Law / United States / 
Hawaii
Uniform Employee and Student Online Privacy Protection Act: educational institutions may not require a student's online account login or content
2021 Haw. Sess. Laws Act 39 (H.B. 125) student online accounts, sections -1, -2, -4 and -5, Uniform Employee and Student Online Privacy Protection Act
In force since .
A sensitive categories rule binding public and private bodies.
- Private right of action
- Yes
- Instrument type
- an act of a legislature
- Obligation class
- Prohibition, Security
What it requires
- If you are an educational institution, public or private, or its agent or designee, do not require, coerce or request a student or prospective student to disclose the login information for, or the content of, a protected personal online account, to alter its settings to make it more accessible to others, to access it in your presence, or to turn over an unlocked personal device to give access to it (section -4(a)(1)).
- Do not take, or threaten to take, adverse action against a student for refusing such a requirement, coercion or request (section -4(a)(2)).
- When a student shares specifically identified content for a permitted purpose, do not access or view unshared content, use the shared content only for that purpose, and do not alter it (section -4(c)).
- If you acquire a student's login information through lawful monitoring of your network or devices, do not use it to access the account or share it, make a reasonable effort to keep it secure, and dispose of it as soon as and as securely as reasonably practicable (section -4(d)).
These lines are LexLint's reading of the law's text.
What this law does
An educational institution, public or private, and its agent or designee may not require, coerce or request a student to disclose the login information for, or the content of, a protected personal online account, to alter the account's settings to make it more accessible to others, to access the account in the institution's presence, or to turn over an unlocked personal device to give access to the account.
An educational institution is a person that provides students an organized program of study or training that is academic, technical, trade-oriented or preparatory for gaining employment and for which it gives academic credit. A student includes a prospective student who expresses interest in, applies for or is being recruited for admission, and a parent or legal guardian of a student under the age of eighteen years.
An educational institution may not take, or threaten to take, adverse action against a student for refusing such a requirement or request.
An institution may still access publicly available information about a student, comply with federal or state law, and, without asking for login information, ask a student to share specifically identified content to comply with its legal obligations, investigate a specific allegation of misconduct or of disclosure of information it must keep confidential, or investigate threats to safety.
An institution that acquires a student's login information through lawful monitoring of its network or devices may not use it to access the account or share it, must make a reasonable effort to keep it secure, and must dispose of it as soon as, as securely as, and to the extent reasonably practicable.
The attorney general may bring a civil action for injunctive and other equitable relief and a civil penalty of up to $1,000 for each violation, not exceeding $100,000 for all violations caused by the same event. A student may bring a civil action for injunctive and other equitable relief, actual and general damages, and costs and reasonable attorney's fees. Act 39 of 2021 took effect on its approval on .
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .
us-hi-2021-haw-sess-laws-39-h-b-125-student-onli