Serves K-12 schools, in District of Columbia

D.C. Code § 38-831.02 · Read the law's page

• If you operate a website, online service, online application or mobile application that is designed, marketed and primarily used for pre-k through 12 purposes, know it is used for those purposes, and provide services to a District public school, public charter school or local education agency, or its agent, implement and maintain reasonable security policies and procedures appropriate to the nature of the personally identifiable student information, and include provisions for notifying educational institutions and local education agencies of unauthorized access to it (sections 38-831.01(10) and 38-831.02(a)(1)).
• Agree that personally identifiable student information provided to you to facilitate the use of your pre-k through 12 service is under the control of the local education agency (section 38-831.02(a)(2)).
• Delete personally identifiable student information under a local education agency's control within a reasonable period after services end or complete, unless the agency asks you to preserve it (section 38-831.02(a)(3)).
• Do not knowingly sell, rent or trade personally identifiable student information, unless the transaction is part of a sale, merger or acquisition of your company, or you hold verified consent from the student (13 or older) or the parent (under 13) to do so for the purpose of providing information about employment, scholarships, financial aid or postsecondary opportunities (section 38-831.02(b)(1)(A)).
• Do not knowingly conduct targeted advertising on your service, and do not knowingly target advertising on any other service using information acquired through a student's use of your pre-k through 12 service; advertising based on a student's real-time use or made in response to the student's request for information or feedback is not targeted advertising if you do not retain data about that real-time activity to target later advertisements (sections 38-831.02(b)(1)(B) and 38-831.01(17)).
• Do not knowingly use data created, gathered or stored on your pre-k through 12 service to develop, in full or in part, a profile of a student or group of students, except in furtherance of pre-k through 12 purposes; collecting or retaining account information generated by a student, a parent or an educational institution is not profiling (section 38-831.02(b)(1)(C)).
• Do not knowingly disclose personally identifiable student information except to further the pre-k through 12 purposes of your service or improve its operability or functionality, as District or federal law requires, in response to legal process, a judicial order or a warrant, to protect the safety of individuals or the security or integrity of the service, at the written request or with the consent of the local education agency, or for legitimate research purposes that District or federal law requires or allows under the agency's direction or consent with no personally identifiable student information used for commercial gain (section 38-831.02(b)(1)(D)).
• When you disclose personally identifiable student information to further your pre-k through 12 purposes or improve the service, prohibit the recipient from using it for any purpose other than providing the contracted service and from disclosing it further, require the recipient to maintain reasonable security measures, and require it to delete the information when its services to you end (section 38-831.02(b)(1)(D)(i)).
• If you provide digital storage, management and retrieval of student records, comply with subsections (a) and (b) of section 38-831.02 (section 38-831.02(c)).

D.C. Code § 38-831.03 · Read the law's page

• School-based personnel, including an employee of an entity the school contracts with who acts as the school's agent at the school or at activities it sponsors (section 38-831.01(16)), must not access the data or functions of a student's 1-to-1 device without the written consent of the student or the student's parent, except as section 38-831.03 provides (section 38-831.03(a)).
• School-based personnel must not access, analyze, share or transfer data on a student's 1-to-1 device, including its browser history, key stroke history or location history, unless the data will be used exclusively for an educational purpose consistent with the personnel's professional duties, exclusively to ensure compliance with District or federal law, on reasonable suspicion of a violation with reasonable suspicion that the device holds evidence of it, to update the device's software or protect it from cyber-threats, in response to a threat to life or safety, or because the data is posted where the general public or permitted school personnel can see it (section 38-831.03(b)).
• Within 72 hours of accessing device data in response to a threat to life or safety, the educational institution that authorized the access must give the student and the student's parent a written description of the precise threat that prompted the access and what data was accessed (section 38-831.03(b)(5)(B)).for a public body
• School-based personnel must not use a 1-to-1 device's location tracking technology to track the device's real-time or historical location, unless the student or parent has reported the device missing or stolen, the device was not returned at the end of the permitted period, a judicial order or warrant orders it, or a threat to life or safety makes it necessary and the access is limited to that purpose (section 38-831.03(c)).
• Within 72 hours of accessing a device's location tracking technology in response to a threat to life or safety, the educational institution that authorized the access must give the student and the student's parent a written description of the precise threat and the data and features accessed (section 38-831.03(c)(4)(B)).for a public body
• School-based personnel must not remotely activate or access the audio or video receiving, transmitting or recording functions of a student's 1-to-1 device, unless the student initiates a video or audio communication with school-based personnel or the device provider, a judicial order or warrant orders it, or an imminent threat to life or safety makes it necessary and the access is limited to that purpose (section 38-831.03(d)).
• Within 72 hours of activating or accessing a device's audio or video function in response to an imminent threat to life or safety, the educational institution that authorized the access must give the student and the student's parent a written description of the precise threat and the data and features accessed or activated (section 38-831.03(d)(3)(B)).for a public body
• When a student permanently returns a 1-to-1 device to an educational institution, the institution must erase all the data stored on the device (section 38-831.03(e)).when it serves a public body
• Before issuing a student a 1-to-1 device, the educational institution must give the student written notice that school-based personnel can search, track or access the device under subsections (b), (c) and (d) of section 38-831.03 (section 38-831.03(f)).for a public body

D.C. Code § 38-831.04 · Read the law's page

• An educational institution or school-based personnel, including an employee of an entity the school contracts with who acts as the school's agent at the school or at activities it sponsors (section 38-831.01(16)), must not take or threaten to take action against a student or prospective student, including discipline, expulsion, unenrollment, refusal to admit, or prohibiting participation in a curricular or extracurricular activity, because the student refused to disclose a username, password or other means of account authentication for a personal media account or personal technological device, to access it in the presence of school-based personnel so they can observe data, to add a person to the list of users who may view it, or to change its privacy settings (section 38-831.04(a)).
• If an educational institution or school-based personnel inadvertently receives the account authentication for a student's or prospective student's personal media account or personal technological device through otherwise lawful means, do not use it to access the account or device, do not share it with anyone, and delete it immediately or as soon as is reasonably practicable (section 38-831.04(b)).
• School-based personnel may search a student's personal media account or personal technological device, or compel the student to produce data from it, on reasonable suspicion that the student used it in furtherance of a violation of an educational institution policy and that it holds evidence of the violation, but only after documenting the suspicion and notifying the student and the student's parent of the suspected violation and of the data or components to be searched (section 38-831.04(c)(1)(A) and (B)).
• Limit a search or compelled production under section 38-831.04(c)(1) to data accessible from the account or device, or components of the device, reasonably likely to yield evidence of the suspected violation, and do not copy, share or transfer data obtained that is unrelated to the suspected violation (section 38-831.04(c)(1)(C) and (D)).
• Where a search is necessary in response to an imminent threat to life or safety, limit it to that purpose, and within 72 hours of the search or compelled production the educational institution that authorized it must give the student and the student's parent a written description of the precise threat and the data accessed (section 38-831.04(c)(2)).for a public body
• An educational institution may seize a student's personal technological device to prevent data deletion pending the notification required by section 38-831.04(c)(1)(B) only for no more than 48 hours, and must store the device securely on its property and not access it during that period (section 38-831.04(d)).for a public body
• If an educational institution creates or provides a media account for a student, give the student notice, when the account is created or within 60 days of August 1, 2017, that school-based personnel may monitor it at any time; without that notice the protections of section 38-831.04 apply to the account (section 38-831.04(f)).for a public body