SF 3065

as introduced - 89th Legislature (2015 - 2016) Posted on 03/24/2016 09:58am

A bill for an act
relating to data privacy; providing kindergarten through grade 12 students who
use online computer services for school purposes with privacy of personally
identifiable information; amending Minnesota Statutes 2014, section 13.321,
by adding a subdivision; proposing coding for new law in Minnesota Statutes,
chapter 125B.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2014, section 13.321, is amended by adding a
subdivision to read:

new text begin Subd. 11. new text end

new text begin Student online personal protection. new text end

new text begin Section 125B.30 governs privacy
and information practices of online computer services used by kindergarten through grade
12 students for kindergarten through grade 12 school purposes.
new text end

Sec. 2.

new text begin [125B.30] STUDENT ONLINE PERSONAL PROTECTION.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin (a) For the purposes of this section, the following terms
have the meanings given.
new text end

new text begin (b) "Covered information" means personally identifiable information or material, or
information that is linked to personally identifiable information or material, in any media
or format that is not publicly available and is:
new text end

new text begin (1) created by or provided to an operator by a student, or the student's parent or legal
guardian, in the course of the student's, parent's, or legal guardian's use of the operator's
site, service, or application for kindergarten through grade 12 school purposes;
new text end

new text begin (2) created by or provided to an operator by an employee or agent of a kindergarten
through grade 12 school or school district for kindergarten through grade 12 school
purposes; or
new text end

new text begin (3) gathered by an operator through the operation of its site, service, or application
for kindergarten through grade 12 school purposes and personally identifies a student
including, but not limited to, information in the student's educational record or e-mail,
first and last name, home address, telephone number, e-mail address, or other information
that allows physical or online contact, discipline records, test results, special education
data, juvenile dependency records, grades, evaluations, criminal records, medical records,
health records, Social Security number, biometric information, disabilities, socioeconomic
information, food purchases, political affiliations, religious information, text messages,
documents, student identifiers, search activity, photos, voice recordings, or geolocation
information.
new text end

new text begin (c) "Interactive computer service" means any information service, system, or
access software provider that provides or enables computer access by multiple users
to a computer server, including specifically a service or system that provides access to
the Internet and such systems operated or services offered by libraries or educational
institutions, as defined in United States Code, title 47, section 230.
new text end

new text begin (d) "Kindergarten through grade 12 school" means a school that offers any of grades
kindergarten through 12 and that is operated by a school district.
new text end

new text begin (e) "Kindergarten through grade 12 school purposes" means purposes that are
directed by or that customarily take place at the direction of a kindergarten through grade
12 school, teacher, or school district or aid in the administration of school activities
including, but not limited to, instruction in the classroom or at home, administrative
activities, and collaboration between students, school personnel, or parents, or are
otherwise for the use and benefit of the school.
new text end

new text begin (f) "Operator" means, to the extent that it is operating in this capacity, the operator of
a Web site, online service, online application, or mobile application with actual knowledge
that the site, service, or application is used primarily for kindergarten through grade 12
school purposes and was designed and marketed for kindergarten through grade 12 school
purposes.
new text end

new text begin (g) "School district" means a school district, intermediate school district, or special
district as defined in section 120A.05.
new text end

new text begin (h) "Targeted advertising" means presenting advertisements to a student where
the advertisement is selected based on information obtained or inferred over time from
that student's online behavior, usage of applications, or covered information. It does not
include advertising to a student at an online location based on that student's current visit to
that location, or in response to that student's request for information or feedback, without
the retention of that student's online activities or requests over time for the purpose of
targeting subsequent advertisements.
new text end

new text begin Subd. 2. new text end

new text begin Operator prohibitions; exceptions; limitations. new text end

new text begin (a) An operator shall
not knowingly do any of the following:
new text end

new text begin (1) engage in targeted advertising on the operator's site, service, or application,
or target advertising on any other site, service, or application if the targeting of the
advertising is based on any information, including covered information and persistent
unique identifiers, that the operator has acquired because of the use of that operator's site,
service, or application for kindergarten through grade 12 school purposes;
new text end

new text begin (2) use information, including persistent unique identifiers, created or gathered by
the operator's site, service, or application, to amass a profile about a student except in
furtherance of kindergarten through grade 12 school purposes. "Amass a profile" does not
include the collection and retention of account information that remains under the control
of the student, the student's parent or guardian, or the kindergarten through grade 12 school;
new text end

new text begin (3) sell or rent a student's information, including covered information. This
subdivision does not apply to the purchase, merger, or other type of acquisition of an
operator by another entity if the operator or successor entity complies with this section
regarding previously acquired student information;
new text end

new text begin (4) except as otherwise provided in clause (3), disclose covered information unless
the disclosure is made for the following purposes:
new text end

new text begin (i) in furtherance of the kindergarten through grade 12 school purpose of the site,
service, or application, if the recipient of the covered information disclosed under this
item does not further disclose the information unless done to allow or improve operability
and functionality of the operator's site, service, or application;
new text end

new text begin (ii) to ensure legal and regulatory compliance or protect against liability;
new text end

new text begin (iii) to respond to or participate in the judicial process;
new text end

new text begin (iv) to protect the safety or integrity of users of the site or others or the security of
the site, service, or application;
new text end

new text begin (v) for a school, educational, or employment purpose requested by the student or the
student's parent or guardian, provided that the information is not used or further disclosed
for any other purpose; and
new text end

new text begin (vi) to a third party, if the operator contractually prohibits the third party from using
any covered information for any purpose other than providing the contracted service to or
on behalf of the operator, prohibits the third party from disclosing any covered information
provided by the operator with subsequent third parties, and requires the third party to
implement and maintain reasonable security procedures and practices.
new text end

new text begin Nothing in this paragraph shall prohibit the operator's use of information for
maintaining, developing, supporting, improving, or diagnosing the operator's site, service,
or application.
new text end

new text begin (b) An operator shall do all of the following:
new text end

new text begin (1) implement and maintain reasonable security procedures and practices appropriate
to the nature of the covered information designed to protect the covered information from
unauthorized access, destruction, use, modification, or disclosure; and
new text end

new text begin (2) within a reasonable time period, delete a student's covered information if the
kindergarten through grade 12 school or school district requests deletion of covered
information under the control of the kindergarten through grade 12 school or school
district, unless a student, parent, or guardian consents to the maintenance of the covered
information.
new text end

new text begin (c) An operator may use or disclose covered information of a student under the
following circumstances:
new text end

new text begin (1) if other provisions of state or federal law require the operator to disclose the
information, and the operator complies with the requirements of state and federal law in
protecting and disclosing that information;
new text end

new text begin (2) for legitimate research purposes as required by state or federal law and subject to
the restrictions under applicable state and federal law or as allowed by state or federal
law and under the direction of a kindergarten through grade 12 school, school district, or
Department of Education, if covered information is not used for advertising or to amass
a profile on the student for purposes other than kindergarten through grade 12 school
purposes; and
new text end

new text begin (3) to a state or local educational agency, including kindergarten through grade
12 schools and school districts, for kindergarten through grade 12 school purposes, as
permitted by state or federal law.
new text end

new text begin (d) This section does not prohibit an operator from doing any of the following:
new text end

new text begin (1) using covered information to improve educational products if that information is
not associated with an identified student within the operator's site, service, or application
or other sites, services, or applications owned by the operator;
new text end

new text begin (2) using covered information that is not associated with an identified student to
demonstrate the effectiveness of the operator's products or services, including in their
marketing;
new text end

new text begin (3) sharing covered information that is not associated with an identified student for
the development and improvement of educational sites, services, or applications;
new text end

new text begin (4) using recommendation engines to recommend to a student either of the following:
new text end

new text begin (i) additional content relating to an educational, other learning, or employment
opportunity purpose within an online site, service, or application if the recommendation is
not determined in whole or in part by payment or other consideration from a third party; or
new text end

new text begin (ii) additional services relating to an educational, other learning, or employment
opportunity purpose within an online site, service, or application if the recommendation is
not determined in whole or in part by payment or other consideration from a third party; and
new text end

new text begin (5) responding to a student's request for information or for feedback without the
information or response being determined in whole or in part by payment or other
consideration from a third party.
new text end

new text begin (e) This section does not do any of the following:
new text end

new text begin (1) limit the authority of a law enforcement agency to obtain any content or
information from an operator as authorized by law or under a court order;
new text end

new text begin (2) limit the ability of an operator to use student data, including covered information,
for adaptive learning or customized student learning purposes;
new text end

new text begin (3) apply to general audience Web sites, general audience online services, general
audience online applications, or general audience mobile applications, even if log-in
credentials created for an operator's site, service, or application may be used to access
those general audience sites, services, or applications;
new text end

new text begin (4) limit service providers from providing Internet connectivity to schools or
students and their families;
new text end

new text begin (5) prohibit an operator of a Web site, online service, online application, or mobile
application from marketing educational products directly to parents if the marketing
did not result from the use of covered information obtained by the operator through the
provision of services covered under this section;
new text end

new text begin (6) impose a duty on a provider of an electronic store, gateway, marketplace, or
other means of purchasing or downloading software or applications to review or enforce
compliance with this section on those applications or software;
new text end

new text begin (7) impose a duty on a provider of an interactive computer service to review or
enforce compliance with this section by third-party content providers; or
new text end

new text begin (8) prohibit students from downloading, exporting, transferring, saving, or
maintaining their own student data or documents.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective August 1, 2016.
new text end