HF 307

as introduced - 90th Legislature (2017 - 2018) Posted on 01/17/2017 10:33am

A bill for an act
relating to educational data; protecting online student data and establishing student
digital privacy rights; proposing coding for new law in Minnesota Statutes, chapter
13.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [13.3201] CITATION.
new text end

new text begin Sections 13.3202 and 13.3203 may be cited as the "Student Online Data Protection and
Privacy Act."
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective for the 2017-2018 school year and later.
new text end

Sec. 2.

new text begin [13.3202] PROTECTING ONLINE STUDENT DATA.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions; application. new text end

new text begin (a) The terms defined in this section have the
meanings given them for purposes of sections 13.32 to 13.3203.
new text end

new text begin (b) "Covered information" means personally identifiable information or materials, in
any media or format, that is:
new text end

new text begin (1) created or provided by the student, parent, or guardian to the operator in the course
of using the operator's site, service, or application for K-12 school purposes;
new text end

new text begin (2) created or provided by an employee or agent of the school or district to the operator;
or
new text end

new text begin (3) gathered by an operator operating a site, service, or application for K-12 school
purposes and describes a student or otherwise identifies a student.
new text end

new text begin (c) "De-identified educational data" means aggregate and anonymous data derived from
individual student data combined with data from a sufficient number of other students to
disguise the attributes of any single student. De-identified educational data must not identify
any individual who is the subject of the data and must not provide a reasonable basis for
identifying any individual who is the subject of the data.
new text end

new text begin (d) "Educational data" means personally identifiable information or materials, in any
media or format, that is:
new text end

new text begin (1) created or provided by a student, parent, or guardian to an operator in the course of
the student's, parent's, or guardian's use of the operator's site, service, or application for
K-12 school purposes;
new text end

new text begin (2) created or provided by an employee or agent of the school, school district, or other
local education entity to an operator; or
new text end

new text begin (3) gathered by an operator through operating a site, service, or application and that
describes or otherwise identifies a student, including, but not limited to: information in the
student's educational record or e-mail; first and last name; home address; telephone number;
e-mail address or other information that allows physical or online contact; discipline records;
test results; special education data; juvenile dependency records; grades; evaluations; criminal
records; medical records; health records; Social Security number; biometric information;
disabilities; socioeconomic information; food purchases; political affiliations; religious
information; text messages; documents; student identifiers; search activity; photos; voice
recordings; or geolocation information.
new text end

new text begin (e) "K-12 school purposes" means purposes that customarily take place at the direction
of the kindergarten through grade 12 school, teacher, school district, or other local education
entity or aid in administering school activities, including, but not limited to, instruction in
the classroom or at home, administrative activities, extended day activities, and collaboration
between students, school personnel, or parents, or that are for the school's use and benefit.
new text end

new text begin (f) "Online service" means those cloud computing services that must comply with this
section if the services otherwise meet the definition of an operator in paragraph (g).
new text end

new text begin (g) "Operator" means the operator of a Web site, online service, online application, or
mobile application with actual knowledge that the site, service, or application is designed
and marketed for K-12 school purposes.
new text end

new text begin Subd. 2. new text end

new text begin Prohibited activities. new text end

new text begin (a) An operator must not:
new text end

new text begin (1) target advertising on the operator's site, service, or application, or on any other site,
service, or application when the targeted advertising is based on any covered information,
including educational data and persistent unique identifiers the operator acquired because
of the use of that operator's site, service, or application;
new text end

new text begin (2) use information, including persistent unique identifiers, created or gathered by the
operator's site, service, or application, to amass a student profile except for K-12 school
purposes;
new text end

new text begin (3) sell a student's information, including covered information, except when another
entity purchases, merges with, or acquires the operator or the operator declares bankruptcy,
provided the operator, successor entity, or creditor remains subject to this section with
respect to previously acquired student information; or
new text end

new text begin (4) disclose covered information unless to:
new text end

new text begin (i) further the K-12 school purposes of the site, service, or application, if the recipient
of the covered information that is disclosed under this item: (A) does not further disclose
the data unless to allow or improve operability and functionality within the student's
classroom or school; and (B) complies with the requirements governing an operator under
this section;
new text end

new text begin (ii) ensure legal and regulatory compliance;
new text end

new text begin (iii) respond to or participate in a judicial process;
new text end

new text begin (iv) protect the safety of users or others or the security of the site; or
new text end

new text begin (v) a service provider, if the operator contractually: (A) prohibits the service provider
from using any covered information for any purpose other than providing the contracted
service to, or on behalf of, the operator; (B) prohibits the service provider from disclosing
any covered information provided by the operator to subsequent third parties; and (C)
requires the service provider to implement and maintain reasonable security procedures and
practices applicable to operators under this section.
new text end

new text begin (b) Nothing in this subdivision prohibits the operator from using information to maintain,
develop, improve, or diagnose its site, service, or application.
new text end

new text begin Subd. 3. new text end

new text begin Operator duties. new text end

new text begin (a) An operator must:
new text end

new text begin (1) implement and maintain reasonable security procedures and practices appropriate
to the covered information and protect the data from unauthorized access, destruction, use,
modification, or disclosure; and
new text end

new text begin (2) delete a student's covered information under the control of the school or district at
the request of that school or district.
new text end

new text begin (b) Notwithstanding subdivision 2, paragraph (a), clause (4), an operator that complies
with subdivision 2, paragraph (a), clauses (1) to (3), may disclose a student's covered
information:
new text end

new text begin (1) to comply with federal or state law requiring the operator to protect and disclose the
information;
new text end

new text begin (2) for legitimate research purposes required by state or federal law and subject to the
restrictions of the applicable law, or allowed by state or federal law and at the direction of
a school, school district, or state Department of Education, if no covered information is
used to advertise or amass a student profile for other than K-12 school purposes; or
new text end

new text begin (3) to a state or local educational agency, including a school or school district, for K-12
school purposes, as permitted by state or federal law.
new text end

new text begin Subd. 4. new text end

new text begin De-identified educational data. new text end

new text begin (a) An operator may use students' de-identified
educational data:
new text end

new text begin (1) within the operator's site, service, or application or other sites, services, or applications
owned by the operator to improve educational products; or
new text end

new text begin (2) to demonstrate the effectiveness of the operator's products or services, including the
operator's marketing.
new text end

new text begin (b) An operator may share students' aggregated de-identified student covered information
to develop and improve educational sites, services, or applications.
new text end

new text begin Subd. 5. new text end

new text begin Exceptions. new text end

new text begin (a) This section does not:
new text end

new text begin (1) limit an operator's ability to use students' covered information for adaptive learning
or customized student learning purposes;
new text end

new text begin (2) apply to general audience Web sites, general audience online services, general
audience online applications, or general audience mobile applications, even if login
credentials created for an operator's site, service, or application may be used to access those
general audience sites, services, or applications;
new text end

new text begin (3) limit Internet service providers from providing Internet connectivity to schools or
students and their families;
new text end

new text begin (4) prohibit an operator of a Web site, online service, online application, or mobile
application from marketing educational products directly to parents so long as the operator's
marketing does not result from covered information the operator obtained by providing
services governed by this section;
new text end

new text begin (5) require a provider of an electronic store, gateway, marketplace, or other means of
purchasing or downloading software or applications to review or enforce compliance with
this section on those applications or software;
new text end

new text begin (6) require a provider of an interactive computer service, under United States Code, title
47, section 230, to review or enforce compliance with this section by third-party content
providers;
new text end

new text begin (7) impede students' ability to download, export, or otherwise save or maintain their
own student-created data or documents; or
new text end

new text begin (8) limit the authority of a law enforcement agency to obtain any content or information
from an operator as authorized by law or subject to a court order.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective for the 2017-2018 school year and later.
new text end

Sec. 3.

new text begin [13.3203] STUDENTS' DIGITAL DATA PRIVACY RIGHTS.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions; application. new text end

new text begin (a) The terms defined in this section have the
meanings given them for purposes of sections 13.32 to 13.3203.
new text end

new text begin (b) "Web site, online service, online application, or mobile application directed to minors"
means a Web site, online service, online application, or mobile application, or some portion
thereof, created to reach a predominately minor audience, and is not intended for a more
general adult audience. It does not include a Web site, online service, online application,
or mobile application, or some portion thereof, that solely refers or links to a Web site,
online service, online application, or mobile application directed to minors through
information location tools, including a directory, index, reference, pointer, or hypertext link.
new text end

new text begin (c) "Marketing or advertising" means, in exchange for monetary compensation, to
communicate to one or more individuals, or to arrange to disseminate to the public a
communication about a product or service, the primary purpose of which is to encourage
recipients of the communication to purchase or use the product or service.
new text end

new text begin (d) "Minor" means a natural person under age 18 enrolled in a kindergarten through
grade 12 school, school district, or other local education entity.
new text end

new text begin (e) "Operator" means any person or entity that owns a Web site, online service, online
application, or mobile application. It does not include any third party that does not own but
operates, hosts, or manages a Web site, online service, online application, or mobile
application on the owner's behalf or processes information on the owner's behalf.
new text end

new text begin (f) "Posted" means content or information about a minor published by the minor that
another user, whether registered or not, can access through a Web site, online service, online
application, or mobile application.
new text end

new text begin Subd. 2. new text end

new text begin Prohibited marketing and advertising. new text end

new text begin (a) An operator of a Web site, online
service, online application, or mobile application directed to minors must not market or
advertise to minors a product or service listed in paragraph (d) on its Web site, online service,
online application, or mobile application.
new text end

new text begin (b) An operator of a Web site, online service, online application, or mobile application
must not market or advertise a product or service to a minor the operator knows is using its
Web site, online service, online application, or mobile application if the marketing or
advertising to that minor is based on information specific to that minor, including, but not
limited to, the minor's profile, activity, address, or location sufficient to establish contact
with a minor, and excluding the Internet Protocol (IP) address and product identification
numbers for operating a service. To comply with this subdivision, an operator must act
reasonably and in good faith to avoid marketing or advertising under circumstances prohibited
under this section.
new text end

new text begin (c) An operator that directs minors to a Web site, online service, online application, or
mobile application or knows minors use its Web site, online service, online application, or
mobile application, must not knowingly use, disclose, or compile a minor's personal
information to market or advertise products or services to that minor, or knowingly allow
a third party to use, disclose, or compile that minor's personal information to market or
advertise products or services to a minor.
new text end

new text begin (d) The marketing and advertising restrictions described in paragraph (a) apply to:
new text end

new text begin (1) alcoholic beverages;
new text end

new text begin (2) firearms and handguns;
new text end

new text begin (3) ammunition and reloaded ammunition;
new text end

new text begin (4) handgun safety certificates;
new text end

new text begin (5) aerosol containers of paint capable of defacing property;
new text end

new text begin (6) etching cream capable of defacing property;
new text end

new text begin (7) any tobacco, cigarette, cigarette papers, blunt wraps, other tobacco preparation, or
other instrument or paraphernalia for smoking or ingesting tobacco, products prepared from
tobacco, or any controlled substance;
new text end

new text begin (8) BB device;
new text end

new text begin (9) dangerous fireworks;
new text end

new text begin (10) tanning in an ultraviolet tanning device;
new text end

new text begin (11) dietary supplement products containing ephedrine group alkaloids;
new text end

new text begin (12) tickets or shares in a lottery game;
new text end

new text begin (13) body branding;
new text end

new text begin (14) permanent tattooing;
new text end

new text begin (15) drug paraphernalia;
new text end

new text begin (16) electronic cigarettes;
new text end

new text begin (17) obscene matter; and
new text end

new text begin (18) less lethal weapons.
new text end

new text begin Subd. 3. new text end

new text begin Operator compliance; advertising services. new text end

new text begin (a) For marketing or advertising
provided by an advertising service, the operator of a Web site, online service, online
application, or mobile application directed to minors must notify the advertising service, in
the manner required by the advertising service, that the operator's site, service, or application
is directed to minors.
new text end

new text begin (b) An advertising service notified by an operator under paragraph (a) that the operator's
Web site, online service, online application, or mobile application is directed to minors must
not market or advertise a product or service listed in subdivision 2, paragraph (d), on that
operator's Web site, online service, online application, or mobile application.
new text end

new text begin Subd. 4. new text end

new text begin Removing online content about a minor. new text end

new text begin (a) An operator of a Web site, online
service, online application, or mobile application directed to minors or an operator of a Web
site, online service, online application, or mobile application that knows minors use its Web
site, online service, online application, or mobile application must:
new text end

new text begin (1) permit a minor who is a registered user of the operator's Web site, online service,
online application, or mobile application to remove or, if the operator prefers, ask the operator
to remove, content or information the minor posted on the operator's Web site, online service,
online application, or mobile application;
new text end

new text begin (2) notify a minor who is a registered user of the operator's Web site, online service,
online application, or mobile application that the minor may remove or, if the operator
prefers, ask the operator to remove, content or information the minor posted on the operator's
Web site, online service, online application, or mobile application;
new text end

new text begin (3) clearly inform a minor who is a registered user of the operator's Web site, online
service, online application, or mobile application how to remove or, if the operator prefers,
ask the operator to remove, content or information the minor posted on the operator's Web
site, online service, online application, or mobile application; and
new text end

new text begin (4) notify a minor who is a registered user of the operator's Web site, online service,
online application, or mobile application that removing content or information under clause
(1) does not ensure that all content or information posted about the minor on the operator's
Web site, online service, online application, or mobile application is removed.
new text end

new text begin (b) An operator or a third party is not required to delete or otherwise eliminate, or to
enable deletion or elimination of, content or information if:
new text end

new text begin (1) a federal or state law requires the operator or third party to maintain the content or
information;
new text end

new text begin (2) a third party, other than the minor who is a registered user, posted or stored the
content or information on the operator's Web site, online service, online application, or
mobile application, including any content or information the minor posted that the third
party then stored, republished, or reposted;
new text end

new text begin (3) the operator anonymizes the content or information posted by the minor who is a
registered user so the minor cannot be individually identified;
new text end

new text begin (4) the minor who is a registered user does not follow the operator's instructions under
paragraph (a), clause (3), on how to remove or ask the operator to remove content or
information the minor posted on the operator's Web site, online service, online application,
or mobile application; or
new text end

new text begin (5) the minor received compensation or other consideration for providing the content.
new text end

new text begin (c) This section does not limit the authority of a law enforcement agency authorized by
law or a court order to obtain content or information from an operator.
new text end

new text begin (d) An operator complies with this section if:
new text end

new text begin (1) it renders the content or information posted by the minor no longer visible to other
users of the service and the public, even if the content or information remains on the
operator's servers in some form; or
new text end

new text begin (2) despite making the minor's original posting invisible, the posting remains visible
because a third party copied or reposted the content or information in the original posting.
new text end

new text begin (e) This section shall not be construed to require an operator of a Web site, online service,
online application, or mobile application to collect information on users' ages.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective for the 2017-2018 school year and later.
new text end

Sec. 4. new text begin SEVERABILITY.
new text end

new text begin The provisions of this act are severable. If any provision of this act or its application is
held invalid, that invalidity shall not affect any other provision or application of the act that
can be given effect without the invalid provision or application.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment.
new text end