Law / United States / 
Maryland
Student Data Privacy Act of 2015
Officially Student data privacy: duties of operators of PreK-12 school websites, services and applications
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Security, Prohibition, Retention, Consent
As of .
What it requires
- If you are an operator of a website, online service, online application or mobile application used for a PreK-12 school purpose under a contract or agreement with a Maryland public school or local school system, protect covered information from unauthorized access, destruction, use, modification or disclosure, and implement and maintain reasonable security procedures and practices to protect it (Educ. 4-131(c)(1)-(2)).
- Delete covered information within a reasonable time if the public school or local school system requests deletion of covered information under its authority (Educ. 4-131(c)(3)).
- Do not knowingly engage in targeted advertising based on information, including covered information and persistent unique identifiers, that you acquired because of the use of your site, service or application (Educ. 4-131(d)(1)(i)).
- Do not knowingly use information created or gathered by your site, service or application to make a profile about a student, except in furtherance of a PreK-12 school purpose (Educ. 4-131(d)(1)(ii)).
- Do not knowingly sell a student's information, and stay bound by the section for covered information you already collected if your site, service or application is merged with or acquired by another entity (Educ. 4-131(d)(1)(iii) and (f)).
- Do not disclose covered information except as subsection (e) allows, for example to a recipient that will not further disclose it and must comply with these duties, to a service provider you bind by contract to use it only for the contracted service and to comply with these duties, or for legal compliance, judicial process, or the safety and security of users or the service (Educ. 4-131(d)(1)(iv) and (e)).
- To use or disclose covered information in a way subsections (d) and (e) would otherwise bar, other than by sale, give the student or the student's parent or guardian clear and conspicuous notice and obtain the affirmative consent of the student, if at least 18 years old, or of the parent or guardian (Educ. 4-131(h)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- Does a vendor whose product a teacher adopts without any contract or agreement with the public school or local school system meet the definition of operator in section 4-131(a)(3)(i), which requires the operator to be 'operating in accordance with a contract or an agreement' with the school or system?
What this law does
An operator is an individual or entity that engages with institutions under the school official exception of the federal Family Educational Rights and Privacy Act and operates under a contract or agreement with a public school or local school system in the State to provide a website, online service, online application or mobile application that processes covered information and is used for a PreK-12 school purpose or issued at the direction of a public school, a teacher or another school employee.
Covered information is information that, alone or in combination with other information, is linked or could be linked to a student in a manner that would allow an employee or a student of the student's school to identify the student with reasonable certainty.
Education Article section 4-131 does not apply to a general audience Internet website, online service, online application or mobile application, even if log-in credentials created for an operator's site, service or application may be used to access the general audience site, service or application.
An operator must protect covered information from unauthorized access, destruction, use, modification or disclosure, and implement and maintain reasonable security procedures and practices to protect it. If covered information is under the authority of a public school or local school system in accordance with a contract or agreement, an operator must delete it within a reasonable time if the school or school system requests deletion.
An operator may not knowingly engage in targeted advertising based on information, including covered information and persistent unique identifiers, that it acquired because of the use of its site, service or application. Except in furtherance of a PreK-12 school purpose, an operator may not knowingly use information created or gathered by its site, service or application to make a profile about a student.
An operator may not knowingly sell a student's information, subject to the exceptions in the section, or disclose covered information except as subsection (e) allows. An operator may disclose covered information in furtherance of the PreK-12 school purpose if the recipient does not further disclose it and is legally required to comply with the operator's security and prohibition duties.
An operator may also use or disclose covered information, except by sale, if it provided clear and conspicuous notice to the student or the student's parent or guardian and obtained the affirmative consent of the student, if at least 18 years old, or of the parent or guardian. House Bill 298 of 2015 was approved by the Governor as Chapter 413. House Bill 298 of 2015 carried an effective date of .
Chapter 164 of the Acts of 2022 (House Bill 769) altered certain definitions in Education Article section 4-131 to provide increased protections for certain student data.
When LexLint raises it
When your app profile says your app serves under-18s.