EdLaw
New Hampshire — student and teacher information protection and privacy (RSA 189:65 to 189:68-a)
The "Student and Teacher Information Protection and Privacy" subdivision of RSA chapter 189 (first enacted 2014, 68:1 — House Bill 1587, whose section 68:4 provides that "This act shall take effect July 1, 2014"; RSA 189:68-a added by 2015, 128:1, eff. Jan. 1, 2016; most recently amended 2025, 141:400, eff. July 1, 2025). It combines a records regime for the department and schools — with minimum privacy and security standards every local education agency's data and privacy governance plan must meet — and a SOPIPA-model operator statute that reaches cloud computing services by name.
Applicability to EdTech
- Every app is inventoried and reviewed. Each local education agency's data and privacy governance plan must include "An inventory of all software applications, digital tools, and extensions" (users, provider, purpose, publisher, privacy statement and terms of use), a review of each with "an assurance that they meet or exceed standards set by the department", and "A requirement for a service provider to meet or exceed standards for data protection and privacy" (RSA 189:66, V(a), V(b), V(e)).
- Operator duties. No targeted advertising, profiling, sale, lease, rent or trade of student information, and no disclosure of protected information except to respond to or participate in judicial process; reasonable security; deletion on the school's or district's request (RSA 189:68-a, II(a), II(b)).
- Cloud services are operators. "'Online service' includes cloud computing services, which shall comply with this section if they otherwise meet the definition of an operator" (RSA 189:68-a, I(d)).
- Biometrics, tracking devices and surveillance. "Biometric" is defined to include facial characteristics and voiceprints (RSA 189:65, I); no school may require a student to use an RFID-type identification or tracking device, or install remote surveillance software ("observing, capturing images, listening, or recording") on a school-supplied device, without school board approval after a public hearing and written parental consent (RSA 189:68, II, III).
- Classroom recording for teacher evaluations requires board approval after a public hearing and written consent (RSA 189:68, IV).
Contents
| Document | Covers |
|---|---|
| STUDENT-PRIVACY.md | RSA 189:65 (definitions), 189:66 (data inventory, security plan, LEA minimum standards), 189:67 (limits on disclosure), 189:68 (student privacy), 189:68-a (student online personal information) |
Key obligations at a glance
- LEA governance plan: app inventory and review, access and privacy policies, breach response plan, service-provider standards — RSA 189:66, V.
- Operators: no targeted advertising, profiling or sale; disclosure only for judicial process — RSA 189:68-a, II(a).
- Operators: reasonable security; deletion on the school's or district's request — RSA 189:68-a, II(b).
- Schools: no remote surveillance software on school-supplied devices without board approval and written parental consent — RSA 189:68, III.
Enforcement
The subdivision sets no penalty and names no enforcing authority for the operator duties in RSA 189:68-a (RSA 189:68-a).
Licence
The corpus reproduces RSA 189:65 to 189:68-a verbatim from the New Hampshire General Court's RSA pages (through the Internet Archive's id_ endpoint, which returns the publisher's original bytes), with each section's "Source." note.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
The RSA pages (gc.nh.gov — RSA 189:68-a, read 2026-10-08 through the Internet Archive) carry no copyright notice.
Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).
Related
- Maine Student Information Privacy Act — the neighbouring SOPIPA-model act
- California SOPIPA — the model RSA 189:68-a follows
- SDPC New Hampshire state terms — the contract layer New Hampshire districts use with vendors
- FERPA — the federal rights RSA 189:66, IV requires schools to publish
Sources
- New Hampshire General Court — RSA 189:66
- New Hampshire General Court — RSA 189:68-a
- New Hampshire General Court — 2014 Chapter 68 (HB 1587) — 68:1 inserts the subdivision beginning with RSA 189:65; "68:4 Effective Date. This act shall take effect July 1, 2014. Approved: May 27, 2014" (read through the Internet Archive's 2024-05-09 capture of the gencourt.state.nh.us URL)