3. An operator of an online education service shall:
a. implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information;
b. protect that information from unauthorized access, destruction, use, modification, or disclosure; and
c. delete covered information at the request of a K-12 school or a school district overseeing the student's education through the service or a student who has subsequently reached the age of majority, unless a student after having reached the age of majority or parent or guardian requests that the operator maintain the covered information.