Student Data Privacy Law in Maine, New Amendments

Maine’s Student Online Personal Information Protection Act or SOPIPA, also known as LD 454/SP 183, is a student data privacy law that was initially passed in 2015. Maine’s LD 454/SP 183 was amended 2 years later in 2017, in order to expand some of the protections offered to students within the state under the law. With this being said, the provisions of the law regulate the manner in which online operators, educators, and other relevant third parties are permitted to collect and use the personal information of students within the state of Maine. Furthermore, the law also lays out the steps and procedures that must be followed when collecting personal information from K-12 students enrolled in educational institutions in the state of Maine.

How is an online operator defined under the law?

Maine’s LD 454/SP 183 defines an online operator as “any entity other than the department, school administrative unit or school to the extent that the entity A. Operates an Internet website, online service, online application or mobile application with actual knowledge that the website, service or application is used for kindergarten to grade 12 school purposes and was designed and marketed for kindergarten to grade 12 school purposes to the extent that the operator is operating in that capacity; and B. Collects, maintains or uses student personally identifiable information in a digital or electronic format.”

What are the duties of online operators under the law?

Under Maine’s LD 454/SP 183, online operators, educators, and relevant third parties have a number of responsibilities and obligations as it relates to ensuring that the personal information of K-12 students within the state is safeguarded from unauthorized access or harm. Some of these duties include:

• Online operators are forbidden from using the personal data of students for the purpose of engaging in targeted advertising, whether this is on an operator’s website, online service, or application.
• Online operators and educators are forbidden from using the personal data of students for the purpose of creating online profiles for said students, unless such profiles will be used strictly for the furtherance of K-12 educational pursuits.
• Online operators are forbidden from selling the personal data of students, unless such transactions are in relation to a corporate merger or acquisition.
• Online operators are required to both implement and maintain security practices and procedures geared towards protecting the personal data of students. Moreover, these security practices and procedures must be appropriate to the nature of the personal data that has been collected from students.
• Online operators are required to delete the personal data of students within 45 days of receiving a school administrative request to do so.

What data elements are protected under the law?

The various data elements pertaining to students within the state of Maine that are legally protected from unauthorized use, access, modification, destruction, and disclosure under LD 454/SP 183 include but are not limited to:

• The first and last names of students.
• The names of a student’s parents or family members.
• Physical addresses.
• Email addresses.
• Phone numbers.
• State assigned student identification.
• Assessment results.
• Participation information.
• Course transcript information.
• A student’s gender, race, and ethnicity.
• A student’s socioeconomic information.
• A student’s disability status.
• Search activity, photos, and voice recordings.

Complying with the law

When looking to aid students in pursuing their long-term educational goals, educators, online operators, and school administrators within Maine will face situations in which they will need to disclose the personal information of students. However, as the provisions of Maine’s LD 454/SP 183 regulate such disclosures, these educators and online operators must also ensure that they comply with the law. To this point, automatic redaction software can be used to strike a balance between providing students with the assistance they need while also ensuring that all applicable legislation is adhered to.

For example, an online operator may need to disclose a student’s driver’s license or identification in order to confirm their identity for a potential scholarship opportunity. Using an automatic redaction software program, an online operator could ensure that certain personal data, such as the student’s address, could not be accessed in an unauthorized manner, while still enabling the student to pursue the scholarship. In this way, online operators and educators can rest assured that they are protecting the personal data and privacy of their respective students while still providing them with the opportunities they need to pursue their educational endeavors.

Online communication and internet access has completely alerted the manner in which human beings around the world interact with each other. This level of change has also occurred within K-12 schools in the U.S., as many schoolchildren in our current age rely on the internet to handle numerous aspects of their educational journeys, ranging from turning in homework to remote instruction. Due to this increased reliance on internet communication, legislation such as Maine’s LD 454/SP 183 stands to protect the personal information that students disclose in the context of their school-related activities. More importantly, however, the law gives parents and guardians within Maine the peace of mind that steps are being taken to protect the data and privacy of their children.