Serves schools or universities, in New Hampshire

RSA 189:70 · Read the law's page

• If you are an educational institution, do not require or request that a student or prospective student disclose or provide access to a personal social media account through a user name, password or other means of authentication (RSA 189:70, I(a)).
• Do not require or request that a student or prospective student access a personal social media account in the presence of an employee of the institution in a manner that lets the employee observe its contents (RSA 189:70, I(b)).
• Do not compel a student or prospective student to add anyone to a contact list associated with a personal social media account, or require, request, suggest or cause a change to the account's privacy settings (RSA 189:70, I(c)).
• Do not take or threaten to take action to discipline a student or bar a student from curricular or co-curricular activities, or refuse to admit a prospective student, because the student refused to disclose information or take the actions in RSA 189:70, I(a) to (c) (RSA 189:70, I(d) and (e)).

RSA 189:68-a · Read the law's page

• If you operate a website, online service, online application or mobile application you know is used primarily for K-12 school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising on your site, service or application, or on any other, based on information you acquired because of the use of yours (RSA 189:68-a, II(a)(1)).
• Do not knowingly use information, including persistent unique identifiers, created or gathered by your site, service or application to amass a profile about a K-12 student (RSA 189:68-a, II(a)(2)).
• Do not knowingly sell, lease, rent, trade or otherwise make available a student's information, including covered information, except in an acquisition of the operator where the successor remains subject to the section (RSA 189:68-a, II(a)(3)).
• Do not knowingly disclose protected information unless the disclosure is made to respond to or participate in judicial process (RSA 189:68-a, II(a)(4)).
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and delete a student's covered information if the school or district requests deletion of data under its control (RSA 189:68-a, II(b)).

RSA 193-C:12 · Read the law's page

• If you are the testing entity that administers the state assessment, destroy all student data on the schedule the state contract sets (RSA 193-C:12, IV).
• If you are the testing entity that administers the state assessment, do not disclose student data, unless the student or parent requests it, to any person, organization, entity or government other than the parent or guardian, the department of education, or the school or school district, and do not use it for any other purpose except as the contract between the department and the testing entity defines (RSA 193-C:12, V).

RSA 189:67, II(b), II-a and III · Read the law's page

• If you are a testing entity contracted to administer the state assessment, do not disclose the student data a school or the department of education gives you to anyone other than the parent or guardian, the department, the school or the school district, and do not use it for any other purpose except as RSA 193-C:12 provides; data collected in conjunction with the SAT or ACT is outside this paragraph (RSA 189:67, II(b)).
• If you administer the SAT or ACT used for the state assessment, destroy all of a student's personal information after the test is completed and verified when the student opts to have it destroyed (RSA 189:67, II-a).
• If you perform test-data analysis, do not connect the data to other student data (RSA 189:67, III).