RFP/Contract Checklist Tool







Requirements for Website, Online Service and Mobile App Operators

The Act imposes restrictions on operators of certain websites, online services and mobile apps[vi]  similar to those placed on contractors.  See “Restrictions on Use” above.  In addition, the Act prohibits operators from:

  • engaging in targeted advertising using student data that the operator acquired because of use of the operator’s web site, online service, or mobile application for school purposes; [vii] 
  • storing or collecting student information, student records, or student-generated content for anything other than school purposes; and
  • selling or trading student data to third parties under most circumstances.

However, operators may use de-identified[viii] student information for a variety of purposes such as maintaining its website, providing user recommendations and feedback, responding to a user request for information, marketing its application, and developing other websites or applications.

Source: Shipman & Goodwin

Bethel Public Schools uses the following contract checklist prior to entering contractual agreements with operators, contractors, and consultants.





Bethel Public Schools
Operator/Contractor RFP Software Services Checklist per CT PA 16-189
Operator/Contractor:
Date:
STATEMENTS - Must have written contract with all of the following points:YES
1a statement that student records,[ii] student information,[iii] and student-generated content[iv](collectively, “student data”) are not the property of, or under the control of, a software or electronic service contractor;
2a statement that the contractor will not use student information, student records, or student-generated content (student data) for any purposes other than those authorized pursuant to the contract;
3a statement that the contractor shall take actions designed to ensure the security and confidentiality of student information, student records, and student-generated content; (student data)
4a statement that the student information, student records, or student-generated content (student data) shall not be retained or available to the contractor upon completion of the contracted services unless a student, or parent or legal guardian of a student, chooses to establish or maintain an electronic account with the contractor for the purpose of storing student-generated content;
5a statement that the contractor and the local or regional board of education will ensure compliance with the federal Family Educational Rights and Privacy Act of 1974 (FERPA);
6a statement that Connecticut law governs the rights and duties of all parties to the contract;
7a statement that a court finding of invalidity for any contract provision does not invalidate other contract provisions or applications that are not affected by the finding.
DESCRIPTIONSYES
8a description of the means by which a local or regional board of education may request the deletion of student information, student records, or student-related content (student data) in the possession of the contractor;
9a description of the procedures by which a student, parent, or guardian may (a) review personally identifiable information in student records, student information, or student-generated content (student data) and (b) correct erroneous information, if any;
10a description of the procedures that a contractor will follow for notifying a local or regional board of education when there has been an unauthorized release, disclosure, or acquisition of student information, student records, or student-generated content; (student data) BREACH
bit.ly/189Toollkit
Acronyms
DI - Directory Information
PII - Personally identificable information
SGC - Student generated content