{"data":{"id":"us-dc/d.c.-code-38-831.02","jurisdiction":"us-dc","citation":"D.C. Code § 38-831.02","heading":"Operator obligations.","body":"(a)\nAn operator providing services to an educational institution, LEA, or its agent shall:\n(1)\nImplement and maintain reasonable security policies and procedures appropriate to the nature of the personally identifiable student information, and designed to protect that information from unauthorized access, destruction, use, modification, or disclosure; provided, that such policies and procedures shall include provisions for notifying educational institutions and LEAs in the event of unauthorized access to personally identifiable student information consistent with the requirements of subchapter II of Chapter 38 of Title 28;\n(2)\nAgree that personally identifiable student information provided to an operator by a student or educational institution to facilitate the use of the operator's pre-k through 12 purposes website, service, or application is under the control of the LEA;\n(3)\nDelete personally identifiable student information under the control of an LEA within a reasonable period of time after termination or completion of services, unless otherwise requested by the LEA to preserve such information; and\n(4)\nComply with all the applicable obligations and restrictions established for operators in this subchapter.\n\n(b)\n(1)\nAn operator shall not knowingly engage in the following activities:\n(A)\nSell, rent, or trade any personally identifiable student information, unless:\n(i)\nThe transaction is part of a sale, merger, or other type of acquisition of an operator by another entity; or\n(ii)\nThe operator obtained verified consent from the student, where the student is 13 years of age or older, or the student's parent, where the student is younger than 13 years of age, to sell, rent, or trade specific personally identifiable student information for the purpose of providing the student with information about employment, educational scholarship, financial aid, or postsecondary educational opportunities;\n(B)\nConduct targeted advertising on an operator's website, service, or application, or target advertising on any other website, service, or application when the advertising is based on information that the operator has acquired through a student's use of the operator's pre-k through 12 purposes website, service, or application;\n(C)\nExcept in furtherance of pre-k through 12 purposes, use data, including personally identifiable student information, created, gathered, or stored on the operator's pre-k through 12 purposes website, service, or application, to develop, in full or in part, a profile of a student or group of students; provided, that developing a profile does not include the collection or retention of account information generated by a student, a student's parent, or an educational institution; and\n(D)\nDisclose personally identifiable student information unless the disclosure is consistent with the requirements of this section, and is:\n(i)\nTo further the pre-k through 12 purposes of the operator's website, service, or application, or to improve the operability or functionality of the operator's pre-k through 12 purposes website, service, or application; provided, that the operator:\n(I)\nProhibits the recipient from using personally identifiable student information for any purpose other than providing the contracted service;\n(II)\nProhibits the recipient from disclosing personally identifiable student information except in accordance with this subparagraph;\n(III)\nRequires the recipient to implement and maintain reasonable security measures consistent with those in subsection (a)(1) of this section; and\n(IV)\nRequires the recipient to delete the personally identifiable student information upon completion or termination of the recipient's services to the operator;\n(ii)\nNecessary to comply with applicable District or federal laws or regulations;\n(iii)\nIn response to legal process, a judicial order, or a warrant;\n(iv)\nNecessary to protect the safety of individuals or the security or integrity of the website, service, or application;\n(v)\nPursuant to the written request or consent of the LEA; or\n(vi)\nFor legitimate research purposes:\n(I)\nAs required by District or federal law; or\n(II)\nAs allowed by District or federal law under the direction or with the consent of the LEA; provided, that no personally identifiable student information is used for commercial gain or to develop a profile on a student or group of students for purposes other than pre-k through 12 purposes.\n(2)\nA sale, merger, or acquisition of an operator shall not void or nullify any contracts or agreements entered into pursuant to this subchapter or regulations issued to enforce it.\n\n(c)\nAn operator that provides digital storage, management, and retrieval of student records shall comply with subsections (a) and (b) of this section.\n\n(d)\nNothing in this section shall be construed to prohibit the operator from:\n(1)\nInternally using personally identifiable student information to maintain, develop, support, improve, or diagnose the operator's pre-k through 12 purposes website, service, or application;\n(2)\nInternally using personally identifiable student information for adaptive learning or customized student learning purposes;\n(3)\nUsing, sharing, or selling de-identified student information;\n(4)\nUsing its pre-k through 12 purposes website, service, or application to recommend products, content, or services to a student related to educational, learning, or employment opportunities; provided, that the recommendation is not determined, in whole or in part, by remuneration from a third party;\n(5)\nResponding to a student's request for information or feedback; provided, that the response is not determined, in whole or in part, by remuneration from a third party; or\n(6)\nMarketing products directly to parents if the marketing did not result from the use of personally identifiable student information obtained by the operator through the provision of services covered under this section.\n\n(e)\nNothing in this section shall be construed to:\n(1)\nLimit the authority of a law enforcement agency to obtain content or information from an operator as authorized by law or pursuant to a judicial order or warrant;\n(2)\nProhibit a student from downloading, editing, exporting, transferring, saving, or otherwise maintaining the student's own student-created data or documents on an operator's website, service, or application;\n(3)\nLimit Internet service providers from providing Internet connectivity to schools or students and their families;\n(4)\nApply to general audience Internet websites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an operator's website, service, or application may be used to access those general audience sites, services, or applications;\n(5)\nImpose a duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading an operator's software or applications to review or enforce a third-party operator's compliance with this section;\n(6)\nImpose a duty upon a provider of an interactive computer service to review or enforce a third-party operator's compliance with this section;\n(7)\nImpose a duty on an operator to comply with the provisions of this section with respect to sites, services, or applications it operates that are not primarily used for pre-k through 12 purposes; or\n(8)\nAffect the rights or obligations of operators, educational institutions, parents, or students in a manner inconsistent with otherwise applicable federal law.","path":["Title 38. Educational Institutions.","Chapter 8B. Public Schools Digital Privacy and Equity.","Subchapter I. Protection of Students Digital Privacy."],"source_url":"https://code.dccouncil.gov/us/dc/council/code/sections/38-831.02","current_through":"2026-08-20 (D.C. Law 26-175)","vintage":"","retrieved_at":"2026-08-29T05:44:07Z","sha256":"5b66e5207869667b9f9c39f1470245f893a0873007b920b07d860b4d46b7b0ea","source_id":"us-dc","stale":false,"prev":"us-dc/d.c.-code-38-831.01","next":"us-dc/d.c.-code-38-831.03"},"notice":"GroundRules: Original legal text. Not legal advice."}