An operator shall:
(1) implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information and designed to protect that covered information from unauthorized access, destruction, use, modification, or disclosure;
(2) delete, within a reasonable time period and to the extent practicable, a student’s covered information if the school or school district requests deletion of covered information under the control of the school or school district, unless a student or his or her parent or legal guardian consents to the maintenance of the covered information; and
(3) publicly disclose and provide the school with material information about its collection, use, and disclosure of covered information, including publishing a term of service agreement, privacy policy, or similar document.