1.1 	A bill for an act
1.2 	relating to education; creating the Student Data Privacy Act; providing penalties;
1.3 	amending Minnesota Statutes 2018, section 13.32, subdivision 1, by adding 
1.4 	subdivisions.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2018, section 13.32, subdivision 1, is amended to read:
1.7 		Subdivision 1.Definitions. As used in this section:
1.8 	(a) "Educational data" means data on individuals that relates to a student and is maintained 
1.9 	by a public educational agency or institution or by a person acting for or contracting with 
1.10 	the agency or institution which relates to a student, including but not limited to a technology 
1.11 	provider.
1.12 	Records of instructional personnel which are in the sole possession of the maker thereof 
1.13 	and are not accessible or revealed to any other individual except a substitute teacher, and 
1.14 	are destroyed at the end of the school year, shall not be deemed to be government data.
1.15 	Records of a law enforcement unit of a public educational agency or institution which 
1.16 	are maintained apart from education data and are maintained solely for law enforcement 
1.17 	purposes, and are not disclosed to individuals other than law enforcement officials of the 
1.18 	jurisdiction are not educational data; provided, that education records maintained by the 
1.19 	educational agency or institution are not disclosed to the personnel of the law enforcement 
1.20 	unit. The University of Minnesota police department is a law enforcement agency for 
1.21 	purposes of section 13.82 and other sections of Minnesota Statutes dealing with law 
1.22 	enforcement records. Records of organizations providing security services to a public 
1.23 	educational agency or institution must be administered consistent with section 13.861.
2.1 	Records relating to a student who is employed by a public educational agency or 
2.2 	institution which are made and maintained in the normal course of business, relate exclusively 
2.3 	to the individual in that individual's capacity as an employee, and are not available for use 
2.4 	for any other purpose are classified pursuant to section 13.43.
2.5 	(b) "Juvenile justice system" includes criminal justice agencies and the judiciary when 
2.6 	involved in juvenile justice activities.
2.7 	(c) "Parent" means a parent, guardian, or other person having legal custody of a child 
2.8 	under the age of 18.
2.9 	(d) "School-issued device" means a technological device that a public educational agency 
2.10 	or institution, acting independently or with a technology provider, provides to an individual 
2.11 	student for that student's dedicated personal use. A school-issued device includes a device 
2.12 	issued through a one-to-one program.
2.13 	(c) (e) "Student" means an individual currently or formerly enrolled or registered, 
2.14 	applicants for enrollment or registration at a public educational agency or institution, or 
2.15 	individuals who receive shared time educational services from a public agency or institution.
2.16 	(d) (f) "Substitute teacher" means an individual who performs on a temporary basis the 
2.17 	duties of the individual who made the record, but does not include an individual who 
2.18 	permanently succeeds to the position of the maker of the record.
2.19 	(g) "Technology provider" means a person who:
2.20 	(1) contracts with a public educational agency or institution, as part of a one-to-one 
2.21 	program or otherwise, to provide technological devices for student use or to provide access 
2.22 	to a software or online application; and
2.23 	(2) creates, receives, or maintains educational data pursuant or incidental to a contract 
2.24 	with a public educational agency or institution.

2.25 	EFFECTIVE DATE. This section is effective for the 2020-2021 school year and later.

2.26 	Sec. 2. Minnesota Statutes 2018, section 13.32, is amended by adding a subdivision to 
2.27 	read:
2.28 		Subd. 13.Technology providers. (a) A technology provider is subject to the provisions 
2.29 	of section 13.05, subdivision 11.
2.30 	(b) All educational data created, received, or maintained by a technology provider 
2.31 	pursuant or incidental to a contract with a public educational agency or institution are not 
2.32 	the technology provider's property.
3.1 	(c) If educational data maintained by the technology provider are subject to a breach of 
3.2 	the security of the data, as defined in section 13.055, the technology provider must, following 
3.3 	discovery of the breach, disclose to the public educational agency or institution all 
3.4 	information necessary to fulfill the requirements of section 13.055.
3.5 	(d) Unless renewal of the contract is reasonably anticipated, within 30 days of the 
3.6 	expiration of the contract, a technology provider must destroy or return to the appropriate 
3.7 	public educational agency or institution all educational data created, received, or maintained 
3.8 	pursuant or incidental to the contract.
3.9 	(e) A technology provider must not sell, share, or disseminate educational data, except 
3.10 	as provided by this section or as part of a valid delegation or assignment of its contract with 
3.11 	a public educational agency or institution. An assignee or delegee that creates, receives, or 
3.12 	maintains educational data is subject to the same restrictions and obligations under this 
3.13 	section as the technology provider.
3.14 	(f) A technology provider must not use educational data for any commercial purpose, 
3.15 	including but not limited to marketing or advertising to a student or parent.
3.16 	(g) A technology provider must establish written procedures to ensure appropriate 
3.17 	security safeguards for educational data. These procedures must require that:
3.18 	(1) the technology provider's employees or contractors have access to educational data 
3.19 	only if authorized; and
3.20 	(2) the technology provider's employees or contractors may be authorized to access 
3.21 	educational data only if access is necessary to fulfill the official duties of the employee or 
3.22 	contractor.
3.23 	These written procedures are public data unless classified as not public data under any other 
3.24 	applicable law.
3.25 	(h) Within 30 days of the start of each school year, a public educational agency or 
3.26 	institution must give parents and students direct, timely notice, by United States mail, e-mail, 
3.27 	or other direct form of communication, of any curriculum, testing, or assessment technology 
3.28 	provider contract affecting a student's educational data. The notice must:
3.29 	(1) identify each curriculum, testing, or assessment technology provider with access to 
3.30 	educational data;
3.31 	(2) identify the educational data affected by the curriculum, testing, or assessment 
3.32 	technology provider contract; and
4.1 	(3) include information about the contract inspection and, if applicable, the parent or 
4.2 	student's ability to opt out of any program or activity that allows a curriculum, testing, or 
4.3 	assessment technology provider to access a student's educational data.
4.4 	(i) A public educational agency or institution must provide parents and students an 
4.5 	opportunity to inspect a complete copy of any contract with a technology provider.
4.6 	(j) A public educational agency or institution must not penalize or withhold an educational 
4.7 	benefit from a parent or student who opts out of any program or activity that allows a 
4.8 	technology provider to access a student's educational data.

4.9 	EFFECTIVE DATE. This section is effective for the 2020-2021 school year and later.

4.10 	Sec. 3. Minnesota Statutes 2018, section 13.32, is amended by adding a subdivision to 
4.11 	read:
4.12 		Subd. 14.School-issued devices. (a) Except as provided in paragraph (b), a government 
4.13 	entity or technology provider must not electronically access or monitor:
4.14 	(1) any location-tracking feature of a school-issued device;
4.15 	(2) any audio or visual receiving, transmitting, or recording feature of a school-issued 
4.16 	device; or
4.17 	(3) student interactions with a school-issued device, including but not limited to 
4.18 	keystrokes and web-browsing activity.
4.19 	(b) A government entity or technology provider may only engage in activities prohibited 
4.20 	by paragraph (a) if:
4.21 	(1) the student to whom the school-issued device was issued initiates and agrees to the 
4.22 	activity, and the activity is limited to a noncommercial educational purpose;
4.23 	(2) the activity is permitted under a judicial warrant;
4.24 	(3) the student to whom the school-issued device was issued or that student's parent 
4.25 	notifies the public educational agency or institution or law enforcement agency that the 
4.26 	device is missing or stolen; or
4.27 	(4) the activity is necessary to respond to an imminent threat to life or safety and the 
4.28 	access is limited to that purpose.
4.29 	(c) If a government entity or technology provider interacts with a school-issued device 
4.30 	as provided in paragraph (b), clause (4), it must, within 72 hours of the access, notify the 
4.31 	student to whom the school-issued device was issued or that student's parent and provide a 
5.1 	written description of the interaction, including which features of the device were accessed 
5.2 	and a description of the threat. This notice is not required if the notice itself would pose an 
5.3 	imminent threat to life or safety.

5.4 	EFFECTIVE DATE. This section is effective for the 2020-2021 school year and later.

5.5 	Sec. 4. Minnesota Statutes 2018, section 13.32, is amended by adding a subdivision to 
5.6 	read:
5.7 		Subd. 15.Application to nonpublic schools; exemption. (a) Notwithstanding any law 
5.8 	to the contrary, an accredited nonpublic school recognized by the Council on Nonpublic 
5.9 	Education under section 123B.445, excluding home schools, must comply with subdivisions 
5.10 	13 and 14 as if it were a public educational agency or institution.
5.11 	(b) A technology provider contracting with an accredited nonpublic school recognized 
5.12 	by the Council on Nonpublic Education under section 123B.445, excluding home schools, 
5.13 	must comply with subdivisions 13 and 14 as if that school were a public educational agency 
5.14 	or institution.
5.15 	(c) A postsecondary institution is exempt from subdivisions 13 and 14. This exemption 
5.16 	extends to a technology provider for purposes of a contract with a postsecondary institution.

5.17 	EFFECTIVE DATE. This section is effective for the 2020-2021 school year and later.