Serves schools or universities, in Delaware

Del. Code Ann. tit. 14, §§ 8101 to 8105 · Read the law's page

• If you are a public or nonpublic institution of higher education or postsecondary education, do not request or require that a student or applicant disclose any password or other related account information in order to gain access to the student's or applicant's social networking site profile or account by way of an electronic communication device (section 8103(a)).
• Do not require or request that a student or applicant log onto a social networking site, mail account or any other internet site or application by way of an electronic communication device in your agent's presence so as to give you access (section 8103(b)).
• Do not monitor or track a student's or applicant's personal electronic communication device by installing software on the device or by remotely tracking it with intercept technology (section 8103(c)).
• Do not request or require that a student or applicant add the employer or its representative, as section 8103(d) reads, to the student's or applicant's personal social networking site profile or account (section 8103(d)).
• Do not access a student's or applicant's social networking site profile or account indirectly through any other person who is a social networking contact of the student or applicant (section 8103(e)).
• Do not discipline, dismiss or otherwise penalize, or threaten to penalize, a student for refusing to disclose that information, and do not fail or refuse to admit an applicant because the applicant refused (section 8104).
• The chapter does not apply to investigations by your public safety department or police agency that have a reasonable articulable suspicion of criminal activity, or to an investigation, inquiry or determination under your threat assessment policy or protocol (section 8105).

Del. Code Ann. tit. 14, §§ 8101A to 8106A · Read the law's page

• If you operate a website, online or cloud computing service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for them, or you collect, maintain or use student data in a digital or electronic format for K-12 school purposes, implement and maintain reasonable security procedures and practices appropriate to the nature of the student data, which at a minimum comply with the Department of Technology and Information's Cloud and Offsite Hosting Policy and include the terms of its Cloud and Offsite Hosting Template for Non-Public Data.
• Delete a student's data within a reasonable timeframe, not to exceed 45 calendar days, if a school district or school requests deletion of data under its control.
• Do not knowingly engage in targeted advertising, on your service or any other, based on student data, state-assigned student identifiers or other persistent unique identifiers acquired because of the use of your covered service.
• Do not knowingly use information created or gathered by your covered service, including state-assigned student identifiers or other persistent unique identifiers, to amass a profile about a student except in furtherance of K-12 school purposes.
• Do not knowingly sell student data. The bar does not apply to the purchase, merger or other acquisition of the operator by another entity that continues to be subject to the chapter for previously acquired student data.
• Do not knowingly disclose student data unless the disclosure is for a reason section 8105A(4) lists: furthering the K-12 school purposes of the service (the recipient may not further disclose it except to allow or improve operability and functionality within the student's classroom or school), legal or regulatory compliance, judicial process, protecting the security or integrity of the service, protecting the safety of users or others, or a service provider you bind by contract to use the data only to provide the contracted service, not to disclose it to subsequent third parties, and to comply with the chapter's security and use limits.

Del. Code Ann. tit. 14, § 4111 · Read the law's page

• If you are a public or private school in Delaware, treat the educational records of your students as confidential, and release them or disclose the personally identifiable information in them only in accordance with the Family Educational Rights and Privacy Act (20 U.S.C. 1232g) and its implementing regulations (34 C.F.R. Part 99) and, for students with disabilities, chapter 31 of title 14 (section 4111(a)).
• If you are an educational institution or program operating in Delaware, including a local education agency or a postsecondary institution or program regulated by a state agency, disclose to the Department of Education the education records, and the personally identifiable information in them, that it needs for the audit or evaluation of state and federal education programs, in accordance with the Family Educational Rights and Privacy Act and its implementing regulations (section 4111(b)(1)).
• If you are a public or private school in Delaware, allow parents and eligible students to inspect and review the education records of their children or themselves, in accordance with the rules and regulations of the Department of Education (section 4111(c)).
• If you are a local education agency or other educational institution or program that outsources data exchange and federal and state reporting to the Department of Education and discloses education records to it without parental consent as a school official, do so only where you would otherwise use your own employees to collect the data, you directly control the Department's use and maintenance of your records, the Department is subject to the Family Educational Rights and Privacy Act's rules on use and redisclosure, and you use reasonable methods to ensure the Department obtains access only to the records necessary for data exchange and federal or state reporting required by law (section 4111(b)(2)).
• If you are the Department of Education, use, compile, maintain, protect, distribute, redisclose and destroy education records, and the personally identifiable information in them, only in compliance with the Family Educational Rights and Privacy Act and its implementing regulations and any other pertinent federal or state privacy statute (section 4111(b)(4)).for a public body