(a)        It is unlawful for a person who enters into a contract with a local board of education or its designee to sell any personally identifiable information that is obtained from a student as a result of the person’s performance under the contract. This prohibition does not apply if the person obtains the prior written authorization of the student’s parent or guardian. This authorization shall include the parent’s or guardian’s original signature. The person shall not solicit this authorization and signature through the school’s personnel or equipment or on school grounds.

(b)        The following definitions apply in this section:

(1)        “Contract” means a contract for the provision of goods or services.

(2)        “Personally identifiable information” means any information directly related to a student, including the student’s name, birthdate, address, social security number, individual purchasing behavior or preferences, parents’ names, telephone number, or any other information or identification number that would provide information about a specific student.

(3)        “Sell” means sell or otherwise use for a business or marketing purpose.

(c)        A violation of subsection (a) of this section shall be punished as a Class 2 misdemeanor, and when the defendant is an organization as defined in N.C. Gen. Stat. § 15A-773(c) the fine shall be five thousand dollars ($5,000) for the first violation, ten thousand dollars ($10,000) for a second violation, and twenty-five thousand dollars ($25,000) for a third or subsequent violation.

(d)       Nothing in this section shall preclude the enforcement of civil remedies as otherwise provided by law.

(e)        Nothing in this section prohibits the identification and disclosure of directory information in compliance with federal law and local board of education policy or procedure. (2001-500, s. 1.)