3.   An operator of an online education service shall:

   a.   implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information;
 
   b.   protect that information from unauthorized access, destruction, use, modification, or disclosure; and
 
   c.   delete covered information at the request of a K-12 school or a school district overseeing the student's education through the service or a student who has subsequently reached the age of majority, unless a student after having reached the age of majority or parent or guardian requests that the operator maintain the covered information.
 
   L.2017, c.494, s.3.