Data Protection and Privacy in Washington D.C. Schools

Washington D.C.’s Protecting Students Digital Privacy Act of 2016 is a data privacy law that was passed in 2016. The Protecting Students Digital Privacy Act of 2016 was passed for the purpose of protecting the personal information of students within Washington D.C. as it relates to internet usage and online websites. As such, the law establishes various requirements for operators of online services in the context of educational institutions within Washington D.C., ranging from the implementation of security measures geared toward protecting the personal information of students within the city to the regulation of the disclosure of this personal information.

How are educational institutions defined under the law?

Under Washington D.C.’s Protecting Students Digital Privacy Act of 2016, an educational institution is defined as a “public school or public charter school in the District of Columbia.” Alternatively, the law defines a local educational agency or LEA as “the District of Columbia Public Schools system or any individual or group of public charter schools operating under a single charter.” Furthermore, the law defines an online operator as “a person that operates an Internet website, online service, online application, or mobile application: That is designed, marketed, and primarily used for pre-k through 12 purposes; and Who has actual knowledge that the person’s website, online service, online application, or mobile application is being used for pre-k through 12 purposes.”

How is personally identifiable information defined under the law?

Under Washington D.C.’s Protecting Students Digital Privacy Act of 2016, personally identifiable information is defined as “data that ‘alone or in combination with other data is linked to a specific student that would allow a reasonable person, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.” To this point, the categories of personal information that are protected under the law include but are not limited to:

• A student’s name.
• The name of a student’s parent, guardian, or family member.
• The address of a student or their family members.
• Photographs.
• Video and audio recordings that contain a student’s voice or image.
• A student’s social security number.
• A student’s financial account number.
• Social media usernames, online user names, and email addresses.
• Credit card numbers.
• Other personal electronic identifiers.

What are the obligations of online operators under the law?

Under Washington D.C.’s Protecting Students Digital Privacy Act of 2016 online operators that provide services to educational institutions and local education agencies within the city have numerous responsibilities as it concerns protecting the personal information of students. Most notably, online operators are required to “implement and maintain reasonable security policies and procedures appropriate to the nature of the personally identifiable student information.” To this end, these security policies and procedures must also protect the personal information of students from unauthorized access, use, modification, destruction, and disclosure. What’s more, in the event that personal information concerning students is compromised or accessed in a manner that is unauthorized, online operators are required to provide notification to all applicable parties.

Conversely, online operators are also prohibited from using information obtained from students for any purpose other than the furtherance of educational pursuits, such as targeted marketing, among others. Additionally, online operators are also required to delete all personal information that they have access to as it relates to students within Washington D.C., either within either a reasonable period of time or after the completion or termination of their respective services. In instances where an online operator wishes to sell, rent, or trade the personal information of students within Washington D.C. for the purpose of providing said students with information concerning educational scholarships, post-secondary educational endeavors, or other related opportunities, they must also obtain expressed consent from said students, or their parents and legal guardians if the students are under 13 years of age.

As online internet usage continues to play a pivotal role in almost every aspect of modern-day society, legislation such as Washington D.C.’s Protecting Students Digital Privacy Act of 2016 ensures that students within the U.S. can enjoy some modicum of privacy when using the internet for the purposes of furthering their education. These laws have become even more relevant due to the rise of COVID-19, as people around the world are using the internet more than in any period before in human history. As such, students within Washington D.C., as well as their parents and guardians, can rest assured that the personal information of all students within the city will effectively be protected under the law.