ILLINOIS — A new Illinois law offers college and high-school students a limited measure of protection against school demands for their social-media passwords. But advocates disagree whether the statute represents a curb on schools’ ability to snoop, or a grant of greater — perhaps unconstitutionally greater — snooping authority.
Under the statute, Illinois schools and universities can’t require students to hand over their social media account passwords — unless they’re suspected of breaking a school disciplinary rule.
The law, which went into effect Jan. 1, makes it illegal for colleges or universities to request students’ social media account passwords unless “a post-secondary school has reasonable cause to believe that a student’s account on a social networking website contains evidence that the student has violated a school disciplinary rule or policy.”
The law also requires elementary and secondary schools to notify students and parents of the school’s authority to require a student to provide their passwords or other account information in order to gain access to the student’s profile — again, only if the school has a “reasonable cause to believe” the account contains evidence of a policy infraction.
Ed Yohnka, director of communications and public policy for the American Civil Liberties Union of Illinois, said there needs to be some separation between schools and what students do on their own time on their personal device. Creating this distance was “clearly the intent of the legislature,” he said.
“This really goes a long way toward protecting that,” he said, adding that only time will tell if the law goes far enough to protect students.
“There clearly is still the ability for the school to get at this information if there’s some real burning need to do so, but I think it also provides a level of protection and privacy for students that is important as well,” Yohnka said.
Students store an “incredible amount of private information” in their online profiles and accounts and it shouldn’t be available to school officials “upon a simple request,” said Adam Wolf, an attorney in California who litigates legal issues on behalf of students.
While it’s great that the policy doesn’t sacrifice students’ privacy entirely, Wolf said there needs to be a greater threshold before a school can demand access to such private information. The law is far too broad, he said.
“For instance, it violates most school policy to chew gum,” Wolf said. “You can’t possibly have a rule that allows a school official to snoop around your online accounts solely to find out if you chewed gum that day.”
Justin Patchin, professor of criminal justice at University of Wisconsin-Eau Claire and co-director of the Cyberbullying Research Center, said it seems like a “reasonable law” and making everybody involved aware of a set standard is useful.
“The law and related policies are an attempt to sort of give educators some guidance in this respect,” Patchin said. “So I think there would be a greater risk prior to this law going into effect that teachers didn’t understand what the rules were and they would maybe coerce students into turning over passwords in situations where it wasn’t appropriate.”
Still, there will always be a question of what warrants reasonable suspicion, he said. It all depends on circumstances.
Melinda Selbee, attorney with the Illinois Association of School Boards, said the organization was neutral on the bill as it was going through the legislature. As part of their policy service, the association is suggesting that school officials adopt in their policies the notification that’s required by the law.
“We’re suggesting that districts just simply follow the act and notify parents,” Selbee said.
The law likely won’t change how school districts handle incidents, as it’s just a requirement to inform students, she said. Selbee didn’t know which individual school boards in the state were adopting policies in response to the law.
“I don’t think this is going to change how districts do business regarding students,” she said.
Wolf said the law seems to authorize an overreach of school authority.
“It seems to authorize actions that are unconstitutional.” Wolf said. “If it allows school officials to search the online accounts of every student for any possible breach of any school policy, that is far more authority than the Constitution allows for the schools.”
Yohnka said the legislation sent a “very clear signal” that the state thought a level of protection was important for private means of communication.
“I think that that in some ways is important,” Yohnka said. “Because I think one of the things it does or should do is probably make an administrator or a school district stop and think about trying to penetrate that zone of privacy. In that regard, that’s a good thing.”
By Lydia Coutré, SPLC staff writer. Contact Coutré by email or at (703) 807-1904 ext. 126.