1. Except as otherwise provided in subsections 2 and 5, a school service provider may collect, use, allow access to or transfer personally identifiable information concerning a pupil only:

(a) For purposes inherent to the use of a school service by a teacher in a classroom or for the purposes authorized by the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable, so long as it is authorized by federal and state law;

(b) If required by federal or state law;

(c) In response to a subpoena issued by a court of competent jurisdiction;

(d) To protect the safety of a user of the school service; or

(e) With the consent of any person required in a policy of the school district, charter school or university school for profoundly gifted pupils, as applicable, or, if none, with the consent of the pupil, if the pupil is at least 18 years of age, or the parent or legal guardian of the pupil if the pupil is less than 18 years of age.

2. A school service provider may transfer personally identifiable information concerning a pupil to a third-party service provider if the school service provider provides notice to any person designated in a policy of the school district, charter school or university school for profoundly gifted pupils, as applicable, to receive such notice or, if none, to the pupil, if the pupil is at least 18 years of age, or the parent or guardian of the pupil and:

(a) Contractually prohibits the third-party service provider from using any such information for any purpose other than providing the contracted school services to, or on behalf of, the school service provider;

(b) Prohibits the third-party service provider from disclosing any personally identifiable information concerning a pupil unless the disclosure is authorized pursuant to subsection 1; and

(c) Requires the third-party service provider to comply with the requirements of NRS 388.281 to 388.296, inclusive.

3. A school service provider shall delete any personally identifiable information concerning a pupil that is collected or maintained by the school service provider and that is under the control of the school service provider within a reasonable time not to exceed 30 days after receiving a request from the board of trustees of the school district in which the school that the pupil attends is located, the governing body of the charter school that the pupil attends or the governing body of the university school for profoundly gifted pupils that the pupil attends, as applicable. The board of trustees or the governing body, as applicable, must have a policy which allows a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to review such information and request that such information about the pupil be deleted. The school service provider shall delete such information upon the request of the parent or legal guardian of a pupil if no such policy exists.

4. Any agreement entered into by a school service provider that provides for the disclosure of personally identifiable information must require that the person or governmental entity to whom the information will be disclosed abide by the requirements imposed pursuant to this section.

5. A school service provider shall not:

(a) Use personally identifiable information to engage in targeted advertising.

(b) Except as otherwise provided in this paragraph, sell personally identifiable information concerning a pupil. A school service provider may transfer personally identifiable information concerning pupils to an entity that purchases, merges with or otherwise acquires the school service and the acquiring entity becomes subject to the requirements of NRS 388.281 to 388.296, inclusive, and any contractual provisions between the school service provider and the board of trustees of a school district, the governing body of a charter school or the governing body of a university school for profoundly gifted pupils, as applicable, governing such information.

(c) Use personally identifiable information concerning a pupil to create a profile of the pupil for any purpose not related to the instruction of the pupil provided by the school without the consent of the appropriate person described in paragraph (e) of subsection 1.

(d) Use personally identifiable information concerning a pupil in a manner that is inconsistent with any contract governing the activities of the school service provider for the school service in effect at the time the information is collected or in a manner that violates any of the provisions of NRS 388.281 to 388.296, inclusive.

(e) Knowingly retain, without the consent of the appropriate person described in paragraph (e) of subsection 1, personally identifiable information concerning a pupil beyond the period authorized by the contract governing the activities of the school service provider.

6. This section does not prohibit the use of personally identifiable information concerning a pupil that is collected or maintained by a school service provider for the purposes of:

(a) Adaptive learning or providing personalized or customized education;

(b) Maintaining or improving the school service;

(c) Recommending additional content or services within a school service;

(d) Responding to a request for information by a pupil;

(e) Soliciting feedback regarding a school service; or

(f) Allowing a pupil who is at least 18 years of age or the parent or legal guardian of any pupil to download, transfer, or otherwise maintain data concerning a pupil.

7. A school service provider that violates the provisions of this section is subject to a civil penalty in an amount not to exceed $5,000 per violation. The Attorney General may recover the penalty in a civil action brought in the name of the State of Nevada in any court of competent jurisdiction.

(Added to NRS by 2015, 1852)