(1) (a) A student owns the student's personally identifiable student data. (b) An education entity shall allow the following individuals to access a student's student data that is maintained by the education entity: (i) the student's parent; (ii) the student; and (iii) in accordance with the education entity's internal policy described in Section 53E-9-303 and in the absence of a parent, an individual acting as a parent to the student.

(a) A student owns the student's personally identifiable student data.

(b) An education entity shall allow the following individuals to access a student's student data that is maintained by the education entity: (i) the student's parent; (ii) the student; and (iii) in accordance with the education entity's internal policy described in Section 53E-9-303 and in the absence of a parent, an individual acting as a parent to the student.

(i) the student's parent;

(ii) the student; and

(iii) in accordance with the education entity's internal policy described in Section 53E-9-303 and in the absence of a parent, an individual acting as a parent to the student.

(2) (a) If a significant data breach occurs at an education entity, the education entity shall notify: (i) the student, if the student is an adult student; or (ii) the student's parent, if the student is not an adult student. (b) The state board shall make rules to define a significant data breach described in Subsection (2)(a).

(a) If a significant data breach occurs at an education entity, the education entity shall notify: (i) the student, if the student is an adult student; or (ii) the student's parent, if the student is not an adult student.

(i) the student, if the student is an adult student; or

(ii) the student's parent, if the student is not an adult student.

(b) The state board shall make rules to define a significant data breach described in Subsection (2)(a).