Four pieces of legislation intended to improve online privacy and protections for Delaware residents were signed into law by Governor Jack Markell on August 7, 2015.
Collectively, this legislation will impact a broad range of constituencies in Delaware and beyond, namely Internet service operators, school districts, parents, and employers. In many instances, this legislation will require substantial revisions to and audits of existing policies.
The Delaware Online Privacy and Protection Act (DOPPA), effective January 1, 2016, will require an operator of a commercial Internet service that collects personally identifiable information (PII) about users who are Delaware residents to make its privacy policy conspicuously available on its Internet service. The Act requires that the policy provide, among other things, the categories of PII collected and how the operator handles “do not track” requests, requirements which are already found in the California Online Protection Act.
DOPPA defines PII as “any information about an individual that, individually or in combination with other information, can be used to distinguish or trace the identity of the individual,” and includes a long list of examples such as a physical address, Social Security number, and employment history. Operators failing to comply within 30 days of notification of noncompliance will face penalties.
DOPPA also prohibits an operator of Internet services from knowingly using, disclosing, or compiling a child’s PII if the operator has actual knowledge that such PII will be used for marketing a prohibited product or service to the child. The prohibition applies both to Internet services intended for children under 18 and for services intended for the general public where the operator has actual knowledge that children under 18 are using the service. Advertising services, when put on notice, are also regulated by DOPPA.
Finally, DOPPA prohibits disclosure of users’ reading histories by entities which offer access to electronic books. Such an entity’s reasonable reliance on a warrant or court order shall be a complete defense to any action for violation of this section. This provision also imposes certain reporting requirements on book service providers.
The Student Data Privacy and Protection Act (SDPPA), effective August 1, 2016, is modeled after California’s Student Online Personal Information Privacy Act. SDPPA requires Delaware’s Department of Education to promulgate extensive rules to protect the privacy of student data and to create and publish a data inventory of the student PII required to be reported.
SDPPA also prohibits, with limited exceptions, transfer of student PII and mandates the development of a data security plan for the state data system. In addition, SDPPA strictly limits the reporting and collection by school districts of sensitive information pertaining to students and their families. Finally, SDPPA includes similar online restrictions as DOPPA with regard to PII and child-targeted marketing and enhances parents’ rights to access and request corrections to education records.
The Victim Online Privacy Act, effective November 5, 2015, amends Delaware’s criminal code to prohibit online posting, soliciting, or selling—with the intent of inciting use of the information to commit a violent crime—of the personal information of certain individuals eligible for Delaware’s “Address Confidentiality Program,” primarily victims of domestic violence, stalking, and sexual assault.
The Employee/Applicant Protection for Social Media Act, effective immediately, prohibits employers from requiring employees or applicants to grant access to social networking accounts.
