MT SB118

Establishes a "right to be forgotten" allowing students or parents to request deletion of education data from the Education and Workforce Data Governing Board within 45 days, with possible 45-90 day extensions for complex requests

Prohibits direct use of student Social Security numbers as unique identifiers for linking education and workforce data, though allows SSNs for generating matching keys

Requires the Superintendent of Public Instruction to ensure vendor contracts include data privacy and security provisions with penalties for noncompliance, and mandates regular compliance audits

Expands the K-12 Data Task Force duties to include developing data security plans, breach notification procedures, and providing annual notification to parents and students of their privacy rights

Strengthens the definition of "deidentified data" to require removal of enough information so individuals cannot reasonably be re-identified, and explicitly excludes juvenile records, criminal records, medical records, SSNs, and biometric information from education data unless in the student's education record