1.1 	A bill for an act
1.2 	relating to education; creating the Student Data Privacy Act; providing penalties;
1.3 	amending Minnesota Statutes 2016, section 13.32, subdivision 1, by adding 
1.4 	subdivisions.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2016, section 13.32, subdivision 1, is amended to read:
1.7 		Subdivision 1.Definitions. As used in this section:
1.8 	(a) "Educational data" means data on individuals which relate to a student and are 
1.9 	maintained by a public educational agency or institution or by a person acting for or 
1.10 	contracting with the agency or institution which relates to a student, including, but not 
1.11 	limited to, a technology provider.
1.12 	Records of instructional personnel which are in the sole possession of the maker thereof 
1.13 	and are not accessible or revealed to any other individual except a substitute teacher, and 
1.14 	are destroyed at the end of the school year, shall not be deemed to be government data.
1.15 	Records of a law enforcement unit of a public educational agency or institution which 
1.16 	are maintained apart from education data and are maintained solely for law enforcement 
1.17 	purposes, and are not disclosed to individuals other than law enforcement officials of the 
1.18 	jurisdiction are not educational data; provided, that education records maintained by the 
1.19 	educational agency or institution are not disclosed to the personnel of the law enforcement 
1.20 	unit. The University of Minnesota police department is a law enforcement agency for 
1.21 	purposes of section 13.82 and other sections of Minnesota Statutes dealing with law 
1.22 	enforcement records. Records of organizations providing security services to a public 
1.23 	educational agency or institution must be administered consistent with section 13.861.
2.1 	Records relating to a student who is employed by a public educational agency or 
2.2 	institution which are made and maintained in the normal course of business, relate exclusively 
2.3 	to the individual in that individual's capacity as an employee, and are not available for use 
2.4 	for any other purpose are classified pursuant to section 13.43.
2.5 	(b) "Juvenile justice system" includes criminal justice agencies and the judiciary when 
2.6 	involved in juvenile justice activities.
2.7 	(c) "Parent" means a parent, guardian, or other person having legal custody of a child 
2.8 	under age 18.
2.9 	(d) "School-issued device" means a technological device that a public educational agency 
2.10 	or institution, acting independently or with a technology provider, provides to an individual 
2.11 	student for that student's dedicated personal use. A school-issued device includes a device 
2.12 	issued through a one-to-one program.
2.13 	(c) (e) "Student" means an individual currently or formerly enrolled or registered, 
2.14 	applicants for enrollment or registration at a public educational agency or institution, or 
2.15 	individuals who receive shared time educational services from a public agency or institution.
2.16 	(d) (f) "Substitute teacher" means an individual who performs on a temporary basis the 
2.17 	duties of the individual who made the record, but does not include an individual who 
2.18 	permanently succeeds to the position of the maker of the record.
2.19 	(g) "Technology provider" means a person who:
2.20 	(1) contracts with a public educational agency or institution, as part of a one-to-one 
2.21 	program or otherwise, to provide technological devices for student use or to provide access 
2.22 	to a software or online application; and
2.23 	(2) creates, receives, or maintains educational data pursuant or incidental to a contract 
2.24 	with a public educational agency or institution.
2.25 	A technology provider does not include a not-for-profit organization that has the primary 
2.26 	purpose of expanding student access to postsecondary education and that obtains a student's 
2.27 	consent to utilize the student's educational data for that purpose.

2.28 	EFFECTIVE DATE. This section is effective for the 2019-2020 school year and later.

2.29 	Sec. 2. Minnesota Statutes 2016, section 13.32, is amended by adding a subdivision to 
2.30 	read:
2.31 		Subd. 13. Audit trail required for electronic student records systems. (a) A public 
2.32 	educational agency or institution must establish written procedures to ensure appropriate 
3.1 	security safeguards for educational data stored in a technology system, including but not 
3.2 	limited to an electronic database, software application, or cloud-based service. These 
3.3 	procedures must require that:
3.4 	(1) a person may access the educational data only if authorized;
3.5 	(2) a person may be authorized to access educational data only if access is necessary to 
3.6 	fulfill official duties; and
3.7 	(3) all actions in which educational data are entered, updated, accessed, shared, or 
3.8 	disseminated, are recorded in a log-of-use that includes the identity of the person interacting 
3.9 	with the data, the identity of the student whose data is affected, the date and time of the 
3.10 	action, and what action was performed. Information recorded in the log-of-use must be 
3.11 	retained for at least one year.
3.12 	(b) The written procedures required by paragraph (a) are public data unless classified 
3.13 	as not public under any other applicable law.
3.14 	(c) Paragraph (a), clause (3), does not apply to technology systems that were in use prior 
3.15 	to January 1, 2019, and that lack the capacity to automatically record actions in a log-of-use.

3.16 	EFFECTIVE DATE. This section is effective for the 2019-2020 school year and later.

3.17 	Sec. 3. Minnesota Statutes 2016, section 13.32, is amended by adding a subdivision to 
3.18 	read:
3.19 		Subd. 14.Training required. A public educational agency or institution must provide 
3.20 	at least annual training for administrative staff, IT directors, teachers, and any other individual 
3.21 	with access to educational data to ensure understanding of and compliance with applicable 
3.22 	provisions of this section, section 121A.065, and the Family Educational Rights and Privacy 
3.23 	Act, United States Code, title 20, section 1232g, and its regulations as provided by Code 
3.24 	of Federal Regulations, title 34, part 99.

3.25 	EFFECTIVE DATE. This section is effective for the 2019-2020 school year and later.

3.26 	Sec. 4. Minnesota Statutes 2016, section 13.32, is amended by adding a subdivision to 
3.27 	read:
3.28 		Subd. 15.Technology providers. (a) A technology provider is subject to the provisions 
3.29 	of section 13.05, subdivision 11.
4.1 	(b) All educational data created, received, or maintained by a technology provider 
4.2 	pursuant or incidental to a contract with a public educational agency or institution are not 
4.3 	the technology provider's property.
4.4 	(c) If educational data maintained by the technology provider are subject to a breach of 
4.5 	the security of the data, as defined in section 13.055, the technology provider must, following 
4.6 	discovery of the breach, disclose to the public educational agency or institution all 
4.7 	information necessary to fulfill the requirements of section 13.055.
4.8 	(d) Unless renewal of the contract is reasonably anticipated, within 30 days of the 
4.9 	expiration of the contract, a technology provider must destroy or return to the appropriate 
4.10 	public educational agency or institution all educational data created, received, or maintained 
4.11 	pursuant or incidental to the contract.
4.12 	(e) A technology provider must not sell, share, or disseminate educational data, except 
4.13 	as provided by this section or as part of a valid delegation or assignment of its contract with 
4.14 	a public educational agency or institution. An assignee or delegee that creates, receives, or 
4.15 	maintains educational data is subject to the same restrictions and obligations under this 
4.16 	section as the technology provider.
4.17 	(f) A technology provider must not use educational data for any commercial purpose, 
4.18 	including, but not limited to, marketing or advertising to a student or parent.
4.19 	(g) A technology provider must establish written procedures to ensure appropriate 
4.20 	security safeguards for educational data. These procedures must require that:
4.21 	(1) the technology provider's employees or contractors have access to educational data 
4.22 	only if authorized;
4.23 	(2) the technology provider's employees or contractors may be authorized to access 
4.24 	educational data only if access is necessary to fulfill the official duties of the employee or 
4.25 	contractor; and
4.26 	(3) all actions in which educational data are entered, updated, accessed, shared, or 
4.27 	disseminated, are recorded in a log-of-use that includes the identity of the employee or 
4.28 	contractor interacting with the data, the identity of the student whose data is affected, the 
4.29 	date and time of the action, and what action was performed. Information recorded in the 
4.30 	log-of-use must be retained for at least one year.
4.31 	These written procedures are public data unless classified as not public under any other 
4.32 	applicable law.
5.1 	(h) Within 30 days of the start of each school year, a public educational agency or 
5.2 	institution must give parents and students direct, timely notice, by United States mail, e-mail, 
5.3 	or other direct form of communication, of any technology provider contract affecting a 
5.4 	student's educational data. The notice must:
5.5 	(1) identify each technology provider with access to educational data;
5.6 	(2) identify the educational data affected by the technology provider contract; and
5.7 	(3) include information about the contract inspection and, if applicable, the parent or 
5.8 	student's ability to opt out of any program or activity that allows a technology provider to 
5.9 	access a student's educational data.
5.10 	(i) A public educational agency or institution must provide parents and students an 
5.11 	opportunity to inspect a complete copy of any contract with a technology provider.
5.12 	(j) A public educational agency or institution must not penalize or withhold an educational 
5.13 	benefit from a parent or student who opts out of any program or activity that allows a 
5.14 	technology provider to access a student's educational data.

5.15 	EFFECTIVE DATE. This section is effective for the 2019-2020 school year and later.

5.16 	Sec. 5. Minnesota Statutes 2016, section 13.32, is amended by adding a subdivision to 
5.17 	read:
5.18 		Subd. 16.School-issued devices. (a) Except as provided in paragraph (b), a government 
5.19 	entity or technology provider must not access or monitor:
5.20 	(1) any location-tracking feature of a school-issued device;
5.21 	(2) any audio or visual receiving, transmitting, or recording feature of a school-issued 
5.22 	device; or
5.23 	(3) student interactions with a school-issued device, including, but not limited to, 
5.24 	keystrokes and Web browsing activity.
5.25 	(b) A government entity or technology provider may only engage in activities prohibited 
5.26 	by paragraph (a) if:
5.27 	(1) the student to whom the school-issued device was issued initiates and agrees to the 
5.28 	activity, and the activity is limited to a noncommercial educational purpose;
5.29 	(2) the activity is permitted under a judicial warrant;
6.1 	(3) the student to whom the school-issued device was provided or that student's parent 
6.2 	notifies the public educational agency or institution or law enforcement agency that the 
6.3 	device is missing or stolen;
6.4 	(4) the activity is necessary to respond to an imminent threat to life or safety and the 
6.5 	access is limited to that purpose; or
6.6 	(5) the activity is limited to that which is prohibited by paragraph (a), clause (3), and is 
6.7 	necessary to enforce a school's acceptable-use policy.
6.8 	(c) If a government entity or technology provider interacts with a school-issued device 
6.9 	as provided in paragraph (b), clause (4), it must, within 72 hours of the access, notify the 
6.10 	student to whom the device was provided or that student's parent and provide a written 
6.11 	description of the interaction, including which features of the device were accessed and a 
6.12 	description of the threat. This notice is not required if the notice itself would pose an 
6.13 	imminent threat to life or safety.

6.14 	EFFECTIVE DATE. This section is effective for the 2019-2020 school year and later.

6.15 	Sec. 6. Minnesota Statutes 2016, section 13.32, is amended by adding a subdivision to 
6.16 	read:
6.17 		Subd. 17.Application to nonpublic schools; exemption. (a) Notwithstanding any law 
6.18 	to the contrary, an accredited nonpublic school recognized by the Minnesota Council on 
6.19 	Nonpublic Education under section 123B.445, excluding home schools, must comply with 
6.20 	subdivisions 14 to 16 as if it were a public educational agency or institution.
6.21 	(b) A technology provider contracting with an accredited nonpublic school recognized 
6.22 	by the Minnesota Council on Nonpublic Education under section 123B.445, excluding home 
6.23 	schools, must comply with subdivisions 14 to 16 as if that school were a public educational 
6.24 	agency or institution.
6.25 	(c) A postsecondary institution is exempt from subdivisions 13 to 16. This exemption 
6.26 	extends to a technology provider for purposes of a contract with a postsecondary institution.

6.27 	EFFECTIVE DATE. This section is effective for the 2019-2020 school year and later.