Law / United States / 
North Carolina
Prohibition on a school contractor's sale of personally identifiable student information
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- If you contract with a local board of education or its designee, do not sell any personally identifiable information you obtain from a student through your performance under the contract, where selling includes using it for a business or marketing purpose, unless you hold the prior written authorization of the student's parent or guardian bearing the parent's or guardian's original signature (G.S. 115C-401.1(a) and (b)(3)).
- Do not solicit that authorization or signature through the school's personnel or equipment or on school grounds (G.S. 115C-401.1(a)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A violation is a Class 2 misdemeanor, and when the defendant is an organization the fine is $5,000 for a first violation, $10,000 for a second violation, and $25,000 for a third or subsequent violation (G.S. 115C-401.1(c)).
Penalty structure
Applies to a defendant that is an organization: the fine is $5,000 for a first violation, $10,000 for a second violation, and $25,000 for a third or subsequent violation, so $25,000 is the most one violation draws.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
What record it asks for
Logging duty
The section lets a contractor sell student information only on the prior written authorization of the student's parent or guardian, bearing the parent's or guardian's original signature, so a contractor that sells holds that signed authorization. The section names no log contents, no retention period, no audit and no reader of a record.
- Kind
- Implicit
- As of
- Provision
- 115C-401.1(a) (a sale rests on a prior written authorization bearing the parent's or guardian's original signature)
- Trigger
- consent_or_optout
What this law does
Section 115C-401.1 makes it unlawful for a person who enters into a contract with a local board of education or its designee to sell any personally identifiable information obtained from a student as a result of the person's performance under the contract. The prohibition does not apply if the person obtains the prior written authorization of the student's parent or guardian, and that authorization must include the parent's or guardian's original signature.
The person must not solicit the authorization through the school's personnel or equipment or on school grounds. Under the section, to sell means to sell or otherwise use for a business or marketing purpose. The section does not prohibit the identification and disclosure of directory information in compliance with federal law and local board of education policy or procedure.
A violation is a Class 2 misdemeanor, and when the defendant is an organization the fine is $5,000 for a first violation, $10,000 for a second violation, and $25,000 for a third or subsequent violation. For that fine schedule, section 15A-773(c) of the General Statutes defines an organization to include a corporation, unincorporated association, partnership, and body politic. The section does not preclude the enforcement of civil remedies as otherwise provided by law.
Section 1 of Session Law 2001-500, which enacted the section, took effect when it became law and applies to contracts entered into, renewed, or modified after that date. The Governor approved Session Law 2001-500 on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .