30719564

Last summer, Illinois (somewhat quietly) passed a new bullying law that took effect on January 1, 2015. The law includes language similar to at least 13 other states which makes it clear that schools have the authority to discipline students for cyberbullying that occurs off campus (and outside of a school-sponsored activity), when such behavior substantially disrupts its educational processes or orderly operation. This has been the long-held federal standard and I was happy to see Illinois moving in the right direction (see also, Minnesota’s recent update).

About the time this law was signed by the governor of Illinois, a former educator from that state told me about another aspect of the law that seemed to permit educators to demand passwords to private social media profiles of students suspected of inappropriate online behaviors impacting the school. I looked into it more, and it turns out that this comes from a separate law that actually took effect on January 1, 2014 (over a year ago). The 2015 law perhaps amplified the implications of the earlier provision with its focus on off-campus behaviors. But why did it take so long for the public to notice it?

Illinois Law

The controversial law begins with a provision that appears to expressly prohibit schools from requesting password information from students or parents:

“(a) It is unlawful for a post-secondary school to request or require a student or his or her parent or guardian to provide a password or other related account information in order to gain access to the student’s account or profile on a social networking website or to demand access in any manner to a student’s account or profile on a social networking website.”

But when one reads more closely, the law also seems to create a loophole that would apparently allow educators to demand passwords in special circumstances (or at least not prohibit it):

“(d) This Section does not apply when a post-secondary school has reasonable cause to believe that a student’s account on a social networking website contains evidence that the student has violated a school disciplinary rule or policy.”

So which is it? Can schools request (or demand) this personal information or not?

Federal Law

It is true that students do have different privacy expectations while at school. Courts have allowed school officials to search for weapons or drugs in school-owned lockers, for example, though these rules are largely governed by school policy and state law. They’ve also supported the school’s ability to “search” a student for drug use by randomly testing student athletes or others involved in extracurricular activities.

In New Jersey v. T.L.O. (1985), the U.S. Supreme Court addressed school searches of student-owned property at school. The Court specifically examined whether a school official can search a student’s purse when there is reasonable suspicion that the purse contained evidence of a violation of school policy (in the case of T.L.O., cigarettes). The Court affirmed that “Schoolchildren have legitimate expectations of privacy…But striking the balance between [that] and the school’s equally legitimate need to maintain an environment in which learning can take place requires some easing of the restrictions to which searches by public authorities are ordinarily subject.” In short, “The legality of a search of a student should depend simply on the reasonableness, under all the circumstances, of the search.” Ultimately the Court supported the search of the purse, ruling that it was reasonable given what was known.

Student Searches in the 21st Century

I’ve previously analyzed the case law as it relates to searches of student-owned cell phones, and wrote about lessons that can be learned from the 2014 Supreme Court case Riley v. California which restricts law enforcement access to cell phones. All things considered, I think it is safe to conclude that courts are generally inclined to err on the side of privacy, for students and others, when it comes to prying into personal digital data and private profiles. Students do generally have an expectation of privacy when it comes to the content of their private profiles, but exigent circumstances could mean that access to the profile would be warranted. If, for example, a reliable student reports to school officials that a classmate has made a bomb threat online or is talking of suicide, then time is of the essence and I suspect the courts would allow educators or the police to demand the necessary information for their investigation.

But what if a student posts the answers to an exam on a private profile? Or criticizes a teacher or teases a classmate? These behaviors surely “violate a school’s disciplinary rule or policy,” but are they covered by the law?

Last year a Minnesota school agreed to pay $70,000 in damages (without admitting liability) to settle a lawsuit in which they were accused of invading a sixth-grader’s privacy by demanding that she turn over the passwords to her email and Facebook profile. Originally, the student was given detention and forced to write a letter of apology for making disparaging remarks online about an adult hall monitor. When she returned to Facebook to vent her frustration and try to find out “who the F%$#” told on her, she was suspended (in-school) for insubordination. In a later incident, someone reported to the school that this same student had been communicating online with a classmate in a sexually inappropriate way. When interviewed by a counselor at the school, she admitted to saying “naughty” things to the classmate, but that it was off-campus and after school hours. School officials and a police officer then demanded her Facebook and email passwords so they could look into it. She initially refused, but school officials threatened her with detention and she eventually complied.

It’s important to acknowledge that the outcome of this case was a settlement, not a court order. So we really don’t know how a judge or jury would have felt about this. I personally think that the school was well within its rights to discipline the student for the inappropriate online comments about the hall monitor and the subsequent insubordination. Where the school went astray, in my opinion, was when they forced the student to turn over her passwords without evidence of a substantial disruption of the learning environment or an imminent threat to herself or others. It is unreasonable for a school, or police officer, to demand access to private communications absent that standard. If a social media profile is open to the public, however, then it is very likely fair game for anyone to review. But just because schools can look, doesn’t mean they should.

So Where Does This Leave Us?

The Illinois law has gained notoriety at a time when at least a dozen other states have enacted legislation to prohibit employers or universities from demanding passwords from employees or students. If nothing else, Illinois is clearly bucking the trend. That said, this law has apparently been on the books for over a year, and yet I am not aware of any schools that have attempted to apply it.

If I were a parent and a school official demanded that my child turn over the password to their private online profile, I would refuse to do so without a police officer and a warrant. Of course if there was legitimate cause for concern about the safety of my child or another, I would immediately review the profile myself, with my child, to evaluate the potential threat. Relevant information would then be turned over to the authorities as appropriate. I would also remind my children to double-check to make sure that all of their social media profiles are restricted so that only those they accept as friends or followers can view the information (i.e., that they are set to “private”). They should similarly ensure their cell phone is locked with a passcode.

If I were an educator, I would be extremely cautious when it comes to situations where I might invade a student’s privacy. Again, the law does give schools some latitude here, but schools really need to make the case for why the intrusion is necessary given the circumstances. If I had a bona fide concern about the safety of a student or staff member, it would be worth the risk. Short of that, I’m not sure. What is “reasonable” to one person might not be to another. And if that other person is a judge, it could spell trouble for the school. If you are an educator in Illinois who is dealing with the implications of this, or have an example you’d be willing to share, I’d be interested in your thoughts and experiences. I have no doubt that this law will eventually be challenged. Here’s hoping it doesn’t involve you or your school.

2 Comments
  1. Privacy Rights IL

    Public as well private schools are now required to develop (investigative) policies. We’ll have to wait and see if they start asking for passwords. I think you offered some excellent advice to parents.

  2. Stace

    Interesting

Leave Comment

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

clear formSubmit