A new law went into effect in Illinois on January 1 that allows schools to demand students’ Facebook passwords as part of school discipline. The law was made with good intentions, designed to catch cyberbullies, but with most issues of online privacy, it could have big unintended consequences.

According to a letter sent out to parents in the state this week, school authorities may “require a student or his or her parent/guardian to provide a password or other related account information in order to gain access to his/her account or profile on a social networking website” If the school officials have “reasonable cause” the student in question violated a school rule.

Of course, this raises a whole host of problems. For instance, who determines what “reasonable cause” means? And what legal recourse do students or parents have if they refuse the order to hand over passwords? Most importantly, where do the boundaries of the schools’ power end? Under this law, schools would be able to investigate all of a student’s Facebook posts ­— whether they were made on a school computer, on campus or at home — and make a judgment.

“It’s one thing for me to take my child’s social media account in there and open it up for the teacher to look [at]… but to have to hand over your passport and personal information to your accounts to the school is just not acceptable,” Sara Bozarth, an Illinois parent, told local news station KTVI-TV.

It’s easy to understand why schools would want this level of power; bullying has increasingly moved from the playground to online forms of communication. However, it may be a step too far to grant educators this kind of all-access pass to students’ personal info.