Law / United States / 
Virginia
Students at institutions of higher education: no sale of personal information by a public institution and no demand for social media credentials
Va. Code Ann. § 23.1-405(D), (E)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- If you are a public institution of higher education, do not sell students' personal information, including names, addresses, phone numbers and email addresses, to any person, except in transactions involving credit, debit, employment, finance, identity verification, risk assessment, fraud prevention or other transactions initiated by the student (Va. Code Ann. 23.1-405(D)).
- If you are a public or private institution of higher education, do not require a student to disclose the username or password to any of the student's personal social media accounts; an account the student opened at the institution's request, or one the institution provides, such as the student's email account, is not a personal social media account (Va. Code Ann. 23.1-405(A), (E)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Subsections D and E of section 23.1-405 bar a public institution of higher education from selling students' personal information and bar any institution of higher education from requiring a student's social media username or password. They set no duty to keep a record.
- Kind
- None
- As of
What this law does
No public institution of higher education may sell students' personal information, including names, addresses, phone numbers and email addresses, to any person, except in transactions involving credit, debit, employment, finance, identity verification, risk assessment, fraud prevention or other transactions initiated by the student.
No public or private institution of higher education may require a student to disclose the username or password to any of the student's personal social media accounts, though a campus police officer may still perform his or her official duties.
A social media account here is a personal account with an electronic medium or service through which users create, share or view user-generated content, and excludes an account opened by a student at the institution's request or provided by the institution, such as the student's email account. The section derives from former section 23-2.1:3, added by Chapter 571 of the 2008 Acts of Assembly, and its history note runs to Chapter 229 of the 2019 Acts of Assembly.
Chapter 588 of the 2016 Acts of Assembly (House Bill 209) created Title 23.1 as a revision of Title 23 and took effect on .
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .