{"data":{"id":"us-ky/krs-365.734","jurisdiction":"us-ky","citation":"KRS 365.734","heading":"Prohibited uses of personally identifiable student information by cloud","body":"computing service provider -- Administrative regulations.\n(1) As used in this section:\n(a) \"Cloud computing service\" means a service that provides, and that is marketed\nand designed to provide, an educational institution with account -based access\nto online computing resources;\n(b) \"Cloud computing service provider\" means any person other than an\neducational institution that operates a cloud computing service;\n(c) \"Educational institution\" means any public, private, or school administrative\nunit serving students in kindergarten to grade twelve (12);\n(d) \"Person\" means an individual, partnership, corporation, association, company,\nor any other legal entity;\n(e) \"Process\" means to use,  access, collect, manipulate, scan, modify, analyze,\ntransform, disclose, store, transmit, aggregate, or dispose of student data; and\n(f) \"Student data\" means any information or material, in any medium or format,\nthat concerns a student and is created or p rovided by the student in the course\nof the student's use of cloud computing services, or by an agent or employee\nof the educational institution in connection with the cloud computing services.\nStudent data includes the student's name, e -mail address, e -mail messages,\npostal address, phone number, and any documents, photos, or unique\nidentifiers relating to the student.\n(2) A cloud computing service provider shall not process student data for any purpose\nother than providing, improving, developing, or maint aining the integrity of its\ncloud computing services, unless the provider receives express permission from the\nstudent's parent. However, a cloud computing service provider may assist an\neducational institution to conduct educational research as permitted by the Family\nEducational Rights and Privacy Act of 1974, as amended, 20 U.S.C. sec. 1232g. A\ncloud computing service provider shall not in any case process student data to\nadvertise or facilitate advertising or to create or correct an individual or househ old\nprofile for any advertisement purpose, and shall not sell, disclose, or otherwise\nprocess student data for any commercial purpose.\n(3) A cloud computing service provider that enters into an agreement to provide cloud\ncomputing services to an educationa l institution shall certify in writing to the\neducational institution that it will comply with subsection (2) of this section.\n(4) The Kentucky Board of Education may promulgate administrative regulations in\naccordance with KRS Chapter 13A as necessary to carry out the requirements of\nthis section.","path":["KRS Chapter 365"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43327","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:59:02Z","sha256":"3d843a2792f6db66a01a9111bf6f24cec2ad99f24f0dc458f87617082ed2975b","source_id":"us-ky","stale":false,"prev":"us-ky/krs-365.732","next":"us-ky/krs-365.750"},"notice":"GroundRules: Original legal text. Not legal advice."}