Law / United States / 
Michigan
Internet Privacy Protection Act, educational institutions and personal internet accounts
MCL 37.272, 37.274, 37.276 to 37.278
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- If you are an educational institution (a public or private school, school district, school system or other institution, or its agent), do not request a student or prospective student to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account (MCL 37.274(a)).
- Do not expel, discipline, fail to admit or otherwise penalize a student or prospective student for refusing to grant, allow or disclose access to a personal internet account (MCL 37.274(b)).
- If you act as an agent of an educational institution, the same prohibitions bind you, because the Act defines an educational institution to include its agent (MCL 37.272(b)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A violation of section 4 is a misdemeanor punishable by a fine of not more than $1,000.00 (MCL 37.278(1)).
Penalty structure
Misdemeanor fine of not more than $1,000.00 for a violation of section 4 (MCL 37.278(1)).
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 1,000
Statutory damages
An individual who is the subject of a violation may recover not more than $1,000.00 in damages plus reasonable attorney fees and court costs, after a written demand served not later than 60 days before filing a civil action for damages (MCL 37.278(2)).
- As of
- Currency
- USD
What record it asks for
Logging duty
The prohibitions in section 4 limit requests for access to a personal internet account and penalties for refusing. They require no log or record, and section 7 states the Act creates no duty to search or monitor the activity of a personal internet account.
- Kind
- None
- As of
What this law does
The Internet Privacy Protection Act bars an educational institution from requesting a student or prospective student to grant access to, allow observation of, or disclose information that allows access to or observation of the student's or prospective student's personal internet account (MCL 37.274(a)).
It bars an educational institution from expelling, disciplining, failing to admit or otherwise penalizing a student or prospective student for failing to grant that access or to allow or disclose it (MCL 37.274(b)). Educational institution includes an elementary or secondary school, a school system, a school district, an intermediate school district and an agent of an educational institution, whether public or private (MCL 37.272(b)).
The term is to be construed broadly to include public and private institutions of higher education to the greatest extent consistent with constitutional limitations (MCL 37.272(b)).
A personal internet account is an account created via a bounded system established by an internet-based service that requires a user to input or store access information via an electronic device to view, create, use or edit the user's account information, profile, display, communications or stored data (MCL 37.272(d)).
The Act does not prohibit an educational institution from requesting or requiring a student to disclose access information to gain access to or operate an electronic communications device it paid for in whole or in part (MCL 37.276(1)(a)).
The Act also does not prohibit an educational institution from requesting or requiring a student to disclose access information for an account or service the institution provided that the student obtained by virtue of admission or uses for educational purposes (MCL 37.276(1)(b)).
Nor does it prohibit or restrict an educational institution from viewing, accessing or using information about a student or applicant that can be obtained without any required access information or that is available in the public domain (MCL 37.276(2)). The Act does not create a duty for an educational institution to search or monitor the activity of a personal internet account (MCL 37.277(1)).
An educational institution is not liable under the Act for failing to request or require that a student or prospective student grant access to a personal internet account (MCL 37.277(2)). A person who violates section 4 is guilty of a misdemeanor punishable by a fine of not more than $1,000.00 (MCL 37.278(1)).
An individual who is the subject of a violation may bring a civil action to enjoin a violation of section 4 and may recover not more than $1,000.00 in damages plus reasonable attorney fees and court costs (MCL 37.278(2)). The individual must make a written demand of the alleged violator for not more than $1,000.00, with reasonable documentation of the violation, not later than 60 days before filing a civil action for damages (MCL 37.278(2)).
It is an affirmative defense that the educational institution acted to comply with requirements of a federal law or a law of this state (MCL 37.278(3)). The Act took effect immediately on .
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .