Law / United States / 
Maine
Student Information Privacy Act: restrictions on operators of kindergarten to grade 12 school websites, services and applications
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Prohibition, Security, Contract terms, Retention
- Audit expectation
- none
What it requires
- If you operate a website, online service or app that you know is used for kindergarten to grade 12 school purposes and that you designed and marketed for those purposes, do not use student data for targeted advertising, do not use it to amass a profile of a student except for kindergarten to grade 12 school purposes, do not sell it, and do not disclose student personally identifiable information except for a purpose subsection 1, paragraph D lists or subsection 3 permits, unless a student's parent or an eligible student gives explicit written or electronic consent (20-A M.R.S. 953(1)).
- Where you disclose student personally identifiable information to a service provider, bind the provider by contract to use student data only to provide the contracted service to you or on your behalf, to impose the same restrictions on its own service providers, and to implement and maintain reasonable security procedures and practices (20-A M.R.S. 953(1)(D)(6)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the student data, to protect it from unauthorized access, destruction, use, modification and disclosure (20-A M.R.S. 953(2)(A)).
- Delete student data within 45 days of a school's or school administrative unit's request (20-A M.R.S. 953(2)(B)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 953 limits an operator's use and disclosure of student data, requires reasonable security procedures and practices and requires deletion within 45 days of a school's request. It names no log, register or consent record that must be kept, so no logging duty is coded.
- Kind
- None
- As of
What this law does
Without explicit written or electronic consent from a student's parent or an eligible student, an operator may not knowingly engage in the activities that subsection 1 of section 953 lists. One of those activities is using student data to engage in targeted advertising on the operator's service or on any other service when the targeting is based on student data or persistent unique identifiers the operator acquired through its service.
Another is using student data to amass a profile of a student except for kindergarten to grade 12 school purposes. A third is selling student data, a prohibition that does not apply to the acquisition of an operator by another entity as long as the successor remains subject to the section for previously acquired student data. The fourth is disclosing student personally identifiable information, unless the disclosure falls within one of the purposes subsection 1 lists.
Notwithstanding that limit, an operator may disclose student data where another federal or state law requires the disclosure, for legitimate research purposes that state or federal law requires or allows, or to a state agency, school administrative unit or school for kindergarten to grade 12 purposes as state or federal law permits.
Section 953 does not prohibit an operator from using student data to maintain, deliver, develop, support, evaluate, improve or diagnose its own service, for adaptive learning or customized student learning, or for recommendation engines whose recommendations are not determined by payment from a 3rd party.
It also does not prohibit an operator from using or sharing aggregate student data or data from which personally identifying information has been removed to develop and improve its own or other educational services, or to demonstrate or market the effectiveness of its products or services. An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the student data.
An operator must delete student data within 45 days of a school's or school administrative unit's request.
An operator is an entity other than the Department of Education, a school administrative unit or a school, to the extent that it operates an Internet website, online service, online application or mobile application with actual knowledge that it is used for kindergarten to grade 12 school purposes and was designed and marketed for those purposes, and collects, maintains or uses student personally identifiable information in a digital or electronic format.
The chapter does not apply to general audience websites, online services, online applications or mobile applications. An operator that signed a written contract with a school, teacher or local educational agency before the Act took effect had to meet the Act's requirements by the beginning of the 2016-17 school year. Public Law 2015, chapter 256 provides that it takes effect 90 days after the First Regular Session of the 127th Legislature adjourned unless otherwise indicated.
The Laws of Maine give as the general effective date of nonemergency laws passed at that session, so the Act took effect that day. Public Law 2017, chapter 288 amended section 953.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .