Representative Jefferson Moss proposes the following substitute bill:


1     
HIGHER EDUCATION DATA PRIVACY AND GOVERNANCE

2     
REVISIONS

3     
2022 GENERAL SESSION

4     
STATE OF UTAH

5     
Chief Sponsor: Jacob L. Anderegg

6     
House Sponsor: Jefferson Moss

7     

8     LONG TITLE
9     General Description:
10          This bill enacts and amends provisions related to higher education data privacy and
11     governance.
12     Highlighted Provisions:
13          This bill:
14          ▸     transfers the Utah Data Resource Center (center) from the Department of Workforce
15     Services to the Utah System of Higher Education;
16          ▸     expands the duties of the center by requiring the center to collect and promote
17     access to data from institutions of higher education and collaborate with the Board
18     of Higher Education and the State Board of Education to coordinate access to
19     certain student identifier information;
20          ▸     requires the commissioner of higher education to:
21               •     appoint a director of the center to serve as chair of the Utah Data Research
22     Advisory Board; and
23               •     appoint the member who represents the center to the School Readiness Board;
24          ▸     requires the center to include information regarding the center's activities and
25     accomplishments in the center's annual report to the Legislature;

26          ▸     provides for higher education student data protection at the state and institution of
27     higher education (institution) levels;
28          ▸     requires the state privacy officer to establish a privacy advisory group;
29          ▸     enacts requirements for data protection and maintenance for the Utah Board of
30     Higher Education, institutions, and third-party contractors;
31          ▸     creates requirements for a third-party contractor's use of student data;
32          ▸     creates penalties for an institution that contracts with a third-party contractor that
33     permits unauthorized collecting, sharing, or use of student data;
34          ▸     defines terms; and
35          ▸     makes technical and conforming changes.
36     Money Appropriated in this Bill:
37          This bill appropriates in fiscal year 2023:
38          ▸     to Utah Board of Higher Education -- Administration, as an ongoing appropriation:
39               •     from the Education Fund, $770,000; and
40          ▸     to Utah Board of Higher Education -- Administration, as a one-time appropriation:
41               •     from the Education Fund, $275,000.
42     Other Special Clauses:
43          This bill provides a special effective date.
44     Utah Code Sections Affected:
45     AMENDS:
46          35A-15-201, as last amended by Laws of Utah 2019, Chapters 246, 246 and
47     renumbered and amended by Laws of Utah 2019, Chapters 342, 342 and last
48     amended by Coordination Clause, Laws of Utah 2019, Chapter 342
49          53B-1-109, as last amended by Laws of Utah 2020, Chapter 365
50          53E-1-201, as last amended by Laws of Utah 2021, Chapters 64, 251, and 351
51          53E-4-308, as last amended by Laws of Utah 2020, Chapter 365
52          53E-10-706, as last amended by Laws of Utah 2019, Chapter 186
53          53E-10-707, as last amended by Laws of Utah 2019, Chapter 186
54     ENACTS:
55          53B-28-501, Utah Code Annotated 1953
56          53B-28-502, Utah Code Annotated 1953

57          53B-28-503, Utah Code Annotated 1953
58          53B-28-504, Utah Code Annotated 1953
59          53B-28-505, Utah Code Annotated 1953
60          53B-28-506, Utah Code Annotated 1953
61     RENUMBERS AND AMENDS:
62          53B-33-101, (Renumbered from 35A-14-102, as last amended by Laws of Utah 2020,
63     Chapter 365)
64          53B-33-201, (Renumbered from 35A-14-201, as enacted by Laws of Utah 2017,
65     Chapter 375)
66          53B-33-202, (Renumbered from 35A-14-203, as last amended by Laws of Utah 2020,
67     Chapter 365)
68          53B-33-203, (Renumbered from 35A-14-204, as enacted by Laws of Utah 2017,
69     Chapter 375)
70          53B-33-301, (Renumbered from 35A-14-301, as enacted by Laws of Utah 2017,
71     Chapter 375)
72          53B-33-302, (Renumbered from 35A-14-302, as last amended by Laws of Utah 2020,
73     Chapter 365)
74          53B-33-303, (Renumbered from 35A-14-303, as enacted by Laws of Utah 2017,
75     Chapter 375)
76          53B-33-304, (Renumbered from 35A-14-304, as enacted by Laws of Utah 2017,
77     Chapter 375)
78     REPEALS:
79          35A-14-101, as enacted by Laws of Utah 2017, Chapter 375
80          35A-14-202, as enacted by Laws of Utah 2017, Chapter 375
81     

82     Be it enacted by the Legislature of the state of Utah:
83          Section 1. Section 35A-15-201 is amended to read:
84          35A-15-201. Establishment of the School Readiness Board -- Membership --
85     Funding prioritization.
86          (1) There is created the School Readiness Board within the department composed of:
87          (a) the executive director or the executive director's designee;

88          (b) one member appointed by the State Board of Education;
89          (c) one member appointed by the chair of the State Charter School Board;
90          (d) two members who have research experience in the area of early childhood
91     development, with:
92          (i) one member who is not a legislator and is appointed by the speaker of the House of
93     Representatives; and
94          (ii) one member who represents the Utah Data Research Center created in Section
95     53B-33-201, appointed by the [executive director] commissioner of higher education;
96          (e) one member, who is not a legislator and is appointed by the president of the Senate,
97     who:
98          (i) has expertise in results-based contracts; or
99          (ii) represents a financial institution that has experience managing a portfolio that
100     meets the requirements of the Community Reinvestment Act, 12 U.S.C. Sec. 2901 et seq.;
101          (f) one member, appointed by the executive director, who has expertise in early
102     childhood education;
103          (g) one member, appointed by the state superintendent, who has expertise in early
104     childhood education;
105          (h) one member, appointed by the governor, who represents a nonprofit corporation
106     that focuses on early childhood education; and
107          (i) one member, appointed by the executive director, who owns and operates a licensed
108     child care center located in the state.
109          (2) (a) A member described in Subsection (1)(b), (c), (d), (e), (f), (g), or (h) shall serve
110     for a term of two years.
111          (b) If a vacancy occurs for a member described in Subsection (1)(b), (c), (d), (e), (f),
112     (g), or (h), the individual appointing the member shall appoint a replacement to serve the
113     remainder of the member's term.
114          (3) (a) A member may not receive compensation or benefits for the member's service.
115          (b) A member may serve more than one term.
116          (4) The department shall provide staff support to the board.
117          (5) (a) The board members shall elect a chair of the board from the board's
118     membership.

119          (b) The board shall meet upon the call of the chair or a majority of the board members.
120          (6) In allocating funding received under this chapter, the board shall:
121          (a) give first priority to repayment of an investor who is a party to a results-based
122     contract under the Laws of Utah, 2014, Chapter 304, Section 10; and
123          (b) determine prioritization of funding for the remaining programs described in this
124     chapter.
125          Section 2. Section 53B-1-109 is amended to read:
126          53B-1-109. Coordination of higher education and public education information
127     technology systems -- Use of unique student identifier.
128          (1) As used in this section[, "unique]:
129          (a) "Center" means the Utah Data Research Center created in Section 53B-33-201.
130          (b) "Institution of higher education" means an institution of higher education described
131     in Section 53B-1-102.
132          (c) student identifier" means the same as that term is defined in Section 53E-4-308.
133          (2) The board and State Board of Education, in collaboration with the center, shall:
134          (a) coordinate public education and higher education information technology systems
135     to allow individual student academic achievement to be tracked through both education
136     systems in accordance with this section and Section 53E-4-308[.]; and
137          (b) coordinate access to the unique student identifier of a public education student who
138     later attends an institution of higher education.
139          (3) Information technology systems used at an institution [within the state system] of
140     higher education shall use the unique student identifier of all students who have previously
141     been assigned a unique student identifier.
142          Section 3. Section 53B-28-501 is enacted to read:
143     
Part 5. Higher Education Student Data Protection

144          53B-28-501. Definitions.
145          As used in this part:
146          (1) "Advisory group" means the institution of higher education privacy advisory group
147     established by the state privacy officer under Section 53B-28-502.
148          (2) "Aggregate data" means data that:
149          (a) are totaled and reported at the group, cohort, class, course, institution, region, or

150     state level, with at least 10 individuals in the level; and
151          (b) do not reveal personally identifiable student data.
152          (3) "Data breach" means an unauthorized release of or unauthorized access to
153     personally identifiable student data that an education entity maintains.
154          (4) "Data governance plan" means an education entity's comprehensive plan for
155     managing education data that:
156          (a) incorporates reasonable data industry best practices to maintain and protect student
157     data and other education-related data;
158          (b) describes the role, responsibility, and authority of the board or an institution privacy
159     officer;
160          (c) provides for necessary technical assistance, training, support, and auditing;
161          (d) describes the process for sharing student data between the education entity and
162     another person;
163          (e) describes the education entity's data expungement process, including how to
164     respond to requests for expungement;
165          (f) describes the data breach response process; and
166          (g) is published annually and available on the institution's website or the Utah System
167     of Higher Education's website.
168          (5) "Education entity" means the Utah Board of Higher Education or an institution.
169          (6) "Higher education privacy officer" means a privacy officer that the board designates
170     under Section 53B-28-503.
171          (7) "Institution" means an institution of higher education described in Section
172     53B-1-102.
173          (8) "Minor" means a person younger than 18 years old.
174          (9) (a) "Personally identifiable student data" means student data that identifies or is
175     used by the holder to identify a student.
176          (b) "Personally identifiable student data" includes:
177          (i) a student's first and last name;
178          (ii) the first and last name of a student's family member;
179          (iii) a student's or a student's family's home or physical address;
180          (iv) a student's email address or other online contact information;

181          (v) a student's telephone number;
182          (vi) a student's social security number;
183          (vii) a student's biometric identifier;
184          (viii) a student's health or disability data;
185          (ix) a student's education entity student identification number;
186          (x) a student's social media user name and password or alias;
187          (xi) if associated with personally identifiable student data, the student's persistent
188     identifier, including:
189          (A) a customer number held in a cookie; or
190          (B) a processor serial number;
191          (xii) a combination of a student's last name or photograph with other information that
192     together permits a person to contact the student online;
193          (xiii) information about a student or a student's family that a person collects online and
194     combines with other personally identifiable student data to identify the student; and
195          (xiv) information that, alone or in combination, is linked or linkable to a specific
196     student that would allow a reasonable person in the school community, who does not have
197     personal knowledge of the relevant circumstances, to identify the student with reasonable
198     certainty.
199          (10) "State privacy officer" means the state privacy officer described in Section
200     67-3-13.
201          (11) "Student" means an individual enrolled in an institution.
202          (12) (a) "Student data" means information about a student at the individual student
203     level.
204          (b) "Student data" does not include aggregate or de-identified data.
205          (13) "Third-party contractor" means a person who:
206          (a) is not an institution or an employee of an institution; and
207          (b) pursuant to a contract with an education entity, collects or receives student data in
208     order to provide a product or service, as described in the contract, if the product or service is
209     not related to school photography, yearbooks, graduation announcements, or a similar product
210     or service.
211          Section 4. Section 53B-28-502 is enacted to read:

212          53B-28-502. State student data protection governance.
213          (1) The state privacy officer shall establish a higher education privacy advisory group
214     to advise institutions and institution boards of trustees on student data protection.
215          (2) The advisory group shall consist of:
216          (a) the state privacy officer;
217          (b) the higher education privacy officer; and
218          (c) the following members, appointed by the commissioner of higher education:
219          (i) at least one Utah system of higher education employee; and
220          (ii) at least one representative of the Utah Board of Higher Education.
221          (3) The advisory group shall:
222          (a) discuss and make recommendations to the board and institutions regarding:
223          (i) existing and proposed:
224          (A) board rules; or
225          (B) board policies of the Utah Board of Higher Education or institutions; and
226          (ii) training on protecting student data privacy; and
227          (b) perform other tasks related to student data protection as designated by the Utah
228     Board of Higher Education.
229          (4) The higher education privacy officer shall:
230          (a) provide training and support to institution boards and employees; and
231          (b) produce:
232          (i) resource materials;
233          (ii) model data governance plans;
234          (iii) model forms for institution student data protection governance; and
235          (iv) a model data collection notice.
236          (5) The board shall:
237          (a) (i) create and maintain a data governance plan; and
238          (ii) annually publish the data governance plan on the Utah System of Higher Education
239     website; and
240          (b) establish standards for:
241          (i) institution policies to protect student data;
242          (ii) institution data governance plans; and

243          (iii) a third-party contractor's use of student data.
244          Section 5. Section 53B-28-503 is enacted to read:
245          53B-28-503. Institution student data protection governance.
246          (1) (a) An institution shall adopt policies to protect student data in accordance with this
247     part and board rule, including the standards the board establishes under Subsection
248     53B-28-502(5).
249          (b) The policies described in Subsection (1)(a) shall take into account the specific
250     needs and priorities of the institution.
251          (2) The board shall designate a higher education privacy officer.
252          (3) The higher education privacy officer shall:
253          (a) verify compliance with student privacy laws, rules, and policies throughout the
254     Utah System of Higher Education;
255          (b) support institutions in developing data governance plans and student data privacy
256     training; and
257          (c) act as the primary point of contact for the state privacy officer.
258          (4) An institution shall:
259          (a) designate an individual to act as the primary contact for the higher education
260     privacy officer;
261          (b) create and maintain an institution:
262          (i) data governance plan that complies with the standards the board establishes under
263     Subsection 53B-28-502(5); and
264          (ii) record of student data privacy training; and
265          (c) annually publish the institution's data governance plan on the institution's website.
266          Section 6. Section 53B-28-504 is enacted to read:
267          53B-28-504. Notification of significant data breach.
268          (1) If a significant data breach occurs at an institution, the institution shall notify each
269     student whose personally-identifiable student data was disclosed.
270          (2) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
271     board shall make rules to define a significant data breach described in Subsection (1).
272          Section 7. Section 53B-28-505 is enacted to read:
273          53B-28-505. Third-party contractors.

274          (1) A third-party contractor shall use personally identifiable student data received
275     under a contract with an education entity strictly for the purpose of providing the contracted
276     product or service within the negotiated contract terms.
277          (2) When contracting with a third-party contractor, an education entity, or a
278     government agency contracting on behalf of an education entity, shall:
279          (a) ensure that the contract terms comply with the standards the board establishes under
280     Subsection 53B-28-502(5); and
281          (b) require the following provisions in the contract:
282          (i) requirements and restrictions related to the collection, use, storage, or sharing of
283     student data by the third-party contractor that are necessary for the education entity to ensure
284     compliance with the provisions of this part and board rule;
285          (ii) a description of a person, or type of person, including an affiliate of the third-party
286     contractor, with whom the third-party contractor may share student data;
287          (iii) provisions that, at the request of the education entity, govern the deletion of the
288     student data received by the third-party contractor;
289          (iv) except as provided in Subsection (4) and if required by the education entity,
290     provisions that prohibit the secondary use of personally identifiable student data by the
291     third-party contractor; and
292          (v) an agreement by the third-party contractor that, at the request of the education entity
293     that is a party to the contract, the education entity or the education entity's designee may audit
294     the third-party contractor to verify compliance with the contract.
295          (3) As authorized by law or court order, a third-party contractor shall share student data
296     as requested by law enforcement.
297          (4) A third-party contractor, as authorized by contract, may:
298          (a) use student data for adaptive learning or customized student learning purposes;
299          (b) market an educational application or product to a student if the third-party
300     contractor does not use student data, shared by or collected on behalf of an education entity, to
301     market the educational application or product;
302          (c) use a recommendation engine to recommend to a student:
303          (i) content that relates to learning or employment, within the third-party contractor's
304     application, if the recommendation is not motivated by payment or other consideration from

305     another party; or
306          (ii) services that relate to learning or employment, within the third-party contractor's
307     application, if the recommendation is not motivated by payment or other consideration from
308     another party;
309          (d) respond to a student request for information or feedback, if the content of the
310     response is not motivated by payment or other consideration from another party;
311          (e) use student data to allow or improve operability and functionality of the third-party
312     contractor's application; or
313          (f) identify for a student nonprofit institutions of higher education or scholarship
314     providers that are seeking students who meet specific criteria:
315          (i) regardless of whether the identified nonprofit institutions of higher education or
316     scholarship providers provide payment or other consideration to the third-party contractor; and
317          (ii) only if the third-party contractor obtains authorization in writing from:
318          (A) the student's parent, if the student is a minor; or
319          (B) the student.
320          (5) At the completion of a contract with an education entity, if the contract has not
321     been renewed, a third-party contractor shall return or delete upon the education entity's request
322     all personally identifiable student data under the control of the education entity unless a student
323     or a minor student's parent consents to the maintenance of the personally identifiable student
324     data.
325          (6) (a) A third-party contractor may not:
326          (i) except as provided in Subsection (6)(b), sell student data;
327          (ii) collect, use, or share student data, if the collection, use, or sharing of the student
328     data is inconsistent with the third-party contractor's contract with the education entity; or
329          (iii) use student data for targeted advertising.
330          (b) A person may obtain student data through the purchase of, merger with, or
331     otherwise acquiring a third-party contractor if the third-party contractor remains in compliance
332     with this section.
333          (7) The provisions of this section do not:
334          (a) apply to the use of a general audience application, including the access of a general
335     audience application with login credentials created by a third-party contractor's application;

336          (b) apply if the student data is shared in accordance with the education entity's
337     directory information policy, as described in 34 C.F.R. Sec. 99.37;
338          (c) apply to the providing of Internet service; or
339          (d) impose a duty on a provider of an interactive computer service, as defined in 47
340     U.S.C. Sec. 230, to review or enforce compliance with this section.
341          (8) A provision of this section that relates to a student's student data does not apply to a
342     third-party contractor if the education entity or third-party contractor obtains authorization from
343     the following individual, in writing, to waive that provision:
344          (a) the student's parent, if the student is a minor; or
345          (b) the student.
346          Section 8. Section 53B-28-506 is enacted to read:
347          53B-28-506. Penalties.
348          (1) (a) An institution that contracts with a third-party contractor that knowingly or
349     recklessly permits unauthorized collecting, sharing, or use of student data under this part:
350          (i) except as provided in Subsection (1)(b), may not enter into a future contract with the
351     third-party contractor; and
352          (ii) may be required by the board to pay a civil penalty of up to $25,000.
353          (b) An education entity may enter into a contract with a third-party contractor that
354     knowingly or recklessly permitted unauthorized collecting, sharing, or use of student data if:
355          (i) the education entity determines that the third-party contractor has corrected the
356     errors that caused the unauthorized collecting, sharing, or use of student data; and
357          (ii) the third-party contractor demonstrates:
358          (A) if the third-party contractor is under contract with the education entity, current
359     compliance with this part; or
360          (B) an ability to comply with the requirements of this part.
361          (c) The board may assess the civil penalty described in Subsection (1)(a)(ii) in
362     accordance with Title 63G, Chapter 4, Administrative Procedures Act.
363          (d) The board may bring an action in the district court of the county in which the office
364     of the education entity is located, if necessary, to enforce payment of the civil penalty described
365     in Subsection (1)(a)(ii).
366          (e) An individual who knowingly or intentionally permits unauthorized collecting,

367     sharing, or use of student data may be found guilty of a class A misdemeanor.
368          (2) (a) A student or a minor student's parent may bring an action against an institution
369     in a court of competent jurisdiction for damages caused by a knowing or reckless violation of
370     Section 53B-28-505 by a third-party contractor that the institution contracts with under
371     53B-28-505.
372          (b) If the court finds that a third-party contractor has violated Section 53B-28-505, the
373     court may order the institution to pay to the parent or student:
374          (i) damages; and
375          (ii) costs.
376          Section 9. Section 53B-33-101, which is renumbered from Section 35A-14-102 is
377     renumbered and amended to read:
378          [35A-14-102].      53B-33-101. Definitions.
379          As used in this chapter:
380          (1) "Advisory board" means the Utah Data Research Advisory Board created in Section
381     [35A-14-203] 53B-33-203.
382          (2) "Center" means the Utah Data Research Center created in Section 53B-33-201.
383          (3) "Data" means any information about a person stored in a physical or electronic
384     record.
385          (4) "Data research program" means the data maintained by the center in accordance
386     with Section [35A-14-301] 53B-33-301.
387          (5) "De-identified data" means data about a person that cannot, without additional
388     information, identify the person to another person or machine.
389          (6) "Director" means the director of the [Workforce Research and Analysis Division]
390     Utah Data Research Center created in Section 53B-33-201.
391          (7) "Institution of higher education" means an institution of higher education described
392     in Section 53B-1-102.
393          [(7)] (8) "Participating entity" means:
394          (a) the State Board of Education, which includes the director as defined in Section
395     53E-10-701;
396          (b) the [Utah Board of Higher Education] board;
397          (c) the Department of Workforce Services; and

398          (d) the Department of Health and Human Services.
399          (9) "Unique student identifier" means the same as that term is defined in Section
400     53E-4-308.
401          Section 10. Section 53B-33-201, which is renumbered from Section 35A-14-201 is
402     renumbered and amended to read:
403          [35A-14-201].      53B-33-201. Utah Data Research Center -- Creation.
404          The Utah Data Research Center is created within the [Workforce Research and Analysis
405     Division within the department] Utah system of higher education.
406          Section 11. Section 53B-33-202, which is renumbered from Section 35A-14-203 is
407     renumbered and amended to read:
408          [35A-14-203].      53B-33-202. Utah Data Research Advisory Board --
409     Composition -- Appointment.
410          (1) There is created the Utah Data Research Advisory Board [in accordance with this
411     section].
412          (2) The [Utah Data Research Advisory Board] advisory board is composed of the
413     following members:
414          (a) the state superintendent of the State Board of Education or the state superintendent's
415     designee;
416          (b) the commissioner [of higher education or the commissioner of higher education's]
417     or the commissioner's designee;
418          (c) the executive director of the Department of Workforce Services or the executive
419     director's designee; and
420          (d) the executive director of the Department of Health and Human Services or the
421     executive director's designee.
422          (3) The [executive director] commissioner shall serve as chair.
423          (4) A member of the advisory board:
424          (a) except to the extent a member's service on the advisory board is related to the
425     member's duties outside of the advisory board, may not receive compensation or benefits for
426     the member's service; and
427          (b) may receive per diem and travel expenses in accordance with:
428          (i) Section 63A-3-106;

429          (ii) Section 63A-3-107; and
430          (iii) rules made by the Division of Finance under Sections 63A-3-106 and 63A-3-107.
431          Section 12. Section 53B-33-203, which is renumbered from Section 35A-14-204 is
432     renumbered and amended to read:
433          [35A-14-204].      53B-33-203. Director -- Additional staff -- Administrative
434     support.
435          (1) The commissioner shall appoint a director [shall] to manage the day-to-day
436     operations of the center.
437          (2) The director may, with the [department's] commissioner's approval, hire staff,
438     including:
439          (a) data scientists;
440          (b) data technology experts; and
441          (c) data security experts.
442          Section 13. Section 53B-33-301, which is renumbered from Section 35A-14-301 is
443     renumbered and amended to read:
444          [35A-14-301].      53B-33-301. Data research program.
445          (1) The center shall establish a data research program for the purpose of analyzing data
446     that is:
447          (a) collected over time;
448          (b) aggregated from multiple sources; and
449          (c) connected and de-identified.
450          (2) The center may, in order to establish the data research program described in
451     Subsection (1):
452          (a) acquire property or equipment in order to store aggregated, connected, and
453     de-identified data derived from data contributed by the participating entities; or
454          (b) contract with a private entity in accordance with Title 63G, Chapter 6a, Utah
455     Procurement Code, or with a state government entity to:
456          (i) store aggregated, connected, and de-identified data derived from data contributed by
457     the participating entities; or
458          (ii) utilize existing aggregated, connected, and de-identified data maintained by a state
459     government entity.

460          (3) A participating entity shall contribute data to the data research program described in
461     Subsection (1) within guidelines established by the center.
462          (4) The center may only release data maintained by the center in accordance with the
463     procedures described in this chapter.
464          (5) The center shall:
465          (a) as directed by the board, serve as a repository in the state of data from institutions
466     of higher education;
467          (b) collaborate with the board and the State Board of Education to coordinate access to
468     the unique student identifier of a public education student who later attends an institution of
469     higher education in accordance with Sections 53B-1-109 and 53E-4-308;
470          (c) develop, establish, and maintain programs that promote access to data from
471     institutions of higher education;
472          (d) identify initiatives that leverage education data that will improve a state citizen's
473     ability to:
474          (i) access services at an institution of higher education; or
475          (ii) graduate with a postsecondary certificate or degree; and
476          (e) perform all other duties provided in this chapter.
477          (6) The director shall identify the resources necessary to successfully implement
478     initiatives described in Subsection (5)(d), in accordance with Section 53B-7-101.
479          (7) The center may:
480          (a) employ staff necessary to carry out the center's duties;
481          (b) purchase, own, create, or maintain equipment necessary to:
482          (i) collect data from the participating entities;
483          (ii) connect and de-identify data collected by the center;
484          (iii) store connected and de-identified data; or
485          (iv) conduct research on data stored or obtained by the center; or
486          (c) contract with a private entity, another state or federal entity, or a political
487     subdivision of the state to carry out the center's duties as provided in this chapter.
488          [(5)] (8) The data research program is not subject to Title 63G, Chapter 2, Government
489     Records Access and Management Act.
490          Section 14. Section 53B-33-302, which is renumbered from Section 35A-14-302 is

491     renumbered and amended to read:
492          [35A-14-302].      53B-33-302. Data research requests.
493          (1) The center shall use data that the center maintains or that a participating entity
494     contributes to the data research program under Section [35A-14-301] 53B-33-301 to conduct
495     research for the purpose of developing public policy for the state.
496          (2) The director, with consultation by the advisory board, shall create a prioritized list
497     of data research for the center to conduct using the data research program each year.
498          (3) (a) In developing the list described in Subsection (2), the center shall accept data
499     research requests from:
500          (i) a legislative committee or a legislative staff office;
501          (ii) the governor or an executive branch agency;
502          (iii) the State Board of Education; and
503          (iv) the [Utah Board of Higher Education] board.
504          [(b) The department shall begin accepting the data research requests described in
505     Subsection (3)(a) on July 1, 2017.]
506          [(c)] (b) The center shall report the list described in Subsection (2) to the Education
507     Interim Committee before December 1 of each year.
508          (4) In addition to conducting data research in accordance with the prioritized list
509     described in Subsection (2), the center may use additional resources to prepare data research at
510     the request of:
511          (a) a state government entity;
512          (b) a political subdivision of the state;
513          (c) a private entity; or
514          (d) a member of the public.
515          (5) The director, with approval by the advisory board, shall determine, for a data
516     research request described in Subsection (4):
517          (a) whether the center has the resources to complete the data research request;
518          (b) the order in which the center shall complete the data research request, if at all; and
519          (c) a reasonable estimated cost for the request.
520          (6) The center, after evaluating a request under Subsection (5), shall:
521          (a) provide the person that requested the data research with a cost estimate; and

522          (b) require, before accepting a data research request, that the person that submitted the
523     data research request agree to pay, once the data research is complete, the full cost of
524     completing the data research request as determined by the center under Subsection (5).
525          (7) The center shall make available to the public, on a website maintained by the
526     center, any data research request that the center completes under this section.
527          (8) The center shall ensure that any data contained in a completed data research request
528     is de-identified.
529          (9) The center shall:
530          (a) establish, by rule made in accordance with Title 63G, Chapter 3, Utah
531     Administrative Rulemaking Act:
532          (i) procedures for submitting a data research request under this section;
533          (ii) criteria to determine how to prioritize data research requests; and
534          (iii) minimum standards for information a person is required to include in a data
535     research request; and
536          (b) create a fee schedule in accordance with Section 63J-1-504 for completing a data
537     research request.
538          (10) In addition to submitting a data research request under Subsection (4), a
539     participating entity, executive branch agency, or legislative staff office may request, and the
540     center may release, a data set from the data research program if the data set is:
541          (a) connected;
542          (b) aggregated; and
543          (c) de-identified.
544          (11) (a) The center shall use any fee the center collects under this section to cover the
545     center's costs to administer this chapter.
546          (b) The center shall deposit any fee the center collects under this section not used to
547     cover the center's costs into the General Fund.
548          Section 15. Section 53B-33-303, which is renumbered from Section 35A-14-303 is
549     renumbered and amended to read:
550          [35A-14-303].      53B-33-303. Data visualization access.
551          (1) In addition to performing data research and responding to data research requests
552     under Section [35A-14-302] 53B-33-302, the center shall create an online data visualization

553     portal that provides access to the public to connected, aggregated, and de-identified data in the
554     program.
555          (2) The data visualization portal described in Subsection (1) shall include role-based
556     dashboards that:
557          (a) allow a user to query data in the program;
558          (b) integrate real-time data; and
559          (c) allow a user to view queried data in a customizable environment.
560          Section 16. Section 53B-33-304, which is renumbered from Section 35A-14-304 is
561     renumbered and amended to read:
562          [35A-14-304].      53B-33-304. Reporting.
563          (1) The center shall report to the Education Interim Committee:
564          (a) before July 1 of each year regarding the center's:
565          (i) research and services priorities for the year; [and]
566          (ii) completed research from the previous year; and
567          (iii) activities and accomplishments in the previous year; and
568          (b) before December 1 of each year, the center's ongoing data research and services
569     priority list described in Subsection [35A-14-302(2)] 53B-33-302(2).
570          (2) The Education Interim Committee shall provide the center ongoing input regarding
571     the center's activities and data research priorities.
572          Section 17. Section 53E-1-201 is amended to read:
573          53E-1-201. Reports to and action required of the Education Interim Committee.
574          (1) In accordance with applicable provisions and Section 68-3-14, the following
575     recurring reports are due to the Education Interim Committee:
576          (a) the report described in Section 9-22-109 by the STEM Action Center Board,
577     including the information described in Section 9-22-113 on the status of the computer science
578     initiative and Section 9-22-114 on the Computing Partnerships Grants Program;
579          (b) the prioritized list of data research described in Section [35A-14-302] 53B-33-302
580     and the report on research and activities described in Section [35A-14-304] 53B-33-304 by the
581     Utah Data Research Center;
582          (c) the report described in Section 35A-15-303 by the State Board of Education on
583     preschool programs;

584          (d) the report described in Section 53B-1-402 by the Utah Board of Higher Education
585     on career and technical education issues and addressing workforce needs;
586          (e) the annual report of the Utah Board of Higher Education described in Section
587     53B-1-402;
588          (f) the reports described in Section 53B-28-401 by the Utah Board of Higher Education
589     regarding activities related to campus safety;
590          (g) the State Superintendent's Annual Report by the state board described in Section
591     53E-1-203;
592          (h) the annual report described in Section 53E-2-202 by the state board on the strategic
593     plan to improve student outcomes;
594          (i) the report described in Section 53E-8-204 by the state board on the Utah Schools for
595     the Deaf and the Blind;
596          (j) the report described in Section 53E-10-703 by the Utah Leading through Effective,
597     Actionable, and Dynamic Education director on research and other activities;
598          (k) the report described in Section 53F-4-203 by the state board and the independent
599     evaluator on an evaluation of early interactive reading software;
600          (l) the report described in Section 53F-4-407 by the state board on UPSTART;
601          (m) the reports described in Sections 53F-5-214 and 53F-5-215 by the state board
602     related to grants for professional learning and grants for an elementary teacher preparation
603     assessment; and
604          (n) the report described in Section 53F-5-405 by the State Board of Education
605     regarding an evaluation of a partnership that receives a grant to improve educational outcomes
606     for students who are low income.
607          (2) In accordance with applicable provisions and Section 68-3-14, the following
608     occasional reports are due to the Education Interim Committee:
609          (a) the report described in Section 35A-15-303 by the School Readiness Board by
610     November 30, 2020, on benchmarks for certain preschool programs;
611          (b) the report described in Section 53B-28-402 by the Utah Board of Higher Education
612     on or before the Education Interim Committee's November 2021 meeting;
613          (c) the reports described in Section 53E-3-520 by the state board regarding cost centers
614     and implementing activity based costing;

615          (d) if required, the report described in Section 53E-4-309 by the state board explaining
616     the reasons for changing the grade level specification for the administration of specific
617     assessments;
618          (e) if required, the report described in Section 53E-5-210 by the state board of an
619     adjustment to the minimum level that demonstrates proficiency for each statewide assessment;
620          (f) in 2022 and in 2023, on or before November 30, the report described in Subsection
621     53E-10-309(7) related to the PRIME pilot program;
622          (g) the report described in Section 53E-10-702 by Utah Leading through Effective,
623     Actionable, and Dynamic Education;
624          (h) if required, the report described in Section 53F-2-513 by the state board evaluating
625     the effects of salary bonuses on the recruitment and retention of effective teachers in high
626     poverty schools;
627          (i) upon request, the report described in Section 53F-5-207 by the state board on the
628     Intergenerational Poverty Intervention Grants Program;
629          (j) the report described in Section 53F-5-210 by the state board on the Educational
630     Improvement Opportunities Outside of the Regular School Day Grant Program;
631          (k) the report described in Section 53G-7-503 by the state board regarding fees that
632     LEAs charge during the 2020-2021 school year;
633          (l) the reports described in Section 53G-11-304 by the state board regarding proposed
634     rules and results related to educator exit surveys;
635          (m) the report described in Section 62A-15-117 by the Division of Substance Abuse
636     and Mental Health, the State Board of Education, and the Department of Health regarding
637     recommendations related to Medicaid reimbursement for school-based health services; and
638          (n) the reports described in Section 63C-19-202 by the Higher Education Strategic
639     Planning Commission.
640          Section 18. Section 53E-4-308 is amended to read:
641          53E-4-308. Unique student identifier -- Coordination of higher education and
642     public education information technology systems -- Coordination of preschool and public
643     education information technology systems.
644          (1) As used in this section, "unique student identifier" means an alphanumeric code
645     assigned to each public education student for identification purposes, which:

646          (a) is not assigned to any former or current student; and
647          (b) does not incorporate personal information, including a birth date or Social Security
648     number.
649          (2) The state board, through the state superintendent, shall assign each public education
650     student a unique student identifier, which shall be used to track individual student performance
651     on achievement tests administered under this part.
652          (3) The state board and the Utah Board of Higher Education, in collaboration with the
653     Utah Data Research Center created in Section 53B-33-201, shall:
654          (a) coordinate public education and higher education information technology systems
655     to allow individual student academic achievement to be tracked through both education
656     systems in accordance with this section and Section 53B-1-109[.]; and
657          [(4)] (b) [The state board and the Utah Board of Higher Education shall] coordinate
658     access to the unique student identifier of a public education student who later attends an
659     institution within the state system of higher education.
660          [(5)] (4) (a) The state board and the Department of Workforce Services shall
661     coordinate assignment of a unique student identifier to each student enrolled in a program
662     described in Title 35A, Chapter 15, Preschool Programs.
663          (b) A unique student identifier assigned to a student under Subsection [(5)] (4)(a) shall
664     remain the student's unique student identifier used by the state board when the student enrolls
665     in a public school in kindergarten or a later grade.
666          (c) The state board, the Department of Workforce Services, and a contractor as defined
667     in Section 53F-4-401, shall coordinate access to the unique student identifier of a preschool
668     student who later attends an LEA.
669          Section 19. Section 53E-10-706 is amended to read:
670          53E-10-706. Electronic resources -- Research clearinghouse.
671          (1) The state board shall publish a ULEAD website containing information provided by
672     the director as described in this part.
673          (2) The director shall within two years of appointment:
674          (a) develop and maintain a research clearinghouse publicly available through the
675     website described in Subsection (1); and
676          (b) include in the research clearinghouse:

677          (i) research on K-12 education, including peer-reviewed research;
678          (ii) information on K-12 education innovation and best practices;
679          (iii) an index and explanation of academic, state, federal, or other K-12 education
680     research repositories;
681          (iv) K-12 education research and policy briefs generated by Utah public and private
682     institutions of higher education, including participating institutions, categorized and searchable
683     by topic;
684          (v) access points to and explanation of currently available K-12 education data,
685     including data managed by the Utah Data Research Center created in Section [35A-14-201]
686     53B-33-201 and data maintained by the state board;
687          (vi) other K-12 education information as determined by the director, including
688     information regarding efforts by institutions or other individuals to promote innovative and
689     effective education practices in Utah; and
690          (vii) each innovative practice report prepared by ULEAD, categorized and searchable
691     by topic, location of the studied LEA, and socioeconomic and demographic profile.
692          (3) The director shall publish:
693          (a) an electronic directory of K-12 education experts identified in ULEAD research and
694     reports; and
695          (b) a monthly report to LEAs, via electronic channels provided by the state board,
696     highlighting ULEAD activities and soliciting proposals from education practitioners for
697     ULEAD research and reports.
698          (4) The director may provide electronic seminars or forums for professional learning
699     regarding subjects of ULEAD research and reports to K-12 practitioners.
700          Section 20. Section 53E-10-707 is amended to read:
701          53E-10-707. ULEAD Steering Committee.
702          (1) (a) There is created the ULEAD Steering Committee.
703          (b) The director is the chair of the steering committee.
704          (2) The steering committee shall consist of the following members each appointed for a
705     term of one year:
706          (a) the director;
707          (b) one member appointed by the chair of the state board;

708          (c) the state superintendent or the state superintendent's designee;
709          (d) the staff director of the State Charter School Board or the director's designee;
710          (e) one member appointed by the office of the governor;
711          (f) one member, appointed by the director, who is a superintendent of a school district;
712          (g) one member, appointed by the director, of a local school board;
713          (h) two principals or other public school leaders of public schools that are not charter
714     schools, appointed by the director;
715          (i) two principals or other public school leaders of charter schools, appointed by the
716     director;
717          (j) two educators who hold a current license under Chapter 6, Education Professional
718     Licensure, nominated by LEA leaders and appointed by the director; and
719          (k) two members representing citizens or business, nominated by the members of the
720     public and appointed by the director.
721          (3) (a) A member of the steering committee may be appointed for more than one term.
722          (b) If a midterm vacancy occurs on the steering committee, the appointing individual,
723     as described in Subsection (2), for the vacant position shall appoint an individual for the
724     remainder of the term.
725          (4) (a) The steering committee shall hold a meeting at least semi annually in January
726     and July or on dates otherwise chosen by the director.
727          (b) The state board shall provide space for the steering committee to meet.
728          (5) The steering committee shall:
729          (a) discuss prospective and current ULEAD projects and findings;
730          (b) consult with and make recommendations to the director to prioritize ULEAD
731     reports and areas of focused research;
732          (c) facilitate connections between the director and Utah's political, business, education
733     technology, and academic communities; and
734          (d) make recommendations to improve gathering, retaining, and disseminating
735     education data and research and evaluation findings for use by participating institutions and
736     other education policy researchers, including data managed by the Utah Data Research Center
737     created in Section [35A-14-201] 53B-33-201.
738          (6) In order to determine research priorities for ULEAD, the director shall consult with:

739          (a) members of the Legislature responsible for public education;
740          (b) members of Utah professional education associations, including principals and
741     LEA governing board members; and
742          (c) policy-research centers based in Utah.
743          (7) The state board or state superintendent may request that the director arrange with a
744     participating institution to prepare a report on a specific LEA or area of practice meeting the
745     criteria established in this part.
746          (8) A member of the steering committee may not receive compensation except a
747     member who is a legislator shall receive compensation for travel and other expense
748     reimbursements in accordance with Section 36-2-2.
749          (9) The steering committee shall hold a meeting described in this section in accordance
750     with Title 52, Chapter 4, Open and Public Meetings Act.
751          Section 21. Repealer.
752          This bill repeals:
753          Section 35A-14-101, Title.
754          Section 35A-14-202, Utah Data Research Center -- Powers.
755          Section 22. Appropriation.
756          The following sums of money are appropriated for the fiscal year beginning July 1,
757     2022, and ending June 30, 2023. These are additions to amounts previously appropriated for
758     fiscal year 2023. Under the terms and conditions of Title 63J, Chapter 1, Budgetary Procedures
759     Act, the Legislature appropriates the following sums of money from the funds or accounts
760     indicated for the use and support of the government of the state of Utah.
761     ITEM 1
762          To Utah Board of Higher Education -- Administration
763               From Education Fund
$770,000

764               From Education Fund, One-time
$275,000

765               Schedule of Programs:
766                    Administration                    $1,045,000
767          The Legislature intends that Utah Board of Higher Education use the appropriation
768     provided under this item to pay for up to seven full-time positions and up to two full-time
769     temporary positions, including related costs, for the purposes of implementing the data research

770     program established by the Utah Data Research Center in accordance with Section 53B-33-301
771     and restructuring the storage system for data maintained by the Utah Data Research Center.
772          Section 23. Effective date.
773          This bill takes effect on July 1, 2022, except that Section 53B-28-506 takes effect on
774     January 1, 2024.