Rhode Island § 16-104-1 - Student Data-Cloud Computing

§ 16-104-1. Student data-cloud computing.

(a) For the purposes of this chapter:

(1) “Cloud computing service” means a service that enables convenient on-demand network access to a shared pool of configurable computing resources to provide a student, teacher, or staff member account-based productivity applications such as email, document storage, and document editing that can be rapidly provisioned and released with minimal management effort or cloud computing service provider interaction.

(2) “Cloud computing service provider” means an entity other than a public elementary or secondary school that operates a cloud computing service.

(3) “Process” means to use, access, manipulate, scan, modify, transform, disclose, store, transmit, transfer, retain, aggregate, or dispose of student data.

(4) “Student data” means any information in any media or format created or provided:

(i) By a student; or

(ii) By a school board employee about a student in the course of using a cloud computing service, including the student’s name, email address, postal address, email message, documents, unique identifiers, and metadata.

(b) Notwithstanding any general or special law to the contrary, any person who provides a cloud computing service to an educational institution operating within the state shall process data of a student enrolled in kindergarten through twelfth (12th) grade for the sole purpose of providing the cloud computing service to the educational institution and shall not process such data for any commercial purposes, including, but not limited to, advertising purposes that benefit the cloud computing service provider.

(c) Each cloud computing service that enters into a contract to provide such services shall certify, in writing, that it shall comply with the provisions of this section.