1.1 	A bill for an act
1.2 	relating to educational data; protecting online student data and establishing 
1.3 	student digital privacy rights;proposing coding for new law in Minnesota 
1.4 	Statutes, chapter 13.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [13.3201] CITATION.
1.7 	Sections 13.3202 and 13.3203 may be cited as the "Student Online Data Protection 
1.8 	and Privacy Act."

1.9 	EFFECTIVE DATE. This section is effective for the 2015-2016 school year and 
1.10 	later.

1.11 	Sec. 2. [13.3202] PROTECTING ONLINE STUDENT DATA.
1.12 		Subdivision 1.Definitions; application. (a) The terms defined in this section have 
1.13 	the meanings given them for purposes of sections 13.32 to 13.3203.
1.14 	(b) "Covered information" means personally identifiable information or materials, 
1.15 	in any media or format, that is:
1.16 	(1) created or provided by the student or the student's parent or guardian to the 
1.17 	operator in the course of using the operator's site, service, or application for K-12 school 
1.18 	purposes;
1.19 	(2) created or provided by an employee or agent of the school or district to the 
1.20 	operator; or
1.21 	(3) gathered by an operator operating a site, service, or application for K-12 school 
1.22 	purposes and describes a student or otherwise identifies a student.
2.1 	(c) "De-identified educational data" means aggregate and anonymous data derived 
2.2 	from individual student data combined with data from a sufficient number of other 
2.3 	students to disguise the attributes of any single student. De-identified educational data 
2.4 	must not identify any individual who is the subject of the data and must not provide a 
2.5 	reasonable basis for identifying any individual who is the subject of the data.
2.6 	(d) "Educational data" means personally identifiable information or materials, in any 
2.7 	media or format, that is:
2.8 	(1) created or provided by a student, or the student's parent or legal guardian, to an 
2.9 	operator in the course of the student's, parent's, or legal guardian's use of the operator's 
2.10 	site, service, or application for K-12 school purposes;
2.11 	(2) created or provided by an employee or agent of the school, school district, or 
2.12 	other local education entity, to an operator; or
2.13 	(3) gathered by an operator through operating a site, service, or application and that 
2.14 	describes or otherwise identifies a student, including, but not limited to, information in 
2.15 	the student's educational record or e-mail; first and last name; home address; telephone 
2.16 	number; e-mail address or other information that allows physical or online contact; 
2.17 	discipline records; test results; special education data; juvenile dependency records; 
2.18 	grades; evaluations; criminal records; medical records; health records; Social Security 
2.19 	number; biometric information; disabilities; socioeconomic information; food purchases; 
2.20 	political affiliations; religious information; text messages; documents; student identifiers; 
2.21 	search activity; photos; voice recordings; or geolocation information.
2.22 	(e) "K-12 school purposes" means purposes that customarily take place at the 
2.23 	direction of the kindergarten through grade 12 school, teacher, school district, or other 
2.24 	local education entity or aid in administering school activities, including, but not limited 
2.25 	to, instruction in the classroom or at home, administrative activities, extended day 
2.26 	activities, and collaboration between students, school personnel, or parents, or that are 
2.27 	for the school's use and benefit.
2.28 	(f) "Online service" means those cloud computing services that must comply with 
2.29 	this section if the services otherwise meet the definition of an operator in paragraph (g).
2.30 	(g) "Operator" means the operator of an Internet Web site, online service, online 
2.31 	application, or mobile application with actual knowledge that the site, service, or 
2.32 	application is designed and marketed for K-12 school purposes.
2.33 		Subd. 2.Prohibited activities. (a) An operator must not:
2.34 	(1) target advertising on the operator's site, service, or application, or on any 
2.35 	other site, service, or application when the targeted advertising is based on any covered 
3.1 	information, including educational data and persistent unique identifiers, the operator 
3.2 	acquired because of the use of that operator's site, service, or application;
3.3 	(2) use information, including persistent unique identifiers, created or gathered by 
3.4 	the operator's site, service, or application, to amass a K-12 student profile except for 
3.5 	K-12 school purposes;
3.6 	(3) sell a student's information, including covered information, except when another 
3.7 	entity purchases, merges with, or acquires the operator or the operator declares bankruptcy, 
3.8 	provided the operator, successor entity, or creditor remains subject to this section with 
3.9 	respect to previously acquired student information; or
3.10 	(4) disclose covered information unless to:
3.11 	(i) further the K-12 purpose of the site, service, or application, if the recipient of the 
3.12 	covered information that is disclosed under this item (A) does not further disclose the data 
3.13 	unless to allow or improve operability and functionality within the student's classroom or 
3.14 	school and (B) complies with the requirements governing an operator under this section;
3.15 	(ii) ensure legal and regulatory compliance;
3.16 	(iii) respond to or participate in a judicial process;
3.17 	(iv) protect the safety of users or others or the security of the site; or
3.18 	(v) a service provider, if the operator contractually: (A) prohibits the service 
3.19 	provider from using any covered information for any purpose other than providing the 
3.20 	contracted service to, or on behalf of, the operator; (B) prohibits the service provider from 
3.21 	disclosing any covered information provided by the operator to subsequent third parties; 
3.22 	and (C) requires the service provider to implement and maintain reasonable security 
3.23 	procedures and practices applicable to operators under this section.
3.24 	(b) Nothing in this subdivision prohibits the operator from using information to 
3.25 	maintain, develop, improve, or diagnose its site, service, or application.
3.26 		Subd. 3.Operator duties. (a) An operator must:
3.27 	(1) implement and maintain reasonable security procedures and practices appropriate 
3.28 	to the covered information and protect the data from unauthorized access, destruction, use, 
3.29 	modification, or disclosure; and
3.30 	(2) delete a student's covered information under the control of the school or district 
3.31 	at the request of that school or district.
3.32 	(b) Notwithstanding subdivision 2, paragraph (a), clause (4), an operator that 
3.33 	complies with subdivision 2, paragraph (a), clauses (1) to (3), may disclose a student's 
3.34 	covered information:
3.35 	(1) to comply with federal or state law requiring the operator to protect and disclose 
3.36 	the information;
4.1 	(2) for legitimate research purposes required by state or federal law and subject to 
4.2 	the restrictions of the applicable law, or allowed by state or federal law and at the direction 
4.3 	of a school, school district, or state Department of Education, if no covered information is 
4.4 	used to advertise or amass a student profile for other than K-12 school purposes; or
4.5 	(3) to a state or local educational agency, including a school or school district, for 
4.6 	K-12 school purposes, as permitted by state or federal law.
4.7 		Subd. 4.De-identified educational data. (a) An operator may use students' 
4.8 	de-identified educational data:
4.9 	(1) within the operator's site, service, or application or other sites, services, or 
4.10 	applications owned by the operator to improve educational products; or
4.11 	(2) to demonstrate the effectiveness of the operator's products or services, including 
4.12 	the operator's marketing.
4.13 	(b) An operator may share students' aggregated de-identified student covered 
4.14 	information to develop and improve educational sites, services, or applications.
4.15 		Subd. 5.Exceptions. (a) This section does not:
4.16 	(1) limit an operator's ability to use students' covered information for adaptive 
4.17 	learning or customized student learning purposes;
4.18 	(2) apply to general audience Internet Web sites, general audience online services, 
4.19 	general audience online applications, or general audience mobile applications, even if 
4.20 	login credentials created for an operator's site, service, or application may be used to 
4.21 	access those general audience sites, services, or applications;
4.22 	(3) limit Internet service providers from providing Internet connectivity to schools 
4.23 	or students and their families;
4.24 	(4) prohibit an operator of an Internet Web site, online service, online application, or 
4.25 	mobile application from marketing educational products directly to parents so long as the 
4.26 	operator's marketing does not result from covered information the operator obtained by 
4.27 	providing services governed by this section;
4.28 	(5) require a provider of an electronic store, gateway, marketplace, or other means of 
4.29 	purchasing or downloading software or applications to review or enforce compliance of 
4.30 	this section on those applications or software;
4.31 	(6) require a provider of an interactive computer service, under United States Code, 
4.32 	title 47, section 230, to review or enforce compliance with this section by third-party 
4.33 	content providers;
4.34 	(7) impede students' ability to download, export, or otherwise save or maintain their 
4.35 	own student-created data or documents; or
5.1 	(8) limit the authority of a law enforcement agency to obtain any content or 
5.2 	information from an operator as authorized by law or subject to a court order.

5.3 	EFFECTIVE DATE. This section is effective for the 2015-2016 school year and 
5.4 	later.

5.5 	Sec. 3. [13.3203] STUDENTS' DIGITAL DATA PRIVACY RIGHTS.
5.6 		Subdivision 1.Definitions; application. (a) The terms defined in this section have 
5.7 	the meanings given them for purposes of this act and section 13.32.
5.8 	(b) "Internet Web site, online service, online application, or mobile application 
5.9 	directed to minors" means an Internet Web site, online service, online application, or 
5.10 	mobile application, or some portion thereof, created to reach a predominately minor 
5.11 	audience, and is not intended for a more general adult audience. It does not include an 
5.12 	Internet Web site, online service, online application, or mobile application, or some 
5.13 	portion thereof, that solely refers or links to an Internet Web site, online service, online 
5.14 	application, or mobile application directed to minors through information location tools, 
5.15 	including a directory, index, reference, pointer, or hypertext link.
5.16 	(c) "Marketing or advertising" means, in exchange for monetary compensation, to 
5.17 	communicate to one or more individuals, or to arrange to disseminate to the public a 
5.18 	communication about a product or service, the primary purpose of which is to encourage 
5.19 	recipients of the communication to purchase or use the product or service.
5.20 	(d) "Minor" means a natural person under age 18 enrolled in a K-12 school, school 
5.21 	district, or other local education entity.
5.22 	(e) "Operator" means any person or entity that owns an Internet Web site, online 
5.23 	service, online application, or mobile application. It does not include any third party that 
5.24 	does not own but operates, hosts, or manages an Internet Web site, online service, online 
5.25 	application, or mobile application on the owner's behalf or processes information on 
5.26 	the owner's behalf.
5.27 	(f) "Posted" means content or information about a minor posted by the minor that 
5.28 	another user, whether registered or not, can access through the Internet Web site, online 
5.29 	service, online application, or mobile application.
5.30 		Subd. 2.Prohibited marketing and advertising. (a) An operator of an Internet 
5.31 	Web site, online service, online application, or mobile application directed to minors 
5.32 	must not market or advertise to minors on its Internet Web site, online service, online 
5.33 	application, or mobile application a product or service listed in paragraph (d).
5.34 	(b) An operator of an Internet Web site, online service, online application, or mobile 
5.35 	application must not market or advertise a product or service to a minor the operator knows 
6.1 	is using its Internet Web site, online service, online application, or mobile application if 
6.2 	the marketing or advertising to that minor is based upon information specific to that minor, 
6.3 	including, but not limited to, the minor's profile, activity, address, or location sufficient 
6.4 	to establish contact with a minor, and excluding the Internet Protocol (IP) address and 
6.5 	product identification numbers for operating a service. To comply with this subdivision, 
6.6 	an operator must act reasonably and in good faith to avoid marketing or advertising under 
6.7 	circumstances prohibited under this section.
6.8 	(c) An operator that directs minors to an Internet Web site, online service, online 
6.9 	application, or mobile application or knows minors use its Internet Web site, online 
6.10 	service, online application, or mobile application, must not knowingly use, disclose, or 
6.11 	compile a minor's personal information to market or advertise products or services to that 
6.12 	minor, or knowingly allow a third party to use, disclose, or compile that minor's personal 
6.13 	information to market or advertise products or services to a minor.
6.14 	(d) The marketing and advertising restrictions described in paragraph (a) apply to: 
6.15 	(1) alcoholic beverages;
6.16 	(2) firearms and handguns;
6.17 	(3) ammunition and reloaded ammunition;
6.18 	(4) handgun safety certificates;
6.19 	(5) aerosol containers of paint capable of defacing property;
6.20 	(6) etching cream capable of defacing property;
6.21 	(7) any tobacco, cigarette, cigarette papers, blunt wraps, other tobacco preparation, 
6.22 	or other instrument or paraphernalia for smoking or ingesting tobacco, products prepared 
6.23 	from tobacco, or any controlled substance;
6.24 	(8) BB device;
6.25 	(9) dangerous fireworks;
6.26 	(10) tanning in an ultraviolet tanning device;
6.27 	(11) dietary supplement products containing ephedrine group alkaloids;
6.28 	(12) tickets or shares in a lottery game;
6.29 	(13) body branding;
6.30 	(14) permanent tattooing;
6.31 	(15) drug paraphernalia;
6.32 	(16) electronic cigarettes;
6.33 	(17) obscene matter; and
6.34 	(18) less lethal weapons. 
6.35 		Subd. 3.Operator compliance; advertising services. (a) For marketing or 
6.36 	advertising provided by an advertising service, the operator of an Internet Web site, online 
7.1 	service, online application, or mobile application directed to minors must notify the 
7.2 	advertising service, in the manner required by the advertising service, that the operator's 
7.3 	site, service, or application is directed to minors.
7.4 	(b) An advertising service notified by an operator under paragraph (a) that the 
7.5 	operator's Internet Web site, online service, online application, or mobile application is 
7.6 	directed to minors must not market or advertise a product or service listed in subdivision 
7.7 	2, paragraph (d), on that operator's Internet Web site, online service, online application, or 
7.8 	mobile application.
7.9 		Subd. 4.Removing online content about a minor. (a) An operator of an Internet 
7.10 	Web site, online service, online application, or mobile application directed to minors or an 
7.11 	operator of an Internet Web site, online service, online application, or mobile application 
7.12 	that knows minors use its Internet Web site, online service, online application, or mobile 
7.13 	application must:
7.14 	(1) permit a minor who is a registered user of the operator's Internet Web site, online 
7.15 	service, online application, or mobile application to remove or, if the operator prefers, ask 
7.16 	the operator to remove, content or information the minor posted on the operator's Internet 
7.17 	Web site, online service, online application, or mobile application;
7.18 	(2) notify a minor who is a registered user of the operator's Internet Web site, online 
7.19 	service, online application, or mobile application that the minor may remove or, if the 
7.20 	operator prefers, ask the operator to remove, content or information the minor posted on 
7.21 	the operator's Internet Web site, online service, online application, or mobile application;
7.22 	(3) clearly inform a minor who is a registered user of the operator's Internet Web 
7.23 	site, online service, online application, or mobile application on how to remove or, if the 
7.24 	operator prefers, ask the operator to remove, content or information the minor posted on the 
7.25 	operator's Internet Web site, online service, online application, or mobile application; and
7.26 	(4) notify a minor who is a registered user of the operator's Internet Web site, online 
7.27 	service, online application, or mobile application that removing content or information 
7.28 	under clause (1) does not ensure that all content or information posted about the minor on 
7.29 	the operator's Internet Web site, online service, online application, or mobile application is 
7.30 	removed.
7.31 	(b) An operator or a third party is not required to erase or otherwise eliminate, or to 
7.32 	enable erasure or elimination of, content or information if:
7.33 	(1) a federal or state law requires the operator or third party to maintain the content 
7.34 	or information;
7.35 	(2) a third party, other than the minor who is a registered user, posted or stored 
7.36 	the content or information on the operator's Internet Web site, online service, online 
8.1 	application, or mobile application, including any content or information the minor posted 
8.2 	that the third party then stored, republished, or reposted;
8.3 	(3) the operator anonymizes the content or information posted by the minor who is a 
8.4 	registered user so the minor cannot be individually identified;
8.5 	(4) the minor who is a registered user does not follow the operator's instructions 
8.6 	under paragraph (a), clause (3), on how to remove or ask the operator to remove content or 
8.7 	information the minor posted on the operator's Internet Web site, online service, online 
8.8 	application, or mobile application; or
8.9 	(5) the minor received compensation or other consideration for providing the content.
8.10 	(c) This section does not limit the authority of a law enforcement agency authorized 
8.11 	by law or a court order to obtain content or information from an operator.
8.12 	(d) An operator complies with this section if:
8.13 	(1) it renders the content or information posted by the minor no longer visible to 
8.14 	other users of the service and the public, even if the content or information remains on the 
8.15 	operator's servers in some form; or
8.16 	(2) despite making the minor's original posting invisible, the posting remains visible 
8.17 	because a third party copied or reposted the content or information in the original posting.
8.18 	(e) This section shall not be construed to require an operator of an Internet Web 
8.19 	site, online service, online application, or mobile application to collect information on 
8.20 	users' ages.

8.21 	EFFECTIVE DATE. This section is effective for the 2015-2016 school year and 
8.22 	later.

8.23 	Sec. 4. SEVERABILITY.
 8.24 	The provisions of this act are severable. If any provision of this act or its application 
8.25 	is held invalid, that invalidity shall not affect any other provision or application of the act 
8.26 	that can be given effect without the invalid provision or application.

8.27 	EFFECTIVE DATE. This section is effective the day following final enactment.