Student Online Personal Information Protection: operator duties for K-12 school services

Hawaii's Student Online Personal Information Protection subpart binds the operator of a website, online service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for those purposes. The subpart defines a K-12 school as a school offering any of grades kindergarten to twelve that is a public school.

The subpart defines covered information as personally identifiable information or material, or information linked to it, that is not publicly available and is created by or provided to an operator by a student, a parent or legal guardian, or an employee or agent of a K-12 school or complex for K-12 school purposes, or is gathered by an operator for K-12 school purposes and personally identifies a student, including biometric information, geolocation information, voice recordings, photos, search activity, health records and special education data.

The subpart's definition of targeted advertising excludes advertising to a student based on the student's current visit to an online location, or in response to the student's request for information or feedback, without retention of the student's online activities or requests over time for the purpose of targeting later advertisements.

Section 302A-500(a)(1) bars an operator from knowingly engaging in targeted advertising on its site, service or application, or targeting advertising elsewhere on information it acquired through the use of that site, service or application for K-12 school purposes. Section 302A-500(a)(2) bars an operator from knowingly using information, including persistent unique identifiers, to amass a profile about a student except in furtherance of K-12 school purposes.

Section 302A-500(a)(2) provides that amassing a profile does not include the collection and retention of account information that remains under the control of the student, the student's parent or guardian, or a K-12 school. Section 302A-500(a)(3) bars an operator from knowingly selling or renting a student's information, including covered information, other than in the acquisition of the operator by another entity that complies with the section.

Section 302A-500(a)(4) bars an operator from knowingly disclosing covered information except for the purposes the paragraph lists. Paragraph (A) of section 302A-500(a)(4) permits a disclosure in furtherance of the K-12 school purpose of the site, service or application, if the recipient does not further disclose the information unless done to allow or improve operability and functionality of the operator's site, service or application.

Paragraphs (B) to (E) of section 302A-500(a)(4) permit a disclosure to ensure legal and regulatory compliance or protect against liability, to respond to or participate in the judicial process, to protect the safety or integrity of users of the site or others or the security of the site, service or application, and for a school, educational or employment purpose requested by the student or the student's parent or guardian, if the information is not used or further disclosed for any other purpose.

Paragraph (F) of section 302A-500(a)(4) permits a disclosure to a third party if the operator contractually prohibits the third party from using covered information for any other purpose, prohibits onward disclosure to subsequent third parties, and requires the third party to implement and maintain reasonable security procedures and practices.

Section 302A-500(a) states that nothing in the section prohibits an operator's use of information for maintaining, developing, supporting, improving or diagnosing the operator's site, service or application. Section 302A-500(b)(1) requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information.

Section 302A-500(b)(2) requires an operator to delete a student's covered information within a reasonable time when the K-12 school or complex requests deletion of covered information under its control, unless a student or a student's parent or guardian consents to the maintenance of the covered information.

Section 302A-500(c) permits an operator to use or disclose a student's covered information if other federal or state law requires the disclosure and the operator complies with that law in protecting and disclosing it, for legitimate research purposes required by state or federal law or allowed by state or federal law under the direction of a K-12 school, complex or the department, if the covered information is not used for advertising or to amass a profile on the student for purposes other than K-12 school purposes, and to a state or local educational agency, including K-12 schools and complexes, for K-12 school purposes as permitted by state or federal law.

Section 302A-500(d) permits an operator to use covered information to improve educational products, use information to demonstrate the effectiveness of its products or services including in marketing them, and share information for the development and improvement of educational sites, services or applications, in each case where the information is not associated with an identified student, and to recommend educational, learning or employment content or services to a student, or respond to a student's request for information or feedback, where the recommendation or response is not determined in whole or in part by payment or other consideration from a third party.

Section 302A-500(e)(3) provides that the section does not apply to general audience websites, online services, online applications or mobile applications, even if login credentials created for an operator's site, service or application may be used to access them.

Section 302A-500(e) also provides that the section does not limit a law enforcement agency's authority to obtain content or information from an operator as authorized by law or under a court order, an operator's use of student data for adaptive learning or customized student learning purposes, or service providers providing internet connectivity to schools or students and their families, and does not prohibit students from downloading, exporting, transferring, saving or maintaining their own student data or documents.

Section 302A-500(e) further provides that the section does not prohibit an operator from marketing educational products directly to parents or guardians if the marketing did not result from the use of covered information obtained by providing services covered by the section, and imposes no duty on a provider of an electronic store, gateway or marketplace for software or applications, or on a provider of an interactive computer service, to review or enforce compliance with the section. Act 40 of 2016 added the subpart to chapter 302A. Act 40 took effect on its approval on April 29, 2016.