Law / United States / 
Delaware
Student Data Privacy Protection Act: operators of K-12 school services
Del. Code Ann. tit. 14, §§ 8101A to 8106A
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Security, Retention, Prohibition, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you operate a website, online or cloud computing service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for them, or you collect, maintain or use student data in a digital or electronic format for K-12 school purposes, implement and maintain reasonable security procedures and practices appropriate to the nature of the student data, which at a minimum comply with the Department of Technology and Information's Cloud and Offsite Hosting Policy and include the terms of its Cloud and Offsite Hosting Template for Non-Public Data.
- Delete a student's data within a reasonable timeframe, not to exceed 45 calendar days, if a school district or school requests deletion of data under its control.
- Do not knowingly engage in targeted advertising, on your service or any other, based on student data, state-assigned student identifiers or other persistent unique identifiers acquired because of the use of your covered service.
- Do not knowingly use information created or gathered by your covered service, including state-assigned student identifiers or other persistent unique identifiers, to amass a profile about a student except in furtherance of K-12 school purposes.
- Do not knowingly sell student data. The bar does not apply to the purchase, merger or other acquisition of the operator by another entity that continues to be subject to the chapter for previously acquired student data.
- Do not knowingly disclose student data unless the disclosure is for a reason section 8105A(4) lists: furthering the K-12 school purposes of the service (the recipient may not further disclose it except to allow or improve operability and functionality within the student's classroom or school), legal or regulatory compliance, judicial process, protecting the security or integrity of the service, protecting the safety of users or others, or a service provider you bind by contract to use the data only to provide the contracted service, not to disclose it to subsequent third parties, and to comply with the chapter's security and use limits.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 8103A gives the Consumer Protection Unit enforcement authority over the chapter under subchapter II of chapter 25 of title 29. Section 2522(b) of title 29 requires a court to order a person found to have committed a wilful violation, in a proceeding the Attorney General or the Director brings under section 2522(a), to pay the State a civil penalty of not more than $10,000 for each violation. Chapter 81A states no penalty of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Consumer Protection Unit of the Delaware Department of Justice, which has enforcement authority over the chapter and may investigate and prosecute violations in accordance with subchapter II of chapter 25 of title 29 (14 Del. C. section 8103A).
What this law does
An operator is any person other than the Department, school districts or schools who operates a website, online or cloud computing service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for them, or who collects, maintains or uses student data in a digital or electronic format for K-12 school purposes.
An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the student data. An operator must delete a student's data within a reasonable timeframe not to exceed 45 calendar days if a school district or school requests deletion of data under its control. An operator may not knowingly engage in targeted advertising based on student data or on identifiers acquired through a covered service.
An operator may not knowingly use information gathered by a covered service to amass a profile about a student except in furtherance of K-12 school purposes. An operator may not knowingly sell student data, except in the purchase, merger or other acquisition of the operator by another entity that continues to be subject to the chapter. An operator may not knowingly disclose student data except for the reasons section 8105A(4) lists.
Chapter 81A of title 14 is not to be construed to apply to general audience websites, online or cloud computing services, online applications or mobile applications, even if login credentials created for an operator's service may be used to access them. The Consumer Protection Unit of the Department of Justice has enforcement authority over chapter 81A of title 14 and may investigate and prosecute violations in accordance with subchapter II of chapter 25 of title 29 of the Delaware Code.
When LexLint raises it
When your app profile says your app serves under-18s.