A. As used in this section:

"Social media account" means a personal account with an electronic medium or service through which users may create, share, or view user-generated content, including, without limitation, videos, photographs, blogs, podcasts, messages, emails, or website profiles or locations. "Social media account" does not include an account (i) opened by a student at the request of a public or private institution of higher education or (ii) provided to a student by a public or private institution of higher education such as the student's email account or other software program owned or operated exclusively by a public or private institution of higher education.

B. Each public institution of higher education and private institution of higher education may require any student who attends, or any applicant who has been accepted to and has committed to attend, such institution to provide, to the extent available, from the originating secondary school and, if applicable, any institution of higher education he has attended a complete student record, including any mental health records held by the previous school or institution. Such records shall be kept confidential as required by state and federal law, including the federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g)(FERPA).

C. Student directory information, as defined by FERPA, and which may include a student's name, sex, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height as a member of an athletic team, dates of attendance, degrees and awards received, and other similar information, may be disclosed, provided that the institution has given notice to the student of (i) the types of information that the institution has designated as directory information, (ii) the right of the student to refuse the designation of any or all of the types of information about the student as directory information, and (iii) the period of time within which the student must notify the institution in writing that he does not want any or all of the types of information about the student designated as directory information. However, no institution shall disclose the address, telephone number, or email address of a student pursuant to the Virginia Freedom of Information Act (§ 2.2-3700 et seq.) unless the student has affirmatively consented in writing to such disclosure. Additionally, except as required by state or federal law, no institution shall disclose the address, telephone number, or email address of a student pursuant to 34 C.F.R. § 99.31(a)(11) unless (a) the disclosure is to students enrolled in the institution for educational purposes or institution business and the student has not opted out of such disclosure in accordance with this subsection and institution policy or (b) the student has affirmatively consented in writing to such disclosure except as required by state or federal law. This subsection shall not apply to disclosures, other than disclosures pursuant to 34 C.F.R. § 99.31(a)(11), permitted under FERPA.

D. No public institution of higher education shall sell students' personal information, including names, addresses, phone numbers, and email addresses, to any person. This subsection shall not apply to transactions involving credit, debit, employment, finance, identity verification, risk assessment, fraud prevention, or other transactions initiated by the student.

E. No public or private institution of higher education shall require a student to disclose the username or password to any of such student's personal social media accounts. Nothing in this subsection shall prevent a campus police officer appointed under Article 3 (§ 23.1-809 et seq.) of Chapter 8 from performing his official duties.

2008, c. 571, § 23-2.1:3; 2012, cc. 347, 382; 2014, c. 748; 2016, cc. 588, 597; 2018, c. 806; 2019, c. 229.