(1) (a) A school service contract provider may collect, use, and share student personally identifiable information only for the purposes authorized in the contract between the school service contract provider and a public education entity or with the consent of the student who is the subject of the information or the student's parent.

(b) A school service contract provider must obtain the consent of the student or the student's parent before using student personally identifiable information in a manner that is materially inconsistent with the school service contract provider's privacy policy or materially inconsistent with the contract between the school service contract provider and the public education entity that applies to the collection of the student personally identifiable information.

(2) A school service contract provider shall not:

(a) Sell student personally identifiable information; except that this prohibition does not apply to the purchase, merger, or other type of acquisition of a school service contract provider, or any assets of a school service contract provider, by another entity, so long as the successor entity continues to be subject to the provisions of this article with respect to student personally identifiable information that the school service contract provider acquired while subject to the provisions of this article;

(b) Use or share student personally identifiable information for purposes of targeted advertising to students; or

(c) Use student personally identifiable information to create a personal profile of a student other than for supporting purposes authorized by the contracting public education entity or with the consent of the student or the student's parent.

(3) Notwithstanding any provision of paragraph (b) of subsection (1) or of subsection (2) of this section to the contrary:

(a) (I) A school service contract provider may use or disclose student personally identifiable information to:

(A) Ensure legal or regulatory compliance or to take precautions against liability;

(B) Respond to or participate in the judicial process;

(C) Protect the safety of users or others on the school service contract provider's website, online service, online application, or mobile application; or

(D) Investigate a matter related to public safety.

(II) If a school service contract provider uses or discloses student personally identifiable information as allowed in subparagraph (I) of this paragraph (a), the contract provider shall notify the contracting public education entity as soon as possible after the use or disclosure of the information.

(b) A school service contract provider may use, or disclose student personally identifiable information to, a subcontractor only if the school service contract provider contractually requires the subcontractor to comply with section 22-16-108, this section, and sections 22-16-110 and 22-16-111. The provisions of this paragraph (b) apply to the ability of an initial or subsequent subcontractor to further subcontract. If a public education entity determines that an initial or subsequent subcontractor has committed a material breach of the contract that involves the misuse or unauthorized release of student personally identifiable information, the public education entity shall comply with the requirements of section 22-16-105 (5)(a) or 22-16-107 (2)(a), as applicable; except that the public education entity is not required to consider terminating the contract if the school service contract provider terminates the contract with the subcontractor as soon as possible after the contract provider knows or has reason to know of the initial or subsequent subcontractor's material breach.

(4) For purposes of this section and section 22-16-110, a student may consent to the use, sharing, or retention of the student's student personally identifiable information only if the student is at least eighteen years of age or legally emancipated.