Student Data Privacy Requirements in the State of Hawaii

Hawaii SB2607 is a student data protection law that was passed in 2016. Much like other student data privacy laws that have been passed at the U.S. state level, the law establishes the legal grounds upon which data pertaining to students within the state of Hawaii may be used to aid said students in furthering their respective academic careers. Furthermore, Hawaii SB2607 also outlines the steps and procedures that online operators and educators are charged with following as it concerns ensuring the personal information of their students is safeguarded from unauthorized use, access, and disclosure.

How is the term online operator defined under the law?

Hawaii SB2607 defines an online operator to mean “the operator of a website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.” Conversely, the law defines K-12 school purposes to mean “purposes that are directed by or that customarily take place at the direction of a K-12 school, teacher, or complex area superintendent or that aid in the administration of school activities, including instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, parents or legal guardians, or are otherwise for the use and benefit of the school.”

What are the duties of operators under the law?

Under Hawaii SB2607, the data privacy and protection responsibilities that online operators have with respect to securing the personal information of their students include:

• Online operators are prohibited from using student data to engage in targeted advertising.
• Online operators must refrain from selling or renting student data. Corporate mergers and acquisitions are exempt from this provision of the law.
• Online operators are forbidden from using student data to create an online profile for students, unless such a profile will be used solely for the furtherance of educational opportunities.
• Online operators must develop, implement, and maintain security procedures and practices that can be used to safeguard student data from unauthorized use.
• Online operators must delete student data within a reasonable period of time, or if a student’s school district requests an online operator do so.

What categories of student data are protected under the law?

The categories of student data that a protected under Hawaii SB2607 include but are not limited to:

• Student identifiers.
• Email addresses.
• Home addresses.
• Special education data.
• Grades.
• Evaluations.
• Text messages.
• Search activity.
• Photos.
• Voice recordings.
• Test results.
• Discipline records.
• Food purchases.
• Biometric data.

Student privacy and redaction

Redaction software can play a helpful role in aiding online operators in maintaining compliance with legislation such as Hawaii SB2607. For example, as online operators will need to disclose student data when looking to provide students with postsecondary educational opportunities, they face a challenge when looking to also protect student privacy. Redaction software can be used to mitigate such challenges, as online operators could redact any information that is not pertinent to the goal at hand, such as social security numbers, while simultaneously disclosing personal information such as grades and evaluations that a student would need to attend an institution of higher education.

While the future of online communication remains unsure, it will undoubtedly continue to play an enormous role in the way in which K-12 students in the U.S. function in various educational settings. As such, legislation such as Hawaii SB2607 is pivotal in securing student data from becoming compromised, as many of these students will not have the means to secure this data themselves. To this point, the law provides parents and guardians within the state of Hawaii with the legal framework needed to ensure that they can effectively safeguard their children from having their personal privacy infringed upon.