RFP/Contract Checklist Tool

Requirements for Website, Online Service and Mobile App Operators

The Act imposes restrictions on operators of certain websites, online services and mobile apps[vi]  similar to those placed on contractors.  See “Restrictions on Use” above.  In addition, the Act prohibits operators from:

  • engaging in targeted advertising using student data that the operator acquired because of use of the operator’s web site, online service, or mobile application for school purposes; [vii] 
  • storing or collecting student information, student records, or student-generated content for anything other than school purposes; and
  • selling or trading student data to third parties under most circumstances.

However, operators may use de-identified[viii] student information for a variety of purposes such as maintaining its website, providing user recommendations and feedback, responding to a user request for information, marketing its application, and developing other websites or applications.

Source: Shipman & Goodwin

Bethel Public Schools uses the following contract checklist prior to entering contractual agreements with operators, contractors, and consultants.

Bethel Public Schools
Operator/Contractor RFP Software Services Checklist per CT PA 16-189
STATEMENTS - Must have written contract with all of the following points:YES
1a statement that student records,[ii] student information,[iii] and student-generated content[iv](collectively, “student data”) are not the property of, or under the control of, a software or electronic service contractor;
2a statement that the contractor will not use student information, student records, or student-generated content (student data) for any purposes other than those authorized pursuant to the contract;
3a statement that the contractor shall take actions designed to ensure the security and confidentiality of student information, student records, and student-generated content; (student data)
4a statement that the student information, student records, or student-generated content (student data) shall not be retained or available to the contractor upon completion of the contracted services unless a student, or parent or legal guardian of a student, chooses to establish or maintain an electronic account with the contractor for the purpose of storing student-generated content;
5a statement that the contractor and the local or regional board of education will ensure compliance with the federal Family Educational Rights and Privacy Act of 1974 (FERPA);
6a statement that Connecticut law governs the rights and duties of all parties to the contract;
7a statement that a court finding of invalidity for any contract provision does not invalidate other contract provisions or applications that are not affected by the finding.
8a description of the means by which a local or regional board of education may request the deletion of student information, student records, or student-related content (student data) in the possession of the contractor;
9a description of the procedures by which a student, parent, or guardian may (a) review personally identifiable information in student records, student information, or student-generated content (student data) and (b) correct erroneous information, if any;
10a description of the procedures that a contractor will follow for notifying a local or regional board of education when there has been an unauthorized release, disclosure, or acquisition of student information, student records, or student-generated content; (student data) BREACH
DI - Directory Information
PII - Personally identificable information
SGC - Student generated content