Law / United States / 
Oregon
Oregon Student Information Protection Act
Officially Oregon Student Information Protection Act: duties of operators of kindergarten through grade 12 online services
Also known as OSIPA.
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Retention, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you operate an Internet website, online service, online application or mobile application that you know is used primarily for kindergarten through grade 12 school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising on it (ORS 336.184(3)(a)(A)).
- Do not knowingly target advertising on any other site, service or application based on information, including covered information and persistent unique identifiers, you acquired because of the kindergarten through grade 12 use of your service (ORS 336.184(3)(a)(B)).
- Do not use information created or gathered by your service to amass a profile about a student, except in furtherance of kindergarten through grade 12 school purposes (ORS 336.184(3)(a)(C)).
- Do not sell a student's information, including covered information; the bar does not apply to the acquisition of an operator by another entity that continues to be subject to the section (ORS 336.184(3)(a)(D)).
- Do not disclose covered information unless the disclosure is made for the school purposes of the service to a recipient bound to the same limits, to ensure legal compliance, to respond to the judicial process, to protect safety or security, or to a service provider you bind by contract to those limits and to reasonable security (ORS 336.184(3)(a)(E)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information (ORS 336.184(4)(a)).
- Delete a student's covered information within a reasonable time if the school or school district requests deletion of data under its control (ORS 336.184(4)(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
ORS 646.642(3): a court that finds a person willfully used a method, act or practice declared unlawful by ORS 646.607 or 646.608 may, on the prosecuting attorney's petition, set a civil penalty of not more than $25,000 per violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
The Attorney General or a district attorney, as the prosecuting attorney ORS 646.605(5) defines for the unlawful trade practices statutes.
What this law does
ORS 336.184 may be cited as the Oregon Student Information Protection Act. An operator is the operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for kindergarten through grade 12 school purposes and was designed and marketed for those purposes, to the extent it is operating in that capacity.
Covered information is personally identifiable information or materials that regard a student in Oregon and that the student or a parent provides to an operator, that a school employee or agent provides for kindergarten through grade 12 purposes, or that an operator gathers and that identify the student or are linked to information that does.
An operator may not knowingly engage in targeted advertising, target advertising on another site based on information acquired through the school use, amass a profile about a student except in furtherance of kindergarten through grade 12 school purposes, sell a student's information, or disclose covered information except as ORS 336.184(3)(a)(E) allows.
An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information and must delete a student's covered information within a reasonable time if the school or school district requests deletion of data under its control. ORS 336.184 does not apply to general audience Internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's site may be used to access them.
A violation of ORS 336.184 is an unlawful practice under ORS 646.607. The history note of ORS 336.184 lists section 2 of chapter 528, Oregon Laws 2015. Section 5 of Enrolled Senate Bill 187 (2015) provides that the Act takes effect . Section 4 of Enrolled Senate Bill 187 (2015) provides that the new operator section first applies to data created, provided or gathered on or after the effective date of the Act.
A court that finds a person willfully used a practice declared unlawful by ORS 646.607 may, on the prosecuting attorney's petition, set a civil penalty not exceeding $25,000 per violation. A prosecuting attorney who has probable cause to believe that a person is engaging in an unlawful trade practice may bring suit in the name of the State of Oregon to restrain the practice.
When LexLint raises it
When your app profile says your app serves under-18s.