Student Online Personal Protection Act, operator duties for K-12 online services

The Student Online Personal Protection Act binds an operator, meaning the operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for those purposes. A K-12 school is a school that offers any of grades kindergarten to 12 and is operated by a school district (MCL 388.1293(c)).

A school district means a school district, intermediate school district or public school academy under the Revised School Code (MCL 388.1293(f)).

Covered information includes personally identifiable information an operator gathers through a K-12 service, such as the student's educational record, contact details, discipline records, test results, special education data, health records, biometric information, search activity, photos, voice recordings and geolocation information (MCL 388.1293(a)(iii)).

An operator may not knowingly engage in targeted advertising on its own service, and may not knowingly target advertising on any other service based on information it acquired because its service was used for K-12 school purposes (MCL 388.1295(1)(a)). An operator may not knowingly use information created or gathered by its service to amass a profile about a student except in furtherance of K-12 school purposes (MCL 388.1295(1)(b)).

Amassing a profile does not include collecting and retaining account registration records or information that remains under the control of the student, the student's parent or guardian or the K-12 school (MCL 388.1295(1)(b)).

An operator may not knowingly sell or rent a student's information, including covered information, but the ban does not apply to the purchase, merger or other acquisition of an operator by another entity if the operator or successor entity complies with section 5 regarding previously acquired student information (MCL 388.1295(1)(c)). An operator may disclose covered information only for the purposes listed in section 5(1)(d), subject to the exceptions in section 5(3) (MCL 388.1295(1)(d)).

An operator may disclose covered information to a service provider only if it contractually bars the service provider from using the information for any purpose other than the contracted service, bars further disclosure to subsequent third parties, and requires reasonable security procedures and practices (MCL 388.1295(1)(d)(vi)).

That subparagraph does not prohibit the operator's own use of information for maintaining, developing, supporting, improving or diagnosing its site, service or application (MCL 388.1295(1)(d)(vi)). An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information (MCL 388.1295(2)(a)).

An operator must delete a student's covered information if the K-12 school or school district requests deletion of covered information under its control (MCL 388.1295(2)(b)).

An operator may use or disclose covered information where federal or state law requires the disclosure, for legitimate research as required or allowed by state or federal law if the information is not used for advertising or to amass a profile for purposes other than K-12 school purposes, and to a state or local educational agency for K-12 school purposes as permitted by state or federal law (MCL 388.1295(3)).

Section 5 does not prohibit an operator from using covered information that is not associated with an identified student to improve educational products or to demonstrate the effectiveness of its products or services, including in marketing (MCL 388.1295(4)(a), (b)).

Nor does it prohibit a recommendation engine that recommends additional educational, learning or employment content or services within the operator's service, if the recommendation is not determined in whole or in part by payment or other consideration from a third party (MCL 388.1295(4)(d)). Section 5 does not limit an operator's use of student data, including covered information, for adaptive learning or customized student learning purposes (MCL 388.1295(5)(b)).

The Act does not apply to general audience Internet websites, online services, online applications or mobile applications (MCL 388.1295(5)(c)). It does not prohibit an operator from marketing educational products directly to parents if the marketing did not result from the use of covered information obtained through the covered service (MCL 388.1295(5)(e)).

It imposes no duty on the provider of an electronic store, gateway, marketplace or other means of purchasing or downloading software or applications to review or enforce compliance by those applications or software (MCL 388.1295(5)(f)). The Act sets no penalty, enforcement procedure or private remedy of its own. The Act took effect on March 22, 2017.