HF 1895

as introduced - 89th Legislature (2015 - 2016) Posted on 03/19/2015 04:53pm

A bill for an act
relating to educational data; protecting online student data and establishing
student digital privacy rights; proposing coding for new law in Minnesota
Statutes, chapter 13.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [13.3201] CITATION.
new text end

new text begin Sections 13.3202 and 13.3203 may be cited as the "Student Online Data Protection
and Privacy Act."
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective for the 2015-2016 school year and
later.
new text end

Sec. 2.

new text begin [13.3202] PROTECTING ONLINE STUDENT DATA.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions; application. new text end

new text begin (a) The terms defined in this section have
the meanings given them for purposes of sections 13.32 to 13.3203.
new text end

new text begin (b) "Covered information" means personally identifiable information or materials,
in any media or format, that is:
new text end

new text begin (1) created or provided by the student or the student's parent or guardian to the
operator in the course of using the operator's site, service, or application for K-12 school
purposes;
new text end

new text begin (2) created or provided by an employee or agent of the school or district to the
operator; or
new text end

new text begin (3) gathered by an operator operating a site, service, or application for K-12 school
purposes and describes a student or otherwise identifies a student.
new text end

new text begin (c) "De-identified educational data" means aggregate and anonymous data derived
from individual student data combined with data from a sufficient number of other
students to disguise the attributes of any single student. De-identified educational data
must not identify any individual who is the subject of the data and must not provide a
reasonable basis for identifying any individual who is the subject of the data.
new text end

new text begin (d) "Educational data" means personally identifiable information or materials, in any
media or format, that is:
new text end

new text begin (1) created or provided by a student, or the student's parent or legal guardian, to an
operator in the course of the student's, parent's, or legal guardian's use of the operator's
site, service, or application for K-12 school purposes;
new text end

new text begin (2) created or provided by an employee or agent of the school, school district, or
other local education entity, to an operator; or
new text end

new text begin (3) gathered by an operator through operating a site, service, or application and that
describes or otherwise identifies a student, including, but not limited to, information in
the student's educational record or e-mail; first and last name; home address; telephone
number; e-mail address or other information that allows physical or online contact;
discipline records; test results; special education data; juvenile dependency records;
grades; evaluations; criminal records; medical records; health records; Social Security
number; biometric information; disabilities; socioeconomic information; food purchases;
political affiliations; religious information; text messages; documents; student identifiers;
search activity; photos; voice recordings; or geolocation information.
new text end

new text begin (e) "K-12 school purposes" means purposes that customarily take place at the
direction of the kindergarten through grade 12 school, teacher, school district, or other
local education entity or aid in administering school activities, including, but not limited
to, instruction in the classroom or at home, administrative activities, extended day
activities, and collaboration between students, school personnel, or parents, or that are
for the school's use and benefit.
new text end

new text begin (f) "Online service" means those cloud computing services that must comply with
this section if the services otherwise meet the definition of an operator in paragraph (g).
new text end

new text begin (g) "Operator" means the operator of an Internet Web site, online service, online
application, or mobile application with actual knowledge that the site, service, or
application is designed and marketed for K-12 school purposes.
new text end

new text begin Subd. 2. new text end

new text begin Prohibited activities. new text end

new text begin (a) An operator must not:
new text end

new text begin (1) target advertising on the operator's site, service, or application, or on any
other site, service, or application when the targeted advertising is based on any covered
information, including educational data and persistent unique identifiers, the operator
acquired because of the use of that operator's site, service, or application;
new text end

new text begin (2) use information, including persistent unique identifiers, created or gathered by
the operator's site, service, or application, to amass a K-12 student profile except for
K-12 school purposes;
new text end

new text begin (3) sell a student's information, including covered information, except when another
entity purchases, merges with, or acquires the operator or the operator declares bankruptcy,
provided the operator, successor entity, or creditor remains subject to this section with
respect to previously acquired student information; or
new text end

new text begin (4) disclose covered information unless to:
new text end

new text begin (i) further the K-12 purpose of the site, service, or application, if the recipient of the
covered information that is disclosed under this item (A) does not further disclose the data
unless to allow or improve operability and functionality within the student's classroom or
school and (B) complies with the requirements governing an operator under this section;
new text end

new text begin (ii) ensure legal and regulatory compliance;
new text end

new text begin (iii) respond to or participate in a judicial process;
new text end

new text begin (iv) protect the safety of users or others or the security of the site; or
new text end

new text begin (v) a service provider, if the operator contractually: (A) prohibits the service
provider from using any covered information for any purpose other than providing the
contracted service to, or on behalf of, the operator; (B) prohibits the service provider from
disclosing any covered information provided by the operator to subsequent third parties;
and (C) requires the service provider to implement and maintain reasonable security
procedures and practices applicable to operators under this section.
new text end

new text begin (b) Nothing in this subdivision prohibits the operator from using information to
maintain, develop, improve, or diagnose its site, service, or application.
new text end

new text begin Subd. 3. new text end

new text begin Operator duties. new text end

new text begin (a) An operator must:
new text end

new text begin (1) implement and maintain reasonable security procedures and practices appropriate
to the covered information and protect the data from unauthorized access, destruction, use,
modification, or disclosure; and
new text end

new text begin (2) delete a student's covered information under the control of the school or district
at the request of that school or district.
new text end

new text begin (b) Notwithstanding subdivision 2, paragraph (a), clause (4), an operator that
complies with subdivision 2, paragraph (a), clauses (1) to (3), may disclose a student's
covered information:
new text end

new text begin (1) to comply with federal or state law requiring the operator to protect and disclose
the information;
new text end

new text begin (2) for legitimate research purposes required by state or federal law and subject to
the restrictions of the applicable law, or allowed by state or federal law and at the direction
of a school, school district, or state Department of Education, if no covered information is
used to advertise or amass a student profile for other than K-12 school purposes; or
new text end

new text begin (3) to a state or local educational agency, including a school or school district, for
K-12 school purposes, as permitted by state or federal law.
new text end

new text begin Subd. 4. new text end

new text begin De-identified educational data. new text end

new text begin (a) An operator may use students'
de-identified educational data:
new text end

new text begin (1) within the operator's site, service, or application or other sites, services, or
applications owned by the operator to improve educational products; or
new text end

new text begin (2) to demonstrate the effectiveness of the operator's products or services, including
the operator's marketing.
new text end

new text begin (b) An operator may share students' aggregated de-identified student covered
information to develop and improve educational sites, services, or applications.
new text end

new text begin Subd. 5. new text end

new text begin Exceptions. new text end

new text begin (a) This section does not:
new text end

new text begin (1) limit an operator's ability to use students' covered information for adaptive
learning or customized student learning purposes;
new text end

new text begin (2) apply to general audience Internet Web sites, general audience online services,
general audience online applications, or general audience mobile applications, even if
login credentials created for an operator's site, service, or application may be used to
access those general audience sites, services, or applications;
new text end

new text begin (3) limit Internet service providers from providing Internet connectivity to schools
or students and their families;
new text end

new text begin (4) prohibit an operator of an Internet Web site, online service, online application, or
mobile application from marketing educational products directly to parents so long as the
operator's marketing does not result from covered information the operator obtained by
providing services governed by this section;
new text end

new text begin (5) require a provider of an electronic store, gateway, marketplace, or other means of
purchasing or downloading software or applications to review or enforce compliance of
this section on those applications or software;
new text end

new text begin (6) require a provider of an interactive computer service, under United States Code,
title 47, section 230, to review or enforce compliance with this section by third-party
content providers;
new text end

new text begin (7) impede students' ability to download, export, or otherwise save or maintain their
own student-created data or documents; or
new text end

new text begin (8) limit the authority of a law enforcement agency to obtain any content or
information from an operator as authorized by law or subject to a court order.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective for the 2015-2016 school year and
later.
new text end

Sec. 3.

new text begin [13.3203] STUDENTS' DIGITAL DATA PRIVACY RIGHTS.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions; application. new text end

new text begin (a) The terms defined in this section have
the meanings given them for purposes of this act and section 13.32.
new text end

new text begin (b) "Internet Web site, online service, online application, or mobile application
directed to minors" means an Internet Web site, online service, online application, or
mobile application, or some portion thereof, created to reach a predominately minor
audience, and is not intended for a more general adult audience. It does not include an
Internet Web site, online service, online application, or mobile application, or some
portion thereof, that solely refers or links to an Internet Web site, online service, online
application, or mobile application directed to minors through information location tools,
including a directory, index, reference, pointer, or hypertext link.
new text end

new text begin (c) "Marketing or advertising" means, in exchange for monetary compensation, to
communicate to one or more individuals, or to arrange to disseminate to the public a
communication about a product or service, the primary purpose of which is to encourage
recipients of the communication to purchase or use the product or service.
new text end

new text begin (d) "Minor" means a natural person under age 18 enrolled in a K-12 school, school
district, or other local education entity.
new text end

new text begin (e) "Operator" means any person or entity that owns an Internet Web site, online
service, online application, or mobile application. It does not include any third party that
does not own but operates, hosts, or manages an Internet Web site, online service, online
application, or mobile application on the owner's behalf or processes information on
the owner's behalf.
new text end

new text begin (f) "Posted" means content or information about a minor posted by the minor that
another user, whether registered or not, can access through the Internet Web site, online
service, online application, or mobile application.
new text end

new text begin Subd. 2. new text end

new text begin Prohibited marketing and advertising. new text end

new text begin (a) An operator of an Internet
Web site, online service, online application, or mobile application directed to minors
must not market or advertise to minors on its Internet Web site, online service, online
application, or mobile application a product or service listed in paragraph (d).
new text end

new text begin (b) An operator of an Internet Web site, online service, online application, or mobile
application must not market or advertise a product or service to a minor the operator knows
is using its Internet Web site, online service, online application, or mobile application if
the marketing or advertising to that minor is based upon information specific to that minor,
including, but not limited to, the minor's profile, activity, address, or location sufficient
to establish contact with a minor, and excluding the Internet Protocol (IP) address and
product identification numbers for operating a service. To comply with this subdivision,
an operator must act reasonably and in good faith to avoid marketing or advertising under
circumstances prohibited under this section.
new text end

new text begin (c) An operator that directs minors to an Internet Web site, online service, online
application, or mobile application or knows minors use its Internet Web site, online
service, online application, or mobile application, must not knowingly use, disclose, or
compile a minor's personal information to market or advertise products or services to that
minor, or knowingly allow a third party to use, disclose, or compile that minor's personal
information to market or advertise products or services to a minor.
new text end

new text begin (d) The marketing and advertising restrictions described in paragraph (a) apply to:
new text end

new text begin (1) alcoholic beverages;
new text end

new text begin (2) firearms and handguns;
new text end

new text begin (3) ammunition and reloaded ammunition;
new text end

new text begin (4) handgun safety certificates;
new text end

new text begin (5) aerosol containers of paint capable of defacing property;
new text end

new text begin (6) etching cream capable of defacing property;
new text end

new text begin (7) any tobacco, cigarette, cigarette papers, blunt wraps, other tobacco preparation,
or other instrument or paraphernalia for smoking or ingesting tobacco, products prepared
from tobacco, or any controlled substance;
new text end

new text begin (8) BB device;
new text end

new text begin (9) dangerous fireworks;
new text end

new text begin (10) tanning in an ultraviolet tanning device;
new text end

new text begin (11) dietary supplement products containing ephedrine group alkaloids;
new text end

new text begin (12) tickets or shares in a lottery game;
new text end

new text begin (13) body branding;
new text end

new text begin (14) permanent tattooing;
new text end

new text begin (15) drug paraphernalia;
new text end

new text begin (16) electronic cigarettes;
new text end

new text begin (17) obscene matter; and
new text end

new text begin (18) less lethal weapons.
new text end

new text begin Subd. 3. new text end

new text begin Operator compliance; advertising services. new text end

new text begin (a) For marketing or
advertising provided by an advertising service, the operator of an Internet Web site, online
service, online application, or mobile application directed to minors must notify the
advertising service, in the manner required by the advertising service, that the operator's
site, service, or application is directed to minors.
new text end

new text begin (b) An advertising service notified by an operator under paragraph (a) that the
operator's Internet Web site, online service, online application, or mobile application is
directed to minors must not market or advertise a product or service listed in subdivision
2, paragraph (d), on that operator's Internet Web site, online service, online application, or
mobile application.
new text end

new text begin Subd. 4. new text end

new text begin Removing online content about a minor. new text end

new text begin (a) An operator of an Internet
Web site, online service, online application, or mobile application directed to minors or an
operator of an Internet Web site, online service, online application, or mobile application
that knows minors use its Internet Web site, online service, online application, or mobile
application must:
new text end

new text begin (1) permit a minor who is a registered user of the operator's Internet Web site, online
service, online application, or mobile application to remove or, if the operator prefers, ask
the operator to remove, content or information the minor posted on the operator's Internet
Web site, online service, online application, or mobile application;
new text end

new text begin (2) notify a minor who is a registered user of the operator's Internet Web site, online
service, online application, or mobile application that the minor may remove or, if the
operator prefers, ask the operator to remove, content or information the minor posted on
the operator's Internet Web site, online service, online application, or mobile application;
new text end

new text begin (3) clearly inform a minor who is a registered user of the operator's Internet Web
site, online service, online application, or mobile application on how to remove or, if the
operator prefers, ask the operator to remove, content or information the minor posted on the
operator's Internet Web site, online service, online application, or mobile application; and
new text end

new text begin (4) notify a minor who is a registered user of the operator's Internet Web site, online
service, online application, or mobile application that removing content or information
under clause (1) does not ensure that all content or information posted about the minor on
the operator's Internet Web site, online service, online application, or mobile application is
removed.
new text end

new text begin (b) An operator or a third party is not required to erase or otherwise eliminate, or to
enable erasure or elimination of, content or information if:
new text end

new text begin (1) a federal or state law requires the operator or third party to maintain the content
or information;
new text end

new text begin (2) a third party, other than the minor who is a registered user, posted or stored
the content or information on the operator's Internet Web site, online service, online
application, or mobile application, including any content or information the minor posted
that the third party then stored, republished, or reposted;
new text end

new text begin (3) the operator anonymizes the content or information posted by the minor who is a
registered user so the minor cannot be individually identified;
new text end

new text begin (4) the minor who is a registered user does not follow the operator's instructions
under paragraph (a), clause (3), on how to remove or ask the operator to remove content or
information the minor posted on the operator's Internet Web site, online service, online
application, or mobile application; or
new text end

new text begin (5) the minor received compensation or other consideration for providing the content.
new text end

new text begin (c) This section does not limit the authority of a law enforcement agency authorized
by law or a court order to obtain content or information from an operator.
new text end

new text begin (d) An operator complies with this section if:
new text end

new text begin (1) it renders the content or information posted by the minor no longer visible to
other users of the service and the public, even if the content or information remains on the
operator's servers in some form; or
new text end

new text begin (2) despite making the minor's original posting invisible, the posting remains visible
because a third party copied or reposted the content or information in the original posting.
new text end

new text begin (e) This section shall not be construed to require an operator of an Internet Web
site, online service, online application, or mobile application to collect information on
users' ages.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective for the 2015-2016 school year and
later.
new text end

Sec. 4. new text begin SEVERABILITY.
new text end

new text begin The provisions of this act are severable. If any provision of this act or its application
is held invalid, that invalidity shall not affect any other provision or application of the act
that can be given effect without the invalid provision or application.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment.
new text end