Law / United States / 
District of Columbia
Protecting Students Digital Privacy Act of 2016, operator obligations
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Retention, Security, Breach notice
What it requires
- If you operate a website, online service, online application or mobile application that is designed, marketed and primarily used for pre-k through 12 purposes, know it is used for those purposes, and provide services to a District public school, public charter school or local education agency, or its agent, implement and maintain reasonable security policies and procedures appropriate to the nature of the personally identifiable student information, and include provisions for notifying educational institutions and local education agencies of unauthorized access to it (sections 38-831.01(10) and 38-831.02(a)(1)).
- Agree that personally identifiable student information provided to you to facilitate the use of your pre-k through 12 service is under the control of the local education agency (section 38-831.02(a)(2)).
- Delete personally identifiable student information under a local education agency's control within a reasonable period after services end or complete, unless the agency asks you to preserve it (section 38-831.02(a)(3)).
- Do not knowingly sell, rent or trade personally identifiable student information, unless the transaction is part of a sale, merger or acquisition of your company, or you hold verified consent from the student (13 or older) or the parent (under 13) to do so for the purpose of providing information about employment, scholarships, financial aid or postsecondary opportunities (section 38-831.02(b)(1)(A)).
- Do not knowingly conduct targeted advertising on your service, and do not knowingly target advertising on any other service using information acquired through a student's use of your pre-k through 12 service; advertising based on a student's real-time use or made in response to the student's request for information or feedback is not targeted advertising if you do not retain data about that real-time activity to target later advertisements (sections 38-831.02(b)(1)(B) and 38-831.01(17)).
- Do not knowingly use data created, gathered or stored on your pre-k through 12 service to develop, in full or in part, a profile of a student or group of students, except in furtherance of pre-k through 12 purposes; collecting or retaining account information generated by a student, a parent or an educational institution is not profiling (section 38-831.02(b)(1)(C)).
- Do not knowingly disclose personally identifiable student information except to further the pre-k through 12 purposes of your service or improve its operability or functionality, as District or federal law requires, in response to legal process, a judicial order or a warrant, to protect the safety of individuals or the security or integrity of the service, at the written request or with the consent of the local education agency, or for legitimate research purposes that District or federal law requires or allows under the agency's direction or consent with no personally identifiable student information used for commercial gain (section 38-831.02(b)(1)(D)).
- When you disclose personally identifiable student information to further your pre-k through 12 purposes or improve the service, prohibit the recipient from using it for any purpose other than providing the contracted service and from disclosing it further, require the recipient to maintain reasonable security measures, and require it to delete the information when its services to you end (section 38-831.02(b)(1)(D)(i)).
- If you provide digital storage, management and retrieval of student records, comply with subsections (a) and (b) of section 38-831.02 (section 38-831.02(c)).
These lines are LexLint's reading of the law's text.
What this law does
Section 38-831.02 binds an operator, which is a person that operates an Internet website, online service, online application or mobile application designed, marketed and primarily used for pre-k through 12 purposes, where the person has actual knowledge of that use.
An operator providing services to an educational institution or local education agency must implement and maintain reasonable security policies and procedures for personally identifiable student information, including provisions for notifying them of unauthorized access.
The operator must agree that personally identifiable student information it receives is under the control of the local education agency, and must delete it within a reasonable period after services end unless the agency asks to preserve it.
An operator may not knowingly sell, rent or trade personally identifiable student information, except in a sale, merger or acquisition of the operator or with verified consent to sell, rent or trade specific information for the purpose of providing the student with information about employment, scholarships, financial aid or postsecondary opportunities.
An operator may not knowingly conduct targeted advertising on its own service, or target advertising on any other service based on information acquired through a student's use of its pre-k through 12 service.
Targeted advertising does not include advertising based on a student's real-time use of the operator's service or made in response to the student's request for information or feedback, provided that the operator does not retain data about the real-time activity to target later advertisements. An operator may not knowingly use data gathered on its pre-k through 12 service to develop a profile of a student or group of students, except in furtherance of pre-k through 12 purposes.
A disclosure of personally identifiable student information to further the operator's pre-k through 12 purposes or improve its functionality is permitted only if the operator prohibits the recipient from other uses and further disclosure, requires reasonable security measures, and requires deletion when the recipient's services end. The section does not bar an operator from using, sharing or selling de-identified student information.
The section does not bar an operator from using personally identifiable student information internally to maintain, develop, support, improve or diagnose its service or for adaptive or customized learning, from recommending educational, learning or employment opportunities or responding to a student's request where no third party's payment shapes the result, or from marketing directly to parents where the marketing did not result from personally identifiable student information obtained through the service.
The section does not apply to general audience Internet websites, online services, online applications or mobile applications. Sections 38-831.02, 38-831.03 and 38-831.04 apply as of .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .