(1) An education entity may not collect a student's: (a) social security number; or (b) except as required in Section 78A-6-112, criminal record.

(a) social security number; or

(b) except as required in Section 78A-6-112, criminal record.

(2) An education entity that collects student data shall, in accordance with this section, prepare and distribute, except as provided in Subsection (3), to parents and students a student data collection notice statement that: (a) is a prominent, stand-alone document; (b) is annually updated and published on the education entity's website; (c) states the student data that the education entity collects; (d) states that the education entity will not collect the student data described in Subsection (1); (e) states the student data described in Section 53E-9-308 that the education entity may not share without written consent; (f) includes the following statement: "The collection, use, and sharing of student data has both benefits and risks. Parents and students should learn about these benefits and risks and make choices regarding student data accordingly."; (g) describes in general terms how the education entity stores and protects student data; and (h) states a student's rights under this part.

(a) is a prominent, stand-alone document;

(b) is annually updated and published on the education entity's website;

(c) states the student data that the education entity collects;

(d) states that the education entity will not collect the student data described in Subsection (1);

(e) states the student data described in Section 53E-9-308 that the education entity may not share without written consent;

(f) includes the following statement: "The collection, use, and sharing of student data has both benefits and risks. Parents and students should learn about these benefits and risks and make choices regarding student data accordingly.";

(g) describes in general terms how the education entity stores and protects student data; and

(h) states a student's rights under this part.

(3) The state board may publicly post the state board's collection notice described in Subsection (2).

(4) An education entity may collect the necessary student data of a student if the education entity provides a student data collection notice to: (a) the student, if the student is an adult student; or (b) the student's parent, if the student is not an adult student.

(a) the student, if the student is an adult student; or

(b) the student's parent, if the student is not an adult student.

(5) An education entity may collect optional student data if the education entity: (a) provides, to an individual described in Subsection (4), a student data collection notice that includes a description of: (i) the optional student data to be collected; and (ii) how the education entity will use the optional student data; and (b) obtains written consent to collect the optional student data from an individual described in Subsection (4).

(a) provides, to an individual described in Subsection (4), a student data collection notice that includes a description of: (i) the optional student data to be collected; and (ii) how the education entity will use the optional student data; and

(i) the optional student data to be collected; and

(ii) how the education entity will use the optional student data; and

(b) obtains written consent to collect the optional student data from an individual described in Subsection (4).

(6) An education entity may collect a student's biometric identifier or biometric information if the education entity: (a) provides, to an individual described in Subsection (4), a biometric information collection notice that is separate from a student data collection notice, which states: (i) the biometric identifier or biometric information to be collected; (ii) the purpose of collecting the biometric identifier or biometric information; and (iii) how the education entity will use and store the biometric identifier or biometric information; and (b) obtains written consent to collect the biometric identifier or biometric information from an individual described in Subsection (4).

(a) provides, to an individual described in Subsection (4), a biometric information collection notice that is separate from a student data collection notice, which states: (i) the biometric identifier or biometric information to be collected; (ii) the purpose of collecting the biometric identifier or biometric information; and (iii) how the education entity will use and store the biometric identifier or biometric information; and

(i) the biometric identifier or biometric information to be collected;

(ii) the purpose of collecting the biometric identifier or biometric information; and

(iii) how the education entity will use and store the biometric identifier or biometric information; and

(b) obtains written consent to collect the biometric identifier or biometric information from an individual described in Subsection (4).

(7) Except under the circumstances described in Subsection 53G-8-211(2), an education entity may not refer a student to an evidence-based alternative intervention described in Subsection 53G-8-211(3) without written consent.