(a) School-based personnel shall not access the data or functions of a 1-to-1 device provided to a student pursuant to a 1-to-1 program without the student or the student's parent's written consent except in accordance with the provisions of this section.
(b) School-based personnel shall not access, analyze, share, or transfer data on a student's 1-to-1 device, including its browser history, key stroke history, or location history, unless:
(1) The data will be used exclusively for an educational purpose consistent with the school-based personnel's professional duties;
(2) The data will be used exclusively to ensure compliance with District or federal law;
(3) Reasonable suspicion exists that the student has violated or is violating an educational institution policy or law and reasonable suspicion exists that the data on the 1-to-1 device contains evidence of the suspected violation;
(4) Doing so is necessary to update or upgrade the 1-to-1 device's software, or to protect the device from cyber-threats, and access is limited to that purpose;
(5)(A) Doing so is necessary in response to a threat to life or safety and access is limited to that purpose; and
(B) Within 72 hours of accessing, analyzing, sharing, or transferring a 1-to-1 device's data in response to a threat to life or safety, the educational institution that authorized access to the 1-to-1 device shall provide the student to whom the device was provided and the student's parent with a written description of the precise threat that prompted the access and what data was accessed; or
(6) The data is otherwise posted on an electronic medium that is accessible by the general public or by school-based personnel who are granted permission to view the content.
(c) School-based personnel shall not use a student's 1-to-1 device's location tracking technology to track a device's real-time or historical location, unless:
(1) The student to whom the device was provided, or the student's parent, has notified the educational institution or law enforcement that the device is missing or stolen;
(2) The device was not returned to the educational institution at the end of the permitted period of use;
(3) Such use is ordered pursuant to a judicial order or warrant; or
(4)(A) Doing so is necessary in response to a threat to life or safety and access is limited to that purpose; and
(B) Within 72 hours of accessing a 1-to-1 device's location tracking technology, the educational institution that authorized access to the device shall provide the student to whom the device was provided and the student's parent with a written description of the precise threat that prompted the access and what data and features were accessed.
(d) School-based personnel shall not activate or access any audio or video receiving, transmitting, or recording functions on a student's 1-to-1 device remotely, unless:
(1) A student initiates video or audio communication with the school-based personnel or 1-to-1 device provider;
(2) The activation or access is ordered pursuant to a judicial order or warrant; or
(3)(A) Doing so is necessary in response to an imminent threat to life or safety and access is limited to that purpose; and
(B) Within 72 hours of accessing or activating a 1-to-1 device's audio or video receiving, transmitting, or recording function, the educational institution that authorized the access or activation shall provide the student to whom the device was provided and the student's parent with a written description of the precise threat that prompted the access or activation and what data and features were accessed or activated.
(e) When a student permanently returns a 1-to-1 device to an educational institution, the educational institution shall erase all the data stored on the device.
(f) Before issuing a student a 1-to-1 device, an educational institution shall provide the student with written notice that the device can be searched, tracked, or accessed by school-based personnel pursuant to subsections (b), (c), and (d) of this section.
(Feb. 18, 2017, D.C. Law 21-218, § 4, 63 DCR 16013.)