§ 38–831.04. Privacy of student personal accounts and devices.

(a) An educational institution or school-based personnel shall not take or threaten to take action against a student or prospective student, including discipline, expulsion, unenrollment, refusal to admit, or prohibiting participation in a curricular or extracurricular activity, because the student or prospective student refused to:

(1) Disclose a username, password, or other means of account authentication used to access the student's personal media account or personal technological device;

(2) Access the student's personal media account or personal technological device in the presence of school-based personnel in a manner that enables the school-based personnel to observe data on the account or device;

(3) Add a person to the list of users who may view the student's personal media account or access a student's personal technological device; or

(4) Change the privacy settings associated with the student's personal media account or personal technological device.

(b) If an educational institution or school-based personnel inadvertently receives the username, password, or other means of account authentication for the personal media account or personal technological device of a student or prospective student through otherwise lawful means, the educational institution or school-based personnel shall:

(1) Not use the information to access the personal media account or personal technological device of the student or prospective student;

(2) Not share the information with anyone; and

(3) Delete the information immediately or as soon as is reasonably practicable.

(c) Notwithstanding subsection (a) of this section, school-based personnel may search a student's personal media account or personal technological device or compel a student to produce data accessible from the student's personal media account or personal technological device, in the following circumstances:

(1)(A) The school-based personnel has a reasonable suspicion that the student has used or is using the student's personal media account or personal technological device in furtherance of a violation of an educational institution policy and a reasonable suspicion that the personal media account or personal technological device contains evidence of the suspected violation;

(B) Before searching or compelling production, the school-based personnel:

(i) Documents the reasonable suspicion giving rise to the need for the search or production; and

(ii) Notifies the student and the student's parent of the suspected violation and the data or components to be searched or that the student will be compelled to produce;

(C) The search or compelled production is limited to data accessible from the account or device or components of the device reasonably likely to yield evidence of the suspected violation; and

(D) No person shall be permitted to copy, share, or transfer data obtained pursuant to a search or compelled production under this subsection that is unrelated to the suspected violation that prompted the search; or

(2)(A) Doing so is necessary in response to an imminent threat to life or safety;

(B) The scope of the search or compelled production is limited to that purpose; and

(C) Within 72 hours of compelling production or searching a student's personal media account or personal technological device, the educational institution that authorized access or compelled production shall provide the student and the student's parent with a written description of the precise threat that prompted the search and the data that was accessed.

(d) An educational institution may seize a student's personal technological device to prevent data deletion pending notification required by subsection (c)(1)(B) of this section; provided, that:

(1) The pre-notification seizure period is no greater than 48 hours; and

(2) The personal technological device is stored securely on the educational institution's property and not accessed during the pre-notification seizure period.

(e) Nothing in this section shall prevent an educational institution from:

(1) Accessing information about a student or prospective student that is publicly available;

(2) Requesting a student or prospective student to voluntarily share specific content accessible from a personal media account or personal technological device for the purpose of ensuring compliance with applicable laws or educational institution policies; provided, that the request complies with the prohibitions in subsection (a) of this section;

(3) Prohibiting a student or prospective student from accessing or operating a personal media account or personal technological device during school hours or while on school property;

(4) Monitoring the usage of the educational institution's computer network; or

(5) Revoking a student's access, in whole or in part, to equipment or computer networks owned or operated by the educational institution.

(f) This section shall apply to media accounts that are created or provided by or at the behest of the educational institution if the educational institution fails to provide a student with notice, at the time the account is created or within 60 days of August 1, 2017, that the account may be monitored at any time by school-based personnel.