HF 2386

as introduced - 89th Legislature (2015 - 2016) Posted on 03/08/2016 04:29pm

A bill for an act
relating to data privacy; providing for protection of a student's personal user
name and password; providing for enforcement; proposing coding for new law
in Minnesota Statutes, chapter 121A.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [121A.80] STUDENT USER NAME AND PASSWORD PRIVACY
PROTECTION.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin (a) As used in this section, the following terms have
the meanings given them.
new text end

new text begin (b) "Personal social media account" means an account with an electronic medium
or service where users may create, share, and view user-generated content, including but
not limited to uploading or downloading videos or still photographs, blogs, video blogs,
podcasts, messages, e-mails, or Internet Web site profiles or locations. Personal social
media account does not include an account opened at an employer's behest, or provided by
an employer, and intended to be used solely on behalf of the employer, or to an account
opened at a school's behest, or provided by a school, and intended to be used solely on
behalf of the school.
new text end

new text begin (c) "Educational institution" means:
new text end

new text begin (1) a private or public school, institution, or school district, or any subdivision
thereof, that offers participants, students, or trainees an organized course of study or
training that is academic, trade-oriented, or preparatory for gainful employment, as well as
school employees and agents acting under the authority or on behalf of an educational
institution; or
new text end

new text begin (2) a state or local educational agency authorized to direct or control an entity listed
in clause (1).
new text end

new text begin (d) "Prospective student" means an applicant for admission to an educational
institution.
new text end

new text begin (e) "Specific content" means data or information on a personal social media account
that is identified with sufficient particularity to:
new text end

new text begin (1) demonstrate prior knowledge of the content's details; and
new text end

new text begin (2) distinguish the content from other data or information on the account with which
it may share similar characteristics.
new text end

new text begin (f) "Student" means any student, participant, or trainee, whether full time or part
time, in an organized course of study at an educational institution.
new text end

new text begin Subd. 2. new text end

new text begin Prohibited disclosure requirements. new text end

new text begin An educational institution shall not:
new text end

new text begin (1) require, request, or coerce a student or prospective student to disclose the user
name and password, password, or any other means of authentication, or provide access
through the user name or password, to a personal social media account;
new text end

new text begin (2) require, request, or coerce a student or prospective student to access a personal
social media account in the presence of a school employee or school volunteer, including
but not limited to a coach, teacher, or school administrator, in a manner that enables the
school employee or school volunteer to observe the contents of the account; or
new text end

new text begin (3) compel a student or prospective student to add anyone, including a coach,
teacher, school administrator, or other school employee or school volunteer, to their list of
contacts associated with a personal social media account or require, request, or otherwise
coerce a student or applicant to change the settings that affect a third party's ability to view
the contents of a personal social networking account.
new text end

new text begin Subd. 3. new text end

new text begin Prohibited educational institution actions. new text end

new text begin An educational institution
shall not:
new text end

new text begin (1) take any action or threaten to take any action to discharge, discipline, prohibit
from participating in curricular or extracurricular activities, or otherwise penalize a student
for a student's refusal to disclose any information specified in subdivision 2, clause (1),
for refusal to take any action specified in subdivision 2, clause (2), or for refusal to add a
coach, teacher, school administrator, or other school employee or school volunteer to their
list of contacts associated with a personal social media account or to change the settings
that affect a third party's ability to view the contents of a personal social media account, as
specified in subdivision 2, clause (3); or
new text end

new text begin (2) fail or refuse to admit any prospective student as a result of the prospective
student's refusal to disclose any information specified in subdivision 2, clause (1), or for
refusal to take any action specified in subdivision 2, clause (2), for refusal to add a coach,
teacher, school administrator, or other school employee or school volunteer to their list
of contacts associated with a personal social media account or to change the settings
that affect a third party's ability to view the contents of a personal social media account,
as specified in subdivision 2, clause (3).
new text end

new text begin Subd. 4. new text end

new text begin Permitted educational institution actions. new text end

new text begin Nothing in this section shall
prevent an educational institution from:
new text end

new text begin (1) accessing information about a student or prospective student that is publicly
available;
new text end

new text begin (2) complying with state and federal laws, rules, and regulations and the rules of
self-regulatory organizations, where applicable;
new text end

new text begin (3) requesting or requiring a student or prospective student to share specific
content that has been reported to the school, without requesting or requiring a student or
prospective student to provide a user name and password, password, or other means of
authentication that provides access to a personal social media account, for the purpose of:
new text end

new text begin (i) ensuring compliance with applicable laws or regulatory requirements; or
new text end

new text begin (ii) investigating an allegation, based on receipt of specific information, of the
unlawful harassment or bullying of another student by the student or prospective student
from whom the content is requested or required;
new text end

new text begin (4) prohibiting a student or prospective student from using a personal social media
account for school purposes; or
new text end

new text begin (5) prohibiting a student or prospective student from accessing or operating a
personal social media account during school hours or while on school property.
new text end

new text begin Subd. 5. new text end

new text begin Inadvertent access. new text end

new text begin If an educational institution inadvertently receives
the user name and password, password, or other means of authentication that provides
access to a personal social media account of an employee, applicant, student, or
prospective student through the use of an otherwise lawful virus scan or firewall that
monitors the educational institution's network or educational institution-provided devices,
the educational institution is not liable for having the information, but may not use the
information to access the personal social media account of the student or prospective
student, may not share the information with anyone, and must delete the information
immediately or as soon as is reasonably practicable.
new text end

new text begin Subd. 6. new text end

new text begin Enforcement. new text end

new text begin (a) Any educational institution, including its employees or
agents, that violates this section shall be subject to legal action for damages or equitable
relief, to be brought by any other person claiming a violation of this section has injured the
person or the person's reputation. A person so injured shall be entitled to actual damages,
including mental pain and suffering endured on account of violation of the provisions of
this section, and reasonable attorney fees and other costs of litigation.
new text end

new text begin (b) Any educational institution employee or agent who violates this section may
be subject to disciplinary proceedings and punishment. For educational institution
employees who are represented under the terms of a collective bargaining agreement, this
section prevails except where it conflicts with the collective bargaining agreement, any
memorandum of agreement or understanding signed pursuant to the collective bargaining
agreement, or any recognized and established practice relative to the members of the
bargaining unit.
new text end

new text begin Subd. 7. new text end

new text begin Severability. new text end

new text begin The provisions in this section are severable. If any part
or provision of this section, or the application of this section to any person, entity, or
circumstance, is held invalid, the remainder of this section, including the application of
the part or provision to other persons, entities, or circumstances, shall not be affected by
the holding and shall continue to have force and effect.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment.
new text end