An Administrator's Guide to California Private School Law

Chapter 10 - Privacy Rights Of Students And Employees

sites no matter what state, territory, or foreign nation in which the operator manages its Web site or online service. 1702 a. Who Are Consumers And Operators? Under CalOPPA a “consumer” includes an individual who seeks to purchase goods or services for personal, family or household purposes. 1703 The statute defines “operator” as a “person or entity that owns a Web site located on the Internet or online service that collects and maintains personally identifiable information from a consumer residing in California who uses or visits the Web site or online service if the Web site or online service is operated for commercial purposes.” 1704 For purposes of the CalOPPA, an operator does not include a third party that “operates, hosts, or manages, but does not own, a Web site or online service on the owner’s behalf or by processing information on behalf of the owner.” 1705 Thus, even if a private school contracts out to a third party to maintain its Web site on the school’s behalf, the private school, and not the third party, is liable for failing to comply with the Act. The CalOPPA applies to operators of commercial Web sites and online services, regardless of the industry in which the company operators. 1706 Unlike the federal Children’s Online Privacy Protection Act (COPPA), CalOPPA does not contain a nonprofit exemption. Thus, private schools which operate a Web site for commercial purposes and which collect personally identifiable information through the internet from individuals, must maintain an electronic privacy policy and provide notice of the policy to visitors and users of the Web site or online service. (i) Operating For Commercial Purposes An operator of a commercial Web site is subject to CalOPPA only to the extent that the Web site or online service is “operated for commercial purposes.” CalOPPA’s language is inconclusive as to how to distinguish between commercial operation and operation for a different purpose. However, case law in other settings has recognized that nonprofits may engage in commercial transactions in certain circumstances. 1707 Without further guidance from the courts on this issue, we recommend that a private school –whether for-profit or nonprofit – comply with the provisions of CalOPPA by drafting and conspicuously posting a privacy policy on the Web site. b. What Is Personally Identifiable Information? The term “personally identifiable information” (“PII”) means information that (1) could allow the operator to identify the individual who provided the information in his/her use of the operator’s Web site or service; and (2) the operator maintains the information in an accessible form (as opposed to maintaining the information in code). Business and Professions Code section 33577(a) defines PII to include, but is not limited to , (1) A first and last name; (2) A home or other physical address, including street name and name of a city or town; (3) An e-mail address; (4) A telephone number;

An Administrator’s Guide to California Private School Law ©2019 Liebert Cassidy Whitmore 380