor demonstrates:
      • (A) if the third-party contractor is under contract with the education entity, current compliance with this part; or
      • (B) an ability to comply with the requirements of this part.
  • (c) The board may assess the civil penalty described in Subsection (1)(a)(ii) in accordance with Title 63G, Chapter 4, Administrative Procedures Act.
  • (d) The board may bring an action in the district court of the county in which the office of the education entity is located, if necessary, to enforce payment of the civil penalty described in Subsection (1)(a)(ii).
  • (e) An individual who knowingly or intentionally permits unauthorized collecting, sharing, or use of student data may be found guilty of a class A misdemeanor.

• (2)
  • (a) A student or a minor student’s parent may bring an action against an institution in a court of competent jurisdiction for damages caused by a knowing or reckless violation of Section 53B-28-505 by a third-party contractor that the institution contracts with under 53B-28-505.
  • (b) If the court finds that a third-party contractor has violated Section 53B-28-505, the court may order the institution to pay to the parent or student:
    • (i) damages; and
    • (ii) costs.

Enacted by Chapter 461, 2022 General Session