Nevada § 388.292 - Collection and uses of personally identifiable information by school service provider; limitations; requirements for transfer or disclosure of personally identifiable information; redaction of personally identifiable information upon request; penalty for violation of provisions

§ 388.292. Collection and uses of personally identifiable information by school service provider; limitations; requirements for transfer or disclosure of personally identifiable information; redaction of personally identifiable information upon request; penalty for violation of provisions

1. Except as otherwise provided in subsections 2 and 5, a school service provider

may collect, use, allow access to or transfer personally identifiable information

concerning a pupil only: (a) For purposes inherent to the use of a school service by a teacher in a classroom

or for the purposes authorized by the board of trustees of the school district in

which the school that the pupil attends is located, the governing body of the charter

school that the pupil attends or the governing body of the university school for profoundly

gifted pupils that the pupil attends, as applicable, so long as it is authorized by

federal and state law; (b) If required by federal or state law; (c) In response to a subpoena issued by a court of competent jurisdiction; (d) To protect the safety of a user of the school service; or (e) With the consent of any person required in a policy of the school district, charter

school or university school for profoundly gifted pupils, as applicable, or, if none,

with the consent of the pupil, if the pupil is at least 18 years of age, or the parent

or legal guardian of the pupil if the pupil is less than 18 years of age. 2. A school service provider may transfer personally identifiable information concerning

a pupil to a third-party service provider if the school service provider provides

notice to any person designated in a policy of the school district, charter school

or university school for profoundly gifted pupils, as applicable, to receive such

notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the

parent or guardian of the pupil and: (a) Contractually prohibits the third-party service provider from using any such information

for any purpose other than providing the contracted school services to, or on behalf

of, the school service provider; (b) Prohibits the third-party service provider from disclosing any personally identifiable

information concerning a pupil unless the disclosure is authorized pursuant to subsection

1; and (c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296 , inclusive. 3. A school service provider shall delete any personally identifiable information

concerning a pupil that is collected or maintained by the school service provider

and that is under the control of the school service provider within a reasonable time

not to exceed 30 days after receiving a request from the board of trustees of the

school district in which the school that the pupil attends is located, the governing

body of the charter school that the pupil attends or the governing body of the university

school for profoundly gifted pupils that the pupil attends, as applicable. The board of trustees or the governing body, as applicable, must have a policy which

allows a pupil who is at least 18 years of age or the parent or legal guardian of

any pupil to review such information and request that such information about the pupil

be deleted. The school service provider shall delete such information upon the request of the

parent or legal guardian of a pupil if no such policy exists. 4. Any agreement entered into by a school service provider that provides for the disclosure

of personally identifiable information must require that the person or governmental

entity to whom the information will be disclosed abide by the requirements imposed

pursuant to this section. 5. A school service provider shall not: (a) Use personally identifiable information to engage in targeted advertising within

the school service or on any other Internet website, online service or mobile application

if the targeted advertising is based upon any information acquired from use of the

school service. (b) Except as otherwise provided in this paragraph, sell personally identifiable information

concerning a pupil. A school service provider may transfer personally identifiable information concerning

pupils to an entity that purchases, merges with or otherwise acquires the school service

and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296 , inclusive, and any contractual provisions between the school service provider and

the board of trustees of a school district, the governing body of a charter school

or the governing body of a university school for profoundly gifted pupils, as applicable,

governing such information. (c) Use personally identifiable information concerning a pupil to create a profile

of the pupil for any purpose not related to the instruction of the pupil provided

by the school without the consent of the appropriate person described in paragraph

(e) of subsection 1. (d) Use personally identifiable information concerning a pupil in a manner that is

inconsistent with any contract governing the activities of the school service provider

for the school service in effect at the time the information is collected or in a

manner that violates any of the provisions of NRS 388.281 to 388.296 , inclusive. (e) Knowingly retain, without the consent of the appropriate person described in paragraph

(e) of subsection 1, personally identifiable information concerning a pupil beyond

the period authorized by the contract governing the activities of the school service

provider. 6. This section does not prohibit the use of personally identifiable information concerning

a pupil that is collected or maintained by a school service provider for the purposes

of: (a) Adaptive learning or providing personalized or customized education; (b) Maintaining or improving the school service; (c) Recommending additional content or services within a school service; (d) Responding to a request for information by a pupil; (e) Soliciting feedback regarding a school service; (f) Performing research which: (1) Is required by federal or state law; or (2) Is authorized by federal or state law, is performed under the direction of a public

school, school district or the Department and does not use any personally identifiable

information concerning a pupil for any purpose relating to advertising or creating

a profile of the pupil for any purpose not related to the instruction of the pupil;

or (g) Allowing a pupil who is at least 18 years of age or the parent or legal guardian

of any pupil to download, transfer, or otherwise maintain data concerning a pupil. 7. A school service provider that violates the provisions of this section is subject

to a civil penalty in an amount not to exceed $5,000 per violation. The Attorney General may recover the penalty in a civil action brought in the name

of the State of Nevada in any court of competent jurisdiction.