2021 Maryland Statutes
Education
Division II - Elementary and Secondary Education
Title 4 - Local School Administration
Subtitle 1 - County Boards of Education
Section 4-131 - Student Data Privacy

    (a)    (1)    In this section the following words have the meanings indicated.

        (2)    (i)    “Covered information” means information or material that:

                1.    Personally identifies an individual student in this State or that is linked to information or material that personally identifies an individual student in this State; and

                2.    Is gathered by an operator through the operation of a site, a service, or an application.

            (ii)    “Covered information” includes a student’s:

                1.    Educational and disciplinary record;

                2.    First and last name;

                3.    Home address and geolocation information;

                4.    Telephone number;

                5.    Electronic mail address or other information that allows physical or online contact;

                6.    Test results, grades, and student evaluations;

                7.    Special education data;

                8.    Criminal records;

                9.    Medical records and health records;

                10.    Social Security number;

                11.    Biometric information;

                12.    Socioeconomic information;

                13.    Food purchases;

                14.    Political and religious affiliations;

                15.    Text messages;

                16.    Student identifiers;

                17.    Search activity;

                18.    Photos; and

                19.    Voice recordings.

        (3)    “Operator” means a person who is operating in accordance with a contract or an agreement with a public school or local school system in the State to provide an Internet website, an online service, an online application, or a mobile application that:

            (i)    Is used primarily for a PreK–12 school purpose;

            (ii)    Is issued at the direction of a public school, a teacher, or any other employee of a public school, local school system, or the Department; and

            (iii)    Was designed and marketed primarily for a PreK–12 school purpose.

        (4)    “Persistent unique identifier” means a unique reference number used as an identifier in computer software that is stored across different usage sessions.

        (5)    (i)    “PreK–12 school purpose” means an activity that:

                1.    Takes place at the direction of a public school, a teacher, an administrator, or a local school system; or

                2.    Aids in the administration of public school activities.

            (ii)    “PreK–12 school purpose” includes:

                1.    Instruction in the classroom;

                2.    Home instruction;

                3.    Administrative activities;

                4.    Collaboration among students, public school employees, and parents;

                5.    Maintaining, developing, supporting, improving, or diagnosing the operator’s site, service, or application; and

                6.    An activity that is for the use and benefit of the public school.

        (6)    (i)    “Targeted advertising” means presenting advertisements to an individual student that are selected based on information obtained or inferred from the student’s online behavior, usage of applications, or covered information.

            (ii)    “Targeted advertising” does not include advertisements presented to an individual student at an online location:

                1.    Based on the student’s current visit to the online location without collection or retention of the student’s online activities over time; or

                2.    In response to a single search query without collection or retention of the student’s online activities over time.

    (b)    This section does not apply to a general audience Internet website, general audience online service, general audience online application, or general audience mobile application, even if log–in credentials created for an operator’s site, service, or application may be used to access the general audience site, service, or application.

    (c)    An operator shall:

        (1)    Protect covered information from unauthorized access, destruction, use, modification, or disclosure;

        (2)    Implement and maintain reasonable security procedures and practices to protect covered information; and

        (3)    If covered information is under the authority of a public school or local school system in accordance with a contract or an agreement, delete within a reasonable time the covered information if the public school or local school system requests deletion of the covered information.

    (d)    (1)    An operator may not knowingly engage in any of the following activities with respect to the operator’s site, service, or application:

            (i)    Engage in targeted advertising if the advertising is based on information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of the operator’s site, service, or application;

            (ii)    Except in furtherance of a PreK–12 school purpose, use information, including covered information and persistent unique identifiers, created or gathered by the operator’s site, service, or application, to make a profile about a student;

            (iii)    Subject to paragraph (2) of this subsection and except as provided in subsection (f) of this section, sell a student’s information; or

            (iv)    Except as provided in subsection (e) of this section, disclose covered information.

        (2)    Nothing in this subsection shall be construed to prohibit the operator’s use of information for maintaining, developing, supporting, improving, or diagnosing the operator’s site, service, or application.

        (3)    For purposes of paragraph (1)(ii) of this subsection, making a profile of a student does not include the collection and retention of account information that remains under the authority of a student, a student’s parent or guardian, a public school, or a local school system.

    (e)    Notwithstanding subsection (d)(1)(iv) of this section, an operator may disclose a student’s covered information:

        (1)    If the disclosure is made only in furtherance of the PreK–12 school purpose of the site, service, or application and the recipient of the covered information:

            (i)    Does not further disclose the information; and

            (ii)    Is legally required to comply with subsections (c) and (d)(1) of this section;

        (2)    To ensure legal or regulatory compliance;

        (3)    To take precautions against liability;

        (4)    To respond to or participate in judicial process;

        (5)    To protect the safety of users or others or the security or integrity of the site, service, or application;

        (6)    To a service provider, provided the operator contractually:

            (i)    Prohibits the service provider from using any covered information for any purpose other than providing the contracted service to, or on behalf of, the operator;

            (ii)    Except for a purpose expressly permitted under this subsection, prohibits the service provider from disclosing covered information provided by the operator with a third party; and

            (iii)    Requires the service provider to comply with the requirements of subsections (c) and (d)(1)(i) through (iii) of this section;

        (7)    If subsection (d)(1)(i) through (iii) of this section is not violated;

        (8)    If federal or State law requires the operator to disclose the information, and the operator complies with the requirements of federal and State law in protecting and disclosing the information;

        (9)    For a legitimate research purpose as:

            (i)    Required by federal or State law; or

            (ii)    Allowed by federal or State law and under the direction of a public school, local school system, or the Department, if a student’s covered information is not used for advertising or to make a profile on the student for a purpose other than a PreK–12 school purpose; or

        (10)    To a State or local education agency, including public schools and local school systems, for a PreK–12 school purpose, as permitted by federal and State law.

    (f)    If an operator of a site, a service, or an application used for a PreK–12 school purpose is merged with or acquired by another entity, the successor entity is subject to this section for previously collected covered information.

    (g)    Nothing in this section prohibits an operator from:

        (1)    Using aggregated or de–identified covered information:

            (i)    To develop or improve an educational product or service within any site, service, or application the operator owns; or

            (ii)    To demonstrate the effectiveness of the operator’s products or services; or

        (2)    Sharing aggregated or de–identified covered information for the development or improvement of educational sites, services, or applications.

    (h)    (1)    Except for subsection (d)(1)(iii) of this section and subject to paragraph (2) of this subsection, nothing in subsections (d) and (e) of this section may be construed to prohibit the use or disclosure of a student’s covered information by an operator.

        (2)    An operator may use or disclose covered information under paragraph (1) of this subsection if the operator:

            (i)    Provided clear and conspicuous notice of the use or disclosure of the student’s covered information to the student or the student’s parent or guardian; and

            (ii)    Obtained the affirmative consent of the student, if the student is at least 18 years old, or the student’s parent or guardian to use or disclose the student’s covered information.

    (i)    This section may not be construed to limit the authority of a law enforcement agency to obtain content or information from an operator as authorized by federal or State law or in accordance with an order of a court of competent jurisdiction.

    (j)    This section does not limit the ability of an operator to:

        (1)    Use a student’s covered information for adaptive learning or customized student learning purposes;

        (2)    Use recommendation engines to recommend to a student additional content or services relating to an educational, other learning, or employment opportunity purpose within an operator’s site, service, or application if the recommendation is not determined in whole or in part by payment or other consideration from a third party;

        (3)    Respond to a student’s search query, other request for information, or request for feedback if the information or response is not determined in whole or in part by payment or other consideration from a third party; or

        (4)    Use or retain covered information to:

            (i)    Ensure legal or regulatory compliance; or

            (ii)    Take precautions against liability.

    (k)    This section may not be construed to prohibit an operator of an Internet website, an online service, an online application, or a mobile application from marketing educational products directly to parents if the marketing was not a result of the use of covered information obtained by the operator through the provision of services covered under this section.

    (l)    This section may not be construed to impose a duty on a provider of an electronic store, a gateway, a marketplace, or any other means of purchasing or downloading software or applications to review or enforce compliance of this section.

    (m)    This section may not be construed to impose a duty on a provider of an interactive computer service, as defined in Chapter 5, Title 47 of the United States Code, to review or enforce compliance with this section by third–party content providers.

    (n)    This section may not be construed to impede the ability of students to download, export, transfer, or otherwise save or maintain their own data or documents.

    (o)    The provisions of this section may not be construed to prohibit an Internet service provider from providing Internet connectivity to public schools, students, or students’ families.