Securing Personal Student Information in the State of Iowa

Iowa’s Student Online Personal Information Protection Act or SOPIPA, otherwise known as HF 2354, is a student data protection law that was enacted in 2018. In a manner similar to other student data privacy laws that have been passed throughout different U.S. states in the past decade, HF 2354 was enacted for the purpose of protecting the privacy and personal information of students that attend school within the state of Iowa. To this end, the law sets forth the requirements that online operators, educators, and other school personnel are responsible for adhering to as it concerns ensuring that the personal information of their students remains secure at all times.

How is an online operator defined under the law?

Under Iowa’s HF 2354, an online operator is defined as “the operator of an internet site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for kindergarten through grade twelve purposes and was designed and marketed for such purposes.” On the other end of the spectrum, the law defines covered information as “personally identifiable information or material, or information that is linked to personally identifiable information or material, in any media or format that is not publicly available and has been created by or provided to an operator by a student, or the student’s parent or legal guardian.”

What are the responsibilities of data operators under the law?

Under HF 2354, online operators, teachers, and school personnel the work within the state of Iowa have the following responsibilities as it relates to ensuring that the personal data of their respective students remains confidential and secure:

• Online operators shall not sell or rent the personal data of their students.
• Online operators shall not use the personal data of their students for the purpose of engaging in targeted advertising or marketing activities.
• Online operators shall not use a student’s personal data, including unique personal identifiers, for the purpose of amassing an online profile for said student, unless such a profile will be used solely for the furtherance of the student’s educational journey.
• Online operators are only permitted to disclose the personal information of students for non-educational purposes under certain circumstances. These circumstances include instances where an online operator is required to disclose a student’s personal information under state or federal law, among others.
• Online operators are responsible for implementing data security procedures and practices, in accordance with industry standards, that will protect the personal data of the students they serve.

What categories of personal data are protected under the law?

Under HF 2354, the categories of personal information concerning K-12 students within the state that are legally protected from unauthorized use, access, modification, destruction, and disclosure include but are not limited to:

• Student educational records.
• Email addresses.
• Home addresses.
• Discipline records.
• Test results.
• Grades and evaluations.
• Special education data.
• Juvenile dependency records.
• Social security numbers.
• Criminal records.
• Biometric information.
• Disability information.
• Geolocation information.
• Voice recordings.

Complying with Iowa’s HF 2354

In terms of complying with the law, one way that online operators, teachers, and school personnel within Iowa can maintain compliance with legislation such as HF 2354 is through the implementation of automatic redaction software. These software programs leverage artificial intelligence and machine learning algorithms to automatically redact a wide range of personal data, effectively rendering it unusable or unreadable. Using such methods, online operators within Iowa can secure the personal information of their respective students, while also saving valuable time, resources, and energy that can then be used to provide further educational services.

As students within the U.S. will have to disclose certain forms of personal information concerning themselves when looking to achieve their educational goals, legislation such as Iowa’s HF 2354 serves to protect this information from misuse. Through the various provisions laid out in the law, online operators, educators, and school personnel members must take the steps and measures necessary to protect the personal information of their students, while simultaneously using this information to aid them in furthering their education. More importantly, however, the law gives parents and guardians of school-aged children within the state of Iowa the peace of mind that the personal information of said children is legally protected.