20-7-1324. Definitions. As used in 20-7-1323 through 20-7-1326, the following definitions apply:

(1) "Deidentified information" means information that cannot be used to identify an individual pupil.

(2) "K-12 online application" means an internet website, online service, cloud computing service, online application, or mobile application that is used primarily for K-12 school purposes and that was designed and is marketed for K-12 school purposes.

(3) "K-12 school purposes" means activities that customarily take place at the direction of a school, teacher, or school district or aid in the administration of school activities, including but not limited to instruction in the classroom or at home, administrative activities, and collaboration between pupils, school personnel, or parents, or that are for the use and benefit of a school.

(4) "Operator" means the operator of a K-12 online application who knows or reasonably should know that the application is used primarily for K-12 school purposes.

(5) (a) "Protected information" means personally identifiable information or materials, in any media or format, that describes or otherwise identifies a pupil and that is:

(i) created or provided by a pupil, or the pupil's parent or legal guardian, to an operator in the course of the pupil's, parent's, or legal guardian's use of the operator's K-12 online application;

(ii) created or provided by an employee or agent of a school district to an operator in the course of the employee's or agent's use of the operator's K-12 online application; or

(iii) gathered by an operator through the operator's K-12 online application.

(b) The term includes but is not limited to:

(i) information in the pupil's educational record or e-mail messages;

(ii) first and last name, home address, telephone number, e-mail address, or other information that allows physical or online contact;

(iii) discipline records, test results, special education data, juvenile dependency records, grades, or evaluations;

(iv) criminal, medical, or health records;

(v) social security number;

(vi) biometric information;

(vii) disability;

(viii) socioeconomic information;

(ix) food purchases;

(x) political affiliation;

(xi) religious information; or

(xii) text messages, documents, pupil identifiers, search activity, photos, voice recordings, or geolocation information.

(6) (a) "Pupil records" means:

(i) any information directly related to a pupil that is maintained by a school district; or

(ii) any information acquired directly from a pupil through the use of instructional software or applications assigned to the pupil by a teacher or other school district employee.

(b) The term does not include deidentified information, including aggregated deidentified information used:

(i) by a third party to improve educational products for adaptive learning purposes and for customizing pupil learning;

(ii) to demonstrate the effectiveness of a third party's products in the marketing of those products; or

(iii) for the development and improvement of educational sites, services, or applications.

(7) (a) "Pupil-generated content" means materials created by a pupil, including but not limited to essays, research reports, portfolios, creative writing, music or other audio files, photographs, and account information that enables ongoing ownership of pupil content.

(b) The term does not include pupil responses to a standardized assessment for which pupil possession and control would jeopardize the validity and reliability of that assessment.

(8) "Third party" refers to a provider of digital educational software or services, including cloud-based services, for the digital storage, management, and retrieval of pupil records.