Student Data Protection Law in the State of Hawaii

Hawaii’s Student Online Personal Information Protection Act or SOPIPA is a student data protection and privacy law that was passed in the U.S. state of Hawaii in 2016. As the U.S. has yet to pass a federal comprehensive data privacy law, such as the EU’s General Data Protection Regulation or GDPR, data privacy legislation within the country is largely limited to laws and regulations that have been passed at the state level. With this being said, Hawaii’s SOPIPA protects the personal information that students within the state disclose to online operators for the purpose of furthering their education. As such, the law sets forth various provisions that online operators must comply with in order to ensure that the personal information of their students is protected at all times.

How are online operators defined under the provisions of the law?

Under Hawaii’s Student Online Personal Information Protection Act, an online operator is defined as “the operator of a website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.” Alternatively, the law defines K-12 purposes to include “purposes that are directed by or that customarily take place at the direction of a K-12 school, teacher, or complex area superintendent or that aid in the administration of school activities, including instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, parents or legal guardians, or are otherwise for the use and benefit of the school.”

What are the duties of online operators under Hawaii’s SOPIPA?

Under Hawaii’s Student Online Personal Information Protection Act, online operators within the state have the following duties and responsibilities as it relates to the protection of the personal information and privacy of students within the state:

• Online operators are prohibited from using personal information obtained from students for the purpose of engaging in target advertising and online marketing.
• Online operators may only use the personal information of students to create an online profile if the profile in question will be used solely for the purpose of furthering the education of students.
• Online operators are prohibited from selling or renting personal information pertaining to students within Hawaii.
• Online operators are required to implement reasonable security measures that will protect the personal information of students from unauthorized access, use, modification, destruction, and disclosure.
• Online operators are required to delete a student’s personal information after a reasonable period of time, unless a student’s parent or legal guardian consents to the maintenance of their child’s personal information.

What categories of personal data are protected under Hawaii’s SOPIPA?

Under the provisions of Hawaii’s Student Online Personal Information Protection Act, the following categories of personal information pertaining to students within the state are legally protected from unauthorized use, access, and disclosure:

• Educational records.
• First and last names.
• Email addresses.
• Physical addresses.
• Grades and evaluations.
• Medical and health records.
• Social security numbers.
• Biometric information.
• Photos and voice recordings.
• Text messages.
• Documents.
• Socioeconomic information.
• Food purchases.
• Juvenile dependency records.
• Geolocation information.

What can online operators within Hawaii do to comply with the law?

Through the implementation of automatic redaction software programs, online operators within the state of Hawaii can ensure that they maintain compliance with the legislative requirements that were set forth in the SOPIPA. Through the use of such software programs, users can automatically redact personal information from a wide variety of file types ranging from PDF, audio, video, email, and images files. In turn, online operators can prevent the personal information of their students from falling into the wrong hands, while simultaneously using this information to help said students pursue opportunities in higher education, such as college scholarships and federal grants, among others.

As many U.S. states have taken legislative measures to protect the personal information and privacy of students, Hawaii’s efforts to achieve this goal manifested itself through the enactment of the Student Online Personal Information Protection Act in 2016. Through the provisions of the law, numerous forms of personal information that students may disclose to teachers, school board members, and online operators are legally protected from unauthorized access, use, and disclosure. More importantly, however, the law provides students and guardians within the state with the peace of mind that the personal data of their children is being protected at all times.