Oregon Revised Statutes Chapter 350 § 350.272 — Prohibited actions related to access to personal social media accounts

Prohibited actions related to access to personal social media accounts. (1) A public or private educational institution may not: (a) Require, request or otherwise compel a student or prospective student to disclose or to provide access to a personal social media account through the student’s or prospective student’s user name and password, password or other means of authentication that provides access. (b) Require, request or otherwise compel a student or prospective student to access a personal social media account in the presence of an administrator or other employee of the educational institution in a manner that enables the administrator or employee to observe the contents of the personal social media account. (c) Take, or threaten to take, any action to discipline or to prohibit from participation in curricular or extracurricular activities a student or prospective student for refusal to disclose the information or take actions specified in paragraph (a) or (b) of this subsection. (d) Fail or refuse to admit a prospective student as a result of the refusal by the prospective student to disclose the information or take actions specified in paragraph (a) or (b) of this subsection. (2) Nothing in this section prohibits an educational institution from: (a) Conducting an investigation, for the purpose of ensuring compliance with applicable law, regulatory requirements or prohibitions against student misconduct, that is based on the receipt of specific information about activity associated with a personal social media account. (b) Conducting an investigation authorized under paragraph (a) of this subsection that requires the student to share specific content on a social media account with the educational institution in order for the educational institution to make a factual determination about that content. Student cooperation required under this paragraph does not include providing the student’s user name and password, password or other means of authentication that provides access to the student’s personal social media account to the educational institution. (c) Revoking a student’s access, in whole or in part, to equipment or computer networks owned or operated by the educational institution. (3) An educational institution is not liable for obtaining the user name and password, password or other means of authentication that provides access to a student’s social media account through the application of the educational institution’s policies governing the use of university equipment or computer networks owned or operated by the educational institution. However, the educational institution may not use the information obtained without the voluntary consent of the student. (4) Nothing in this section applies to social media accounts intended for use solely for educational purposes at an educational institution or to social media accounts that are created by the educational institution and provided to the student if the student has been provided advance notice that the account may be monitored at any time by the educational institution. (5) As used in this section: (a) “Educational institution” means an institution that offers participants, students or trainees an organized course of study or training that is academic, technical, trade-oriented or preparatory for gainful employment in a recognized occupation. “Educational institution” includes, but is not limited to, community colleges and the public universities listed in ORS 352.002 but does not include kindergarten, elementary or secondary schools. (b) “Social media” means an electronic medium that allows users to create, share and view user-generated content, including, but not limited to, uploading or downloading videos, still photographs, blogs, video blogs, podcasts, instant messages, electronic mail or Internet website profiles or locations. [Formerly 326.551]