Law / United States / District of Columbia

Protecting Students Digital Privacy Act of 2016, student personal accounts and devices

D.C. Code § 38-831.04

In force since 1 Aug 2017.

A sensitive categories rule binding public and private bodies.

Obligation class

Prohibition, Retention, Disclosure

What it requires

• An educational institution or school-based personnel, including an employee of an entity the school contracts with who acts as the school's agent at the school or at activities it sponsors (section 38-831.01(16)), must not take or threaten to take action against a student or prospective student, including discipline, expulsion, unenrollment, refusal to admit, or prohibiting participation in a curricular or extracurricular activity, because the student refused to disclose a username, password or other means of account authentication for a personal media account or personal technological device, to access it in the presence of school-based personnel so they can observe data, to add a person to the list of users who may view it, or to change its privacy settings (section 38-831.04(a)).
• If an educational institution or school-based personnel inadvertently receives the account authentication for a student's or prospective student's personal media account or personal technological device through otherwise lawful means, do not use it to access the account or device, do not share it with anyone, and delete it immediately or as soon as is reasonably practicable (section 38-831.04(b)).
• School-based personnel may search a student's personal media account or personal technological device, or compel the student to produce data from it, on reasonable suspicion that the student used it in furtherance of a violation of an educational institution policy and that it holds evidence of the violation, but only after documenting the suspicion and notifying the student and the student's parent of the suspected violation and of the data or components to be searched (section 38-831.04(c)(1)(A) and (B)).
• Limit a search or compelled production under section 38-831.04(c)(1) to data accessible from the account or device, or components of the device, reasonably likely to yield evidence of the suspected violation, and do not copy, share or transfer data obtained that is unrelated to the suspected violation (section 38-831.04(c)(1)(C) and (D)).
• Where a search is necessary in response to an imminent threat to life or safety, limit it to that purpose, and within 72 hours of the search or compelled production the educational institution that authorized it must give the student and the student's parent a written description of the precise threat and the data accessed (section 38-831.04(c)(2)).
• An educational institution may seize a student's personal technological device to prevent data deletion pending the notification required by section 38-831.04(c)(1)(B) only for no more than 48 hours, and must store the device securely on its property and not access it during that period (section 38-831.04(d)).
• If an educational institution creates or provides a media account for a student, give the student notice, when the account is created or within 60 days of August 1, 2017, that school-based personnel may monitor it at any time; without that notice the protections of section 38-831.04 apply to the account (section 38-831.04(f)).

These lines are LexLint's reading of the law's text.

When LexLint raises it

When your app profile says your app serves K-12 schools.

Back to the example  ·  Lint your app

Page updated 10 November 2026.