1. (1) In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g, and other relevant state and federal privacy laws, a student who is currently enrolled in, or has previously been enrolled in, an institution has the right to:

   1. (a) access the student's educational data; and
   2. (b) authorize access to the student's educational data in accordance with this section.

2. (2) An institution shall:

   1. (a) subject to Subsection (3), disclose a student's educational data;
   2. (b) beginning July 1, 2027, offer a secure digital or electronic mechanism as the primary method for obtaining informed consent under this section;
   3. (c) allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student;

   4. (d) when obtaining a student's informed consent:

      1. (i) allow the student to review all consent information before authorization;
      2. (ii) allow the student to revoke consent at any time; and
      3. (iii) prohibit the bundling of unrelated terms or conditions with the consent request; and

   5. (e) regarding a limitation imposed under Subsection (5)(b):

      1. (i) clearly disclose the limitation at the time the institution grants access; and
      2. (ii) provide a reasonable mechanism that allows a student to re-access educational data after the expiration of a time-based or session-based limitation.

3. (3) Except as provided in the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g, an institution shall disclose a student's educational data under this section only:

   1. (a) with the informed consent of the student;
   2. (b) according to the terms of the document expressing the informed consent of the student; and

   3. (c) subject to the agreement of the third party receiving the student's educational data:

      1. (i) to use the student's educational data only as provided in the document expressing the informed consent of the student to the disclosure; and
      2. (ii) to not redisclose the student's educational data to any other party.

4. (4) A third party that receives the educational data of more than 10 students is subject to:

   1. (a) data privacy requirements the Utah Board of Higher Education makes under Subsection 53H-14-502(5); and
   2. (b) policies regarding the protection of student data the institution adopts under Subsection 53H-14-502(1).
5. (5) An institution may impose reasonable time-based or session-based limitations on a student's technical method of access to educational data.

6. (6) An institution may not:

   1. (a) deny, delay, or restrict a student's ability to grant informed consent that complies with this section;
   2. (b) require a student to waive unrelated rights or agree to unrelated terms as a condition of granting informed consent; and

   3. (c) impose a limitation under Subsection (5)(b) that:

      1. (i) restricts the student's underlying right to access the student's educational data;
      2. (ii) prevents the student from requesting renewed access; or
      3. (iii) limits the student's ability to provide informed consent for disclosure of the student's educational data.

7. (7) This section does not alter, limit, or supersede any right or obligation under:

   1. (a) the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g; or
   2. (b) any other applicable state or federal privacy law.
8. (8) The Utah Board of Higher Education may issue nonbinding guidance regarding best practices for consent mechanisms that comply with the requirements of this section.

9. (9)

   1. (a) A student whose educational data is shared as a result of a violation of a third party's failure to comply with the requirements of this section has a private right of action against the third party.
   2. (b) A student described in Subsection (9)(a) does not have a private right of action against the institution.

Enacted by Chapter 234, 2026 General Session