1     
HIGHER EDUCATION DATA PRIVACY AND GOVERNANCE

2     
REVISIONS

3     
2022 GENERAL SESSION

4     
STATE OF UTAH

5     
Chief Sponsor: Jacob L. Anderegg

6     
House Sponsor: Jefferson Moss

7     

8     LONG TITLE
9     General Description:
10          This bill enacts and amends provisions related to higher education data privacy and
11     governance.
12     Highlighted Provisions:
13          This bill:
14          ▸     transfers the Utah Data Resource Center (center) from the Department of Workforce
15     Services to the Utah System of Higher Education;
16          ▸     expands the duties of the center by requiring the center to collect and promote
17     access to data from institutions of higher education and collaborate with the Board
18     of Higher Education and the State Board of Education to coordinate access to
19     certain student identifier information;
20          ▸     requires the commissioner of higher education to:
21               •     appoint a director of the center to serve as chair of the Utah Data Research
22     Advisory Board; and
23               •     appoint the member who represents the center to the School Readiness Board;
24          ▸     requires the center to include information regarding the center's activities and
25     accomplishments in the center's annual report to the Legislature;
26          ▸     provides for higher education student data protection at the state and institution of
27     higher education (institution) levels;
28          ▸     requires the state privacy officer to establish a privacy advisory group;

29          ▸     enacts requirements for data protection and maintenance for the Utah Board of
30     Higher Education, institutions, and third-party contractors;
31          ▸     creates requirements for a third-party contractor's use of student data;
32          ▸     creates penalties for an institution that contracts with a third-party contractor that
33     permits unauthorized collecting, sharing, or use of student data;
34          ▸     defines terms; and
35          ▸     makes technical and conforming changes.
36     Money Appropriated in this Bill:
37          This bill appropriates in fiscal year 2023:
38          ▸     to Utah Board of Higher Education -- Administration, as an ongoing appropriation:
39               •     from the Education Fund, $770,000; and
40          ▸     to Utah Board of Higher Education -- Administration, as a one-time appropriation:
41               •     from the Education Fund, $275,000.
42     Other Special Clauses:
43          This bill provides a special effective date.
44     Utah Code Sections Affected:
45     AMENDS:
46          35A-15-201, as last amended by Laws of Utah 2019, Chapters 246, 246 and
47     renumbered and amended by Laws of Utah 2019, Chapters 342, 342 and last
48     amended by Coordination Clause, Laws of Utah 2019, Chapter 342
49          53B-1-109, as last amended by Laws of Utah 2020, Chapter 365
50          53E-1-201, as last amended by Laws of Utah 2021, Chapters 64, 251, and 351
51          53E-4-308, as last amended by Laws of Utah 2020, Chapter 365
52          53E-10-706, as last amended by Laws of Utah 2019, Chapter 186
53          53E-10-707, as last amended by Laws of Utah 2019, Chapter 186
54     ENACTS:
55          53B-28-501, Utah Code Annotated 1953

56          53B-28-502, Utah Code Annotated 1953
57          53B-28-503, Utah Code Annotated 1953
58          53B-28-504, Utah Code Annotated 1953
59          53B-28-505, Utah Code Annotated 1953
60          53B-28-506, Utah Code Annotated 1953
61     RENUMBERS AND AMENDS:
62          53B-33-101, (Renumbered from 35A-14-102, as last amended by Laws of Utah 2020,
63     Chapter 365)
64          53B-33-201, (Renumbered from 35A-14-201, as enacted by Laws of Utah 2017,
65     Chapter 375)
66          53B-33-202, (Renumbered from 35A-14-203, as last amended by Laws of Utah 2020,
67     Chapter 365)
68          53B-33-203, (Renumbered from 35A-14-204, as enacted by Laws of Utah 2017,
69     Chapter 375)
70          53B-33-301, (Renumbered from 35A-14-301, as enacted by Laws of Utah 2017,
71     Chapter 375)
72          53B-33-302, (Renumbered from 35A-14-302, as last amended by Laws of Utah 2020,
73     Chapter 365)
74          53B-33-303, (Renumbered from 35A-14-303, as enacted by Laws of Utah 2017,
75     Chapter 375)
76          53B-33-304, (Renumbered from 35A-14-304, as enacted by Laws of Utah 2017,
77     Chapter 375)
78     REPEALS:
79          35A-14-101, as enacted by Laws of Utah 2017, Chapter 375
80          35A-14-202, as enacted by Laws of Utah 2017, Chapter 375
81     

82     Be it enacted by the Legislature of the state of Utah:

83          Section 1. Section 35A-15-201 is amended to read:
84          35A-15-201. Establishment of the School Readiness Board -- Membership --
85     Funding prioritization.
86          (1) There is created the School Readiness Board within the department composed of:
87          (a) the executive director or the executive director's designee;
88          (b) one member appointed by the State Board of Education;
89          (c) one member appointed by the chair of the State Charter School Board;
90          (d) two members who have research experience in the area of early childhood
91     development, with:
92          (i) one member who is not a legislator and is appointed by the speaker of the House of
93     Representatives; and
94          (ii) one member who represents the Utah Data Research Center created in Section
95     53B-33-201, appointed by the [executive director] commissioner of higher education;
96          (e) one member, who is not a legislator and is appointed by the president of the Senate,
97     who:
98          (i) has expertise in results-based contracts; or
99          (ii) represents a financial institution that has experience managing a portfolio that
100     meets the requirements of the Community Reinvestment Act, 12 U.S.C. Sec. 2901 et seq.;
101          (f) one member, appointed by the executive director, who has expertise in early
102     childhood education;
103          (g) one member, appointed by the state superintendent, who has expertise in early
104     childhood education;
105          (h) one member, appointed by the governor, who represents a nonprofit corporation
106     that focuses on early childhood education; and
107          (i) one member, appointed by the executive director, who owns and operates a licensed
108     child care center located in the state.
109          (2) (a) A member described in Subsection (1)(b), (c), (d), (e), (f), (g), or (h) shall serve

110     for a term of two years.
111          (b) If a vacancy occurs for a member described in Subsection (1)(b), (c), (d), (e), (f),
112     (g), or (h), the individual appointing the member shall appoint a replacement to serve the
113     remainder of the member's term.
114          (3) (a) A member may not receive compensation or benefits for the member's service.
115          (b) A member may serve more than one term.
116          (4) The department shall provide staff support to the board.
117          (5) (a) The board members shall elect a chair of the board from the board's
118     membership.
119          (b) The board shall meet upon the call of the chair or a majority of the board members.
120          (6) In allocating funding received under this chapter, the board shall:
121          (a) give first priority to repayment of an investor who is a party to a results-based
122     contract under the Laws of Utah, 2014, Chapter 304, Section 10; and
123          (b) determine prioritization of funding for the remaining programs described in this
124     chapter.
125          Section 2. Section 53B-1-109 is amended to read:
126          53B-1-109. Coordination of higher education and public education information
127     technology systems -- Use of unique student identifier.
128          (1) As used in this section[, "unique]:
129          (a) "Center" means the Utah Data Research Center created in Section 53B-33-201.
130          (b) "Institution of higher education" means an institution of higher education described
131     in Section 53B-1-102.
132          (c) "Unique student identifier" means the same as that term is defined in Section
133     53E-4-308.
134          (2) The board and State Board of Education, in collaboration with the center, shall:
135          (a) coordinate public education and higher education information technology systems
136     to allow individual student academic achievement to be tracked through both education

137     systems in accordance with this section and Section 53E-4-308[.]; and
138          (b) coordinate access to the unique student identifier of a public education student who
139     later attends an institution of higher education.
140          (3) Information technology systems used at an institution [within the state system] of
141     higher education shall use the unique student identifier of all students who have previously
142     been assigned a unique student identifier.
143          Section 3. Section 53B-28-501 is enacted to read:
144     
Part 5. Higher Education Student Data Protection

145          53B-28-501. Definitions.
146          As used in this part:
147          (1) "Advisory group" means the institution of higher education privacy advisory group
148     established by the state privacy officer under Section 53B-28-502.
149          (2) "Aggregate data" means data that:
150          (a) are totaled and reported at the group, cohort, class, course, institution, region, or
151     state level, with at least 10 individuals in the level; and
152          (b) do not reveal personally identifiable student data.
153          (3) "Data breach" means an unauthorized release of or unauthorized access to
154     personally identifiable student data that an education entity maintains.
155          (4) "Data governance plan" means an education entity's comprehensive plan for
156     managing education data that:
157          (a) incorporates reasonable data industry best practices to maintain and protect student
158     data and other education-related data;
159          (b) describes the role, responsibility, and authority of the board or an institution privacy
160     officer;
161          (c) provides for necessary technical assistance, training, support, and auditing;
162          (d) describes the process for sharing student data between the education entity and
163     another person;

164          (e) describes the education entity's data expungement process, including how to
165     respond to requests for expungement;
166          (f) describes the data breach response process; and
167          (g) is published annually and available on the institution's website or the Utah System
168     of Higher Education's website.
169          (5) "Education entity" means the Utah Board of Higher Education or an institution.
170          (6) "Higher education privacy officer" means a privacy officer that the board designates
171     under Section 53B-28-503.
172          (7) "Institution" means an institution of higher education described in Section
173     53B-1-102.
174          (8) "Minor" means a person younger than 18 years old.
175          (9) (a) "Personally identifiable student data" means student data that identifies or is
176     used by the holder to identify a student.
177          (b) "Personally identifiable student data" includes:
178          (i) a student's first and last name;
179          (ii) the first and last name of a student's family member;
180          (iii) a student's or a student's family's home or physical address;
181          (iv) a student's email address or other online contact information;
182          (v) a student's telephone number;
183          (vi) a student's social security number;
184          (vii) a student's biometric identifier;
185          (viii) a student's health or disability data;
186          (ix) a student's education entity student identification number;
187          (x) a student's social media user name and password or alias;
188          (xi) if associated with personally identifiable student data, the student's persistent
189     identifier, including:
190          (A) a customer number held in a cookie; or

191          (B) a processor serial number;
192          (xii) a combination of a student's last name or photograph with other information that
193     together permits a person to contact the student online;
194          (xiii) information about a student or a student's family that a person collects online and
195     combines with other personally identifiable student data to identify the student; and
196          (xiv) information that, alone or in combination, is linked or linkable to a specific
197     student that would allow a reasonable person in the school community, who does not have
198     personal knowledge of the relevant circumstances, to identify the student with reasonable
199     certainty.
200          (10) "State privacy officer" means the state privacy officer described in Section
201     67-3-13.
202          (11) "Student" means an individual enrolled in an institution.
203          (12) (a) "Student data" means information about a student at the individual student
204     level.
205          (b) "Student data" does not include aggregate or de-identified data.
206          (13) "Third-party contractor" means a person who:
207          (a) is not an institution or an employee of an institution; and
208          (b) pursuant to a contract with an education entity, collects or receives student data in
209     order to provide a product or service, as described in the contract, if the product or service is
210     not related to school photography, yearbooks, graduation announcements, or a similar product
211     or service.
212          Section 4. Section 53B-28-502 is enacted to read:
213          53B-28-502. State student data protection governance.
214          (1) The state privacy officer shall establish a higher education privacy advisory group
215     to advise institutions and institution boards of trustees on student data protection.
216          (2) The advisory group shall consist of:
217          (a) the state privacy officer;

218          (b) the higher education privacy officer; and
219          (c) the following members, appointed by the commissioner of higher education:
220          (i) at least one Utah system of higher education employee; and
221          (ii) at least one representative of the Utah Board of Higher Education.
222          (3) The advisory group shall:
223          (a) discuss and make recommendations to the board and institutions regarding:
224          (i) existing and proposed:
225          (A) board rules; or
226          (B) board policies of the Utah Board of Higher Education or institutions; and
227          (ii) training on protecting student data privacy; and
228          (b) perform other tasks related to student data protection as designated by the Utah
229     Board of Higher Education.
230          (4) The higher education privacy officer shall:
231          (a) provide training and support to institution boards and employees; and
232          (b) produce:
233          (i) resource materials;
234          (ii) model data governance plans;
235          (iii) model forms for institution student data protection governance; and
236          (iv) a model data collection notice.
237          (5) The board shall:
238          (a) (i) create and maintain a data governance plan; and
239          (ii) annually publish the data governance plan on the Utah System of Higher Education
240     website; and
241          (b) establish standards for:
242          (i) institution policies to protect student data;
243          (ii) institution data governance plans; and
244          (iii) a third-party contractor's use of student data.

245          Section 5. Section 53B-28-503 is enacted to read:
246          53B-28-503. Institution student data protection governance.
247          (1) (a) An institution shall adopt policies to protect student data in accordance with this
248     part and board rule, including the standards the board establishes under Subsection
249     53B-28-502(5).
250          (b) The policies described in Subsection (1)(a) shall take into account the specific
251     needs and priorities of the institution.
252          (2) The board shall designate a higher education privacy officer.
253          (3) The higher education privacy officer shall:
254          (a) verify compliance with student privacy laws, rules, and policies throughout the
255     Utah System of Higher Education;
256          (b) support institutions in developing data governance plans and student data privacy
257     training; and
258          (c) act as the primary point of contact for the state privacy officer.
259          (4) An institution shall:
260          (a) designate an individual to act as the primary contact for the higher education
261     privacy officer;
262          (b) create and maintain an institution:
263          (i) data governance plan that complies with the standards the board establishes under
264     Subsection 53B-28-502(5); and
265          (ii) record of student data privacy training; and
266          (c) annually publish the institution's data governance plan on the institution's website.
267          Section 6. Section 53B-28-504 is enacted to read:
268          53B-28-504. Notification of significant data breach.
269          (1) If a significant data breach occurs at an institution, the institution shall notify each
270     student whose personally-identifiable student data was disclosed.
271          (2) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the

272     board shall make rules to define a significant data breach described in Subsection (1).
273          Section 7. Section 53B-28-505 is enacted to read:
274          53B-28-505. Third-party contractors.
275          (1) A third-party contractor shall use personally identifiable student data received
276     under a contract with an education entity strictly for the purpose of providing the contracted
277     product or service within the negotiated contract terms.
278          (2) When contracting with a third-party contractor, an education entity, or a
279     government agency contracting on behalf of an education entity, shall:
280          (a) ensure that the contract terms comply with the standards the board establishes under
281     Subsection 53B-28-502(5); and
282          (b) require the following provisions in the contract:
283          (i) requirements and restrictions related to the collection, use, storage, or sharing of
284     student data by the third-party contractor that are necessary for the education entity to ensure
285     compliance with the provisions of this part and board rule;
286          (ii) a description of a person, or type of person, including an affiliate of the third-party
287     contractor, with whom the third-party contractor may share student data;
288          (iii) provisions that, at the request of the education entity, govern the deletion of the
289     student data received by the third-party contractor;
290          (iv) except as provided in Subsection (4) and if required by the education entity,
291     provisions that prohibit the secondary use of personally identifiable student data by the
292     third-party contractor; and
293          (v) an agreement by the third-party contractor that, at the request of the education entity
294     that is a party to the contract, the education entity or the education entity's designee may audit
295     the third-party contractor to verify compliance with the contract.
296          (3) As authorized by law or court order, a third-party contractor shall share student data
297     as requested by law enforcement.
298          (4) A third-party contractor may:

299          (a) use student data for adaptive learning or customized student learning purposes;
300          (b) market an educational application or product to a student if the third-party
301     contractor does not use student data, shared by or collected on behalf of an education entity, to
302     market the educational application or product;
303          (c) use a recommendation engine to recommend to a student:
304          (i) content that relates to learning or employment, within the third-party contractor's
305     application, if the recommendation is not motivated by payment or other consideration from
306     another party; or
307          (ii) services that relate to learning or employment, within the third-party contractor's
308     application, if the recommendation is not motivated by payment or other consideration from
309     another party;
310          (d) respond to a student request for information or feedback, if the content of the
311     response is not motivated by payment or other consideration from another party;
312          (e) use student data to allow or improve operability and functionality of the third-party
313     contractor's application; or
314          (f) identify for a student nonprofit institutions of higher education or scholarship
315     providers that are seeking students who meet specific criteria:
316          (i) regardless of whether the identified nonprofit institutions of higher education or
317     scholarship providers provide payment or other consideration to the third-party contractor; and
318          (ii) only if the third-party contractor obtains authorization in writing from:
319          (A) the student's parent, if the student is a minor; or
320          (B) the student.
321          (5) At the completion of a contract with an education entity, if the contract has not
322     been renewed, a third-party contractor shall return or delete upon the education entity's request
323     all personally identifiable student data under the control of the education entity unless a student
324     or a minor student's parent consents to the maintenance of the personally identifiable student
325     data.

326          (6) (a) A third-party contractor may not:
327          (i) except as provided in Subsection (6)(b), sell student data;
328          (ii) collect, use, or share student data, if the collection, use, or sharing of the student
329     data is inconsistent with the third-party contractor's contract with the education entity; or
330          (iii) use student data for targeted advertising.
331          (b) A person may obtain student data through the purchase of, merger with, or
332     otherwise acquiring a third-party contractor if the third-party contractor remains in compliance
333     with this section.
334          (7) The provisions of this section do not:
335          (a) apply to the use of a general audience application, including the access of a general
336     audience application with login credentials created by a third-party contractor's application;
337          (b) apply if the student data is shared in accordance with the education entity's
338     directory information policy, as described in 34 C.F.R. Sec. 99.37;
339          (c) apply to the providing of Internet service; or
340          (d) impose a duty on a provider of an interactive computer service, as defined in 47
341     U.S.C. Sec. 230, to review or enforce compliance with this section.
342          (8) A provision of this section that relates to a student's student data does not apply to a
343     third-party contractor if the education entity or third-party contractor obtains authorization from
344     the following individual, in writing, to waive that provision:
345          (a) the student's parent, if the student is a minor; or
346          (b) the student.
347          Section 8. Section 53B-28-506 is enacted to read:
348          53B-28-506. Penalties.
349          (1) (a) An institution that contracts with a third-party contractor that knowingly or
350     recklessly permits unauthorized collecting, sharing, or use of student data under this part:
351          (i) except as provided in Subsection (1)(b), may not enter into a future contract with the
352     third-party contractor; and

353          (ii) may be required by the board to pay a civil penalty of up to $25,000.
354          (b) An education entity may enter into a contract with a third-party contractor that
355     knowingly or recklessly permitted unauthorized collecting, sharing, or use of student data if:
356          (i) the education entity determines that the third-party contractor has corrected the
357     errors that caused the unauthorized collecting, sharing, or use of student data; and
358          (ii) the third-party contractor demonstrates:
359          (A) if the third-party contractor is under contract with the education entity, current
360     compliance with this part; or
361          (B) an ability to comply with the requirements of this part.
362          (c) The board may assess the civil penalty described in Subsection (1)(a)(ii) in
363     accordance with Title 63G, Chapter 4, Administrative Procedures Act.
364          (d) The board may bring an action in the district court of the county in which the office
365     of the education entity is located, if necessary, to enforce payment of the civil penalty described
366     in Subsection (1)(a)(ii).
367          (e) An individual who knowingly or intentionally permits unauthorized collecting,
368     sharing, or use of student data may be found guilty of a class A misdemeanor.
369          (2) (a) A student or a minor student's parent may bring an action against an institution
370     in a court of competent jurisdiction for damages caused by a knowing or reckless violation of
371     Section 53B-28-505 by a third-party contractor that the institution contracts with under
372     53B-28-505.
373          (b) If the court finds that a third-party contractor has violated Section 53B-28-505, the
374     court may order the institution to pay to the parent or student:
375          (i) damages; and
376          (ii) costs.
377          Section 9. Section 53B-33-101, which is renumbered from Section 35A-14-102 is
378     renumbered and amended to read:
379          [35A-14-102].      53B-33-101. Definitions.

380          As used in this chapter:
381          (1) "Advisory board" means the Utah Data Research Advisory Board created in Section
382     [35A-14-203] 53B-33-203.
383          (2) "Center" means the Utah Data Research Center created in Section 53B-33-201.
384          (3) "Data" means any information about a person stored in a physical or electronic
385     record.
386          (4) "Data research program" means the data maintained by the center in accordance
387     with Section [35A-14-301] 53B-33-301.
388          (5) "De-identified data" means data about a person that cannot, without additional
389     information, identify the person to another person or machine.
390          (6) "Director" means the director of the [Workforce Research and Analysis Division]
391     Utah Data Research Center created in Section 53B-33-201.
392          (7) "Institution of higher education" means an institution of higher education described
393     in Section 53B-1-102.
394          [(7)] (8) "Participating entity" means:
395          (a) the State Board of Education, which includes the director as defined in Section
396     53E-10-701;
397          (b) the [Utah Board of Higher Education] board;
398          (c) the Department of Workforce Services; and
399          (d) the Department of Health and Human Services.
400          (9) "Unique student identifier" means the same as that term is defined in Section
401     53E-4-308.
402          Section 10. Section 53B-33-201, which is renumbered from Section 35A-14-201 is
403     renumbered and amended to read:
404          [35A-14-201].      53B-33-201. Utah Data Research Center -- Creation.
405          The Utah Data Research Center is created within the [Workforce Research and Analysis
406     Division within the department] Utah system of higher education.

407          Section 11. Section 53B-33-202, which is renumbered from Section 35A-14-203 is
408     renumbered and amended to read:
409          [35A-14-203].      53B-33-202. Utah Data Research Advisory Board --
410     Composition -- Appointment.
411          (1) There is created the Utah Data Research Advisory Board [in accordance with this
412     section].
413          (2) The [Utah Data Research Advisory Board] advisory board is composed of the
414     following members:
415          (a) the state superintendent of the State Board of Education or the state superintendent's
416     designee;
417          (b) the commissioner [of higher education or the commissioner of higher education's]
418     or the commissioner's designee;
419          (c) the executive director of the Department of Workforce Services or the executive
420     director's designee; and
421          (d) the executive director of the Department of Health and Human Services or the
422     executive director's designee.
423          (3) The [executive director] commissioner shall serve as chair.
424          (4) A member of the advisory board:
425          (a) except to the extent a member's service on the advisory board is related to the
426     member's duties outside of the advisory board, may not receive compensation or benefits for
427     the member's service; and
428          (b) may receive per diem and travel expenses in accordance with:
429          (i) Section 63A-3-106;
430          (ii) Section 63A-3-107; and
431          (iii) rules made by the Division of Finance under Sections 63A-3-106 and 63A-3-107.
432          Section 12. Section 53B-33-203, which is renumbered from Section 35A-14-204 is
433     renumbered and amended to read:

434          [35A-14-204].      53B-33-203. Director -- Additional staff -- Administrative
435     support.
436          (1) The commissioner shall appoint a director [shall] to manage the day-to-day
437     operations of the center.
438          (2) The director may, with the [department's] commissioner's approval, hire staff,
439     including:
440          (a) data scientists;
441          (b) data technology experts; and
442          (c) data security experts.
443          Section 13. Section 53B-33-301, which is renumbered from Section 35A-14-301 is
444     renumbered and amended to read:
445          [35A-14-301].      53B-33-301. Data research program.
446          (1) The center shall establish a data research program for the purpose of analyzing data
447     that is:
448          (a) collected over time;
449          (b) aggregated from multiple sources; and
450          (c) connected and de-identified.
451          (2) The center may, in order to establish the data research program described in
452     Subsection (1):
453          (a) acquire property or equipment in order to store aggregated, connected, and
454     de-identified data derived from data contributed by the participating entities; or
455          (b) contract with a private entity in accordance with Title 63G, Chapter 6a, Utah
456     Procurement Code, or with a state government entity to:
457          (i) store aggregated, connected, and de-identified data derived from data contributed by
458     the participating entities; or
459          (ii) utilize existing aggregated, connected, and de-identified data maintained by a state
460     government entity.

461          (3) A participating entity shall contribute data to the data research program described in
462     Subsection (1) within guidelines established by the center.
463          (4) The center may only release data maintained by the center in accordance with the
464     procedures described in this chapter.
465          (5) The center shall:
466          (a) as directed by the board, serve as a repository in the state of data from institutions
467     of higher education;
468          (b) collaborate with the board and the State Board of Education to coordinate access to
469     the unique student identifier of a public education student who later attends an institution of
470     higher education in accordance with Sections 53B-1-109 and 53E-4-308;
471          (c) develop, establish, and maintain programs that promote access to data from
472     institutions of higher education;
473          (d) identify initiatives that leverage education data that will improve a state citizen's
474     ability to:
475          (i) access services at an institution of higher education; or
476          (ii) graduate with a postsecondary certificate or degree; and
477          (e) perform all other duties provided in this chapter.
478          (6) The director shall identify the resources necessary to successfully implement
479     initiatives described in Subsection (5)(d), in accordance with Section 53B-7-101.
480          (7) The center may:
481          (a) employ staff necessary to carry out the center's duties;
482          (b) purchase, own, create, or maintain equipment necessary to:
483          (i) collect data from the participating entities;
484          (ii) connect and de-identify data collected by the center;
485          (iii) store connected and de-identified data; or
486          (iv) conduct research on data stored or obtained by the center; or
487          (c) contract with a private entity, another state or federal entity, or a political

488     subdivision of the state to carry out the center's duties as provided in this chapter.
489          [(5)] (8) The data research program is not subject to Title 63G, Chapter 2, Government
490     Records Access and Management Act.
491          Section 14. Section 53B-33-302, which is renumbered from Section 35A-14-302 is
492     renumbered and amended to read:
493          [35A-14-302].      53B-33-302. Data research requests.
494          (1) The center shall use data that the center maintains or that a participating entity
495     contributes to the data research program under Section [35A-14-301] 53B-33-301 to conduct
496     research for the purpose of developing public policy for the state.
497          (2) The director, with consultation by the advisory board, shall create a prioritized list
498     of data research for the center to conduct using the data research program each year.
499          (3) (a) In developing the list described in Subsection (2), the center shall accept data
500     research requests from:
501          (i) a legislative committee or a legislative staff office;
502          (ii) the governor or an executive branch agency;
503          (iii) the State Board of Education; and
504          (iv) the [Utah Board of Higher Education] board.
505          [(b) The department shall begin accepting the data research requests described in
506     Subsection (3)(a) on July 1, 2017.]
507          [(c)] (b) The center shall report the list described in Subsection (2) to the Education
508     Interim Committee before December 1 of each year.
509          (4) In addition to conducting data research in accordance with the prioritized list
510     described in Subsection (2), the center may use additional resources to prepare data research at
511     the request of:
512          (a) a state government entity;
513          (b) a political subdivision of the state;
514          (c) a private entity; or

515          (d) a member of the public.
516          (5) The director, with approval by the advisory board, shall determine, for a data
517     research request described in Subsection (4):
518          (a) whether the center has the resources to complete the data research request;
519          (b) the order in which the center shall complete the data research request, if at all; and
520          (c) a reasonable estimated cost for the request.
521          (6) The center, after evaluating a request under Subsection (5), shall:
522          (a) provide the person that requested the data research with a cost estimate; and
523          (b) require, before accepting a data research request, that the person that submitted the
524     data research request agree to pay, once the data research is complete, the full cost of
525     completing the data research request as determined by the center under Subsection (5).
526          (7) The center shall make available to the public, on a website maintained by the
527     center, any data research request that the center completes under this section.
528          (8) The center shall ensure that any data contained in a completed data research request
529     is de-identified.
530          (9) The center shall:
531          (a) establish, by rule made in accordance with Title 63G, Chapter 3, Utah
532     Administrative Rulemaking Act:
533          (i) procedures for submitting a data research request under this section;
534          (ii) criteria to determine how to prioritize data research requests; and
535          (iii) minimum standards for information a person is required to include in a data
536     research request; and
537          (b) create a fee schedule in accordance with Section 63J-1-504 for completing a data
538     research request.
539          (10) In addition to submitting a data research request under Subsection (4), a
540     participating entity, executive branch agency, or legislative staff office may request, and the
541     center may release, a data set from the data research program if the data set is:

542          (a) connected;
543          (b) aggregated; and
544          (c) de-identified.
545          (11) (a) The center shall use any fee the center collects under this section to cover the
546     center's costs to administer this chapter.
547          (b) The center shall deposit any fee the center collects under this section not used to
548     cover the center's costs into the General Fund.
549          Section 15. Section 53B-33-303, which is renumbered from Section 35A-14-303 is
550     renumbered and amended to read:
551          [35A-14-303].      53B-33-303. Data visualization access.
552          (1) In addition to performing data research and responding to data research requests
553     under Section [35A-14-302] 53B-33-302, the center shall create an online data visualization
554     portal that provides access to the public to connected, aggregated, and de-identified data in the
555     program.
556          (2) The data visualization portal described in Subsection (1) shall include role-based
557     dashboards that:
558          (a) allow a user to query data in the program;
559          (b) integrate real-time data; and
560          (c) allow a user to view queried data in a customizable environment.
561          Section 16. Section 53B-33-304, which is renumbered from Section 35A-14-304 is
562     renumbered and amended to read:
563          [35A-14-304].      53B-33-304. Reporting.
564          (1) The center shall report to the Education Interim Committee:
565          (a) before July 1 of each year regarding the center's:
566          (i) research and services priorities for the year; [and]
567          (ii) completed research from the previous year; and
568          (iii) activities and accomplishments in the previous year; and

569          (b) before December 1 of each year, the center's ongoing data research and services
570     priority list described in Subsection [35A-14-302(2)] 53B-33-302(2).
571          (2) The Education Interim Committee shall provide the center ongoing input regarding
572     the center's activities and data research priorities.
573          Section 17. Section 53E-1-201 is amended to read:
574          53E-1-201. Reports to and action required of the Education Interim Committee.
575          (1) In accordance with applicable provisions and Section 68-3-14, the following
576     recurring reports are due to the Education Interim Committee:
577          (a) the report described in Section 9-22-109 by the STEM Action Center Board,
578     including the information described in Section 9-22-113 on the status of the computer science
579     initiative and Section 9-22-114 on the Computing Partnerships Grants Program;
580          (b) the prioritized list of data research described in Section [35A-14-302] 53B-33-302
581     and the report on research and activities described in Section [35A-14-304] 53B-33-304 by the
582     Utah Data Research Center;
583          (c) the report described in Section 35A-15-303 by the State Board of Education on
584     preschool programs;
585          (d) the report described in Section 53B-1-402 by the Utah Board of Higher Education
586     on career and technical education issues and addressing workforce needs;
587          (e) the annual report of the Utah Board of Higher Education described in Section
588     53B-1-402;
589          (f) the reports described in Section 53B-28-401 by the Utah Board of Higher Education
590     regarding activities related to campus safety;
591          (g) the State Superintendent's Annual Report by the state board described in Section
592     53E-1-203;
593          (h) the annual report described in Section 53E-2-202 by the state board on the strategic
594     plan to improve student outcomes;
595          (i) the report described in Section 53E-8-204 by the state board on the Utah Schools for

596     the Deaf and the Blind;
597          (j) the report described in Section 53E-10-703 by the Utah Leading through Effective,
598     Actionable, and Dynamic Education director on research and other activities;
599          (k) the report described in Section 53F-4-203 by the state board and the independent
600     evaluator on an evaluation of early interactive reading software;
601          (l) the report described in Section 53F-4-407 by the state board on UPSTART;
602          (m) the reports described in Sections 53F-5-214 and 53F-5-215 by the state board
603     related to grants for professional learning and grants for an elementary teacher preparation
604     assessment; and
605          (n) the report described in Section 53F-5-405 by the State Board of Education
606     regarding an evaluation of a partnership that receives a grant to improve educational outcomes
607     for students who are low income.
608          (2) In accordance with applicable provisions and Section 68-3-14, the following
609     occasional reports are due to the Education Interim Committee:
610          (a) the report described in Section 35A-15-303 by the School Readiness Board by
611     November 30, 2020, on benchmarks for certain preschool programs;
612          (b) the report described in Section 53B-28-402 by the Utah Board of Higher Education
613     on or before the Education Interim Committee's November 2021 meeting;
614          (c) the reports described in Section 53E-3-520 by the state board regarding cost centers
615     and implementing activity based costing;
616          (d) if required, the report described in Section 53E-4-309 by the state board explaining
617     the reasons for changing the grade level specification for the administration of specific
618     assessments;
619          (e) if required, the report described in Section 53E-5-210 by the state board of an
620     adjustment to the minimum level that demonstrates proficiency for each statewide assessment;
621          (f) in 2022 and in 2023, on or before November 30, the report described in Subsection
622     53E-10-309(7) related to the PRIME pilot program;

623          (g) the report described in Section 53E-10-702 by Utah Leading through Effective,
624     Actionable, and Dynamic Education;
625          (h) if required, the report described in Section 53F-2-513 by the state board evaluating
626     the effects of salary bonuses on the recruitment and retention of effective teachers in high
627     poverty schools;
628          (i) upon request, the report described in Section 53F-5-207 by the state board on the
629     Intergenerational Poverty Intervention Grants Program;
630          (j) the report described in Section 53F-5-210 by the state board on the Educational
631     Improvement Opportunities Outside of the Regular School Day Grant Program;
632          (k) the report described in Section 53G-7-503 by the state board regarding fees that
633     LEAs charge during the 2020-2021 school year;
634          (l) the reports described in Section 53G-11-304 by the state board regarding proposed
635     rules and results related to educator exit surveys;
636          (m) the report described in Section 62A-15-117 by the Division of Substance Abuse
637     and Mental Health, the State Board of Education, and the Department of Health regarding
638     recommendations related to Medicaid reimbursement for school-based health services; and
639          (n) the reports described in Section 63C-19-202 by the Higher Education Strategic
640     Planning Commission.
641          Section 18. Section 53E-4-308 is amended to read:
642          53E-4-308. Unique student identifier -- Coordination of higher education and
643     public education information technology systems -- Coordination of preschool and public
644     education information technology systems.
645          (1) As used in this section, "unique student identifier" means an alphanumeric code
646     assigned to each public education student for identification purposes, which:
647          (a) is not assigned to any former or current student; and
648          (b) does not incorporate personal information, including a birth date or Social Security
649     number.

650          (2) The state board, through the state superintendent, shall assign each public education
651     student a unique student identifier, which shall be used to track individual student performance
652     on achievement tests administered under this part.
653          (3) The state board and the Utah Board of Higher Education, in collaboration with the
654     Utah Data Research Center created in Section 53B-33-201, shall:
655          (a) coordinate public education and higher education information technology systems
656     to allow individual student academic achievement to be tracked through both education
657     systems in accordance with this section and Section 53B-1-109[.]; and
658          [(4)] (b) [The state board and the Utah Board of Higher Education shall] coordinate
659     access to the unique student identifier of a public education student who later attends an
660     institution within the state system of higher education.
661          [(5)] (4) (a) The state board and the Department of Workforce Services shall
662     coordinate assignment of a unique student identifier to each student enrolled in a program
663     described in Title 35A, Chapter 15, Preschool Programs.
664          (b) A unique student identifier assigned to a student under Subsection [(5)] (4)(a) shall
665     remain the student's unique student identifier used by the state board when the student enrolls
666     in a public school in kindergarten or a later grade.
667          (c) The state board, the Department of Workforce Services, and a contractor as defined
668     in Section 53F-4-401, shall coordinate access to the unique student identifier of a preschool
669     student who later attends an LEA.
670          Section 19. Section 53E-10-706 is amended to read:
671          53E-10-706. Electronic resources -- Research clearinghouse.
672          (1) The state board shall publish a ULEAD website containing information provided by
673     the director as described in this part.
674          (2) The director shall within two years of appointment:
675          (a) develop and maintain a research clearinghouse publicly available through the
676     website described in Subsection (1); and

677          (b) include in the research clearinghouse:
678          (i) research on K-12 education, including peer-reviewed research;
679          (ii) information on K-12 education innovation and best practices;
680          (iii) an index and explanation of academic, state, federal, or other K-12 education
681     research repositories;
682          (iv) K-12 education research and policy briefs generated by Utah public and private
683     institutions of higher education, including participating institutions, categorized and searchable
684     by topic;
685          (v) access points to and explanation of currently available K-12 education data,
686     including data managed by the Utah Data Research Center created in Section [35A-14-201]
687     53B-33-201 and data maintained by the state board;
688          (vi) other K-12 education information as determined by the director, including
689     information regarding efforts by institutions or other individuals to promote innovative and
690     effective education practices in Utah; and
691          (vii) each innovative practice report prepared by ULEAD, categorized and searchable
692     by topic, location of the studied LEA, and socioeconomic and demographic profile.
693          (3) The director shall publish:
694          (a) an electronic directory of K-12 education experts identified in ULEAD research and
695     reports; and
696          (b) a monthly report to LEAs, via electronic channels provided by the state board,
697     highlighting ULEAD activities and soliciting proposals from education practitioners for
698     ULEAD research and reports.
699          (4) The director may provide electronic seminars or forums for professional learning
700     regarding subjects of ULEAD research and reports to K-12 practitioners.
701          Section 20. Section 53E-10-707 is amended to read:
702          53E-10-707. ULEAD Steering Committee.
703          (1) (a) There is created the ULEAD Steering Committee.

704          (b) The director is the chair of the steering committee.
705          (2) The steering committee shall consist of the following members each appointed for a
706     term of one year:
707          (a) the director;
708          (b) one member appointed by the chair of the state board;
709          (c) the state superintendent or the state superintendent's designee;
710          (d) the staff director of the State Charter School Board or the director's designee;
711          (e) one member appointed by the office of the governor;
712          (f) one member, appointed by the director, who is a superintendent of a school district;
713          (g) one member, appointed by the director, of a local school board;
714          (h) two principals or other public school leaders of public schools that are not charter
715     schools, appointed by the director;
716          (i) two principals or other public school leaders of charter schools, appointed by the
717     director;
718          (j) two educators who hold a current license under Chapter 6, Education Professional
719     Licensure, nominated by LEA leaders and appointed by the director; and
720          (k) two members representing citizens or business, nominated by the members of the
721     public and appointed by the director.
722          (3) (a) A member of the steering committee may be appointed for more than one term.
723          (b) If a midterm vacancy occurs on the steering committee, the appointing individual,
724     as described in Subsection (2), for the vacant position shall appoint an individual for the
725     remainder of the term.
726          (4) (a) The steering committee shall hold a meeting at least semi annually in January
727     and July or on dates otherwise chosen by the director.
728          (b) The state board shall provide space for the steering committee to meet.
729          (5) The steering committee shall:
730          (a) discuss prospective and current ULEAD projects and findings;

731          (b) consult with and make recommendations to the director to prioritize ULEAD
732     reports and areas of focused research;
733          (c) facilitate connections between the director and Utah's political, business, education
734     technology, and academic communities; and
735          (d) make recommendations to improve gathering, retaining, and disseminating
736     education data and research and evaluation findings for use by participating institutions and
737     other education policy researchers, including data managed by the Utah Data Research Center
738     created in Section [35A-14-201] 53B-33-201.
739          (6) In order to determine research priorities for ULEAD, the director shall consult with:
740          (a) members of the Legislature responsible for public education;
741          (b) members of Utah professional education associations, including principals and
742     LEA governing board members; and
743          (c) policy-research centers based in Utah.
744          (7) The state board or state superintendent may request that the director arrange with a
745     participating institution to prepare a report on a specific LEA or area of practice meeting the
746     criteria established in this part.
747          (8) A member of the steering committee may not receive compensation except a
748     member who is a legislator shall receive compensation for travel and other expense
749     reimbursements in accordance with Section 36-2-2.
750          (9) The steering committee shall hold a meeting described in this section in accordance
751     with Title 52, Chapter 4, Open and Public Meetings Act.
752          Section 21. Repealer.
753          This bill repeals:
754          Section 35A-14-101, Title.
755          Section 35A-14-202, Utah Data Research Center -- Powers.
756          Section 22. Appropriation.
757          The following sums of money are appropriated for the fiscal year beginning July 1,

758     2022, and ending June 30, 2023. These are additions to amounts previously appropriated for
759     fiscal year 2023. Under the terms and conditions of Title 63J, Chapter 1, Budgetary Procedures
760     Act, the Legislature appropriates the following sums of money from the funds or accounts
761     indicated for the use and support of the government of the state of Utah.
762     ITEM 1
763          To Utah Board of Higher Education -- Administration
764               From Education Fund
$770,000

765               From Education Fund, One-time
$275,000

766               Schedule of Programs:
767                    Administration                    $1,045,000
768          The Legislature intends that Utah Board of Higher Education use the appropriation
769     provided under this item to pay for up to seven full-time positions and up to two full-time
770     temporary positions, including related costs, for the purposes of implementing the data research
771     program established by the Utah Data Research Center in accordance with Section 53B-33-301
772     and restructuring the storage system for data maintained by the Utah Data Research Center.
773          Section 23. Effective date.
774          This bill takes effect on July 1, 2022, except that Section 53B-28-506 takes effect on
775     January 1, 2024.