1.1 	A bill for an act
1.2 	relating to privacy; enacting the Uniform Employee and Student Online Privacy 
1.3 	Protection Act;proposing coding for new law as Minnesota Statutes, chapter 13E.
1.4 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.5 	Section 1. [13E.01] SHORT TITLE.
1.6 	This chapter may be cited as the "Uniform Employee and Student Online Privacy 
1.7 	Protection Act."

1.8 	Sec. 2. [13E.02] DEFINITIONS.
1.9 		Subdivision 1.Scope. For purposes of this chapter, the terms defined in this section have 
1.10 	the meanings given them.
1.11 		Subd. 2.Content. "Content" means information, other than log-in information, that is 
1.12 	contained in a protected personal online account, accessible to the account holder, and not 
1.13 	publicly available.
1.14 		Subd. 3.Educational institution. "Educational institution" means a person that provides 
1.15 	students at the postsecondary level an organized program of study or training that is academic, 
1.16 	technical, trade oriented, or preparatory for gaining employment and for which the person 
1.17 	gives academic credit. The term includes:
1.18 	(1) a public or private institution; and
1.19 	(2) an agent or designee of the educational institution.
1.20 		Subd. 4.Electronic. "Electronic" means relating to technology having electrical, digital, 
1.21 	magnetic, wireless, optical, electromagnetic, or similar capabilities.
2.1 		Subd. 5.Employee. "Employee" means an individual who provides services or labor to 
2.2 	an employer in exchange for salary, wages, or the equivalent or, for an unpaid intern, 
2.3 	academic credit or occupational experience. The term includes:
2.4 	(1) a prospective employee who:
2.5 	(i) has expressed to the employer an interest in being an employee; or
2.6 	(ii) has applied to or is applying for employment by, or is being recruited for employment 
2.7 	by, the employer; and
2.8 	(2) an independent contractor.
2.9 		Subd. 6.Employer. "Employer" means a person that provides salary, wages, or the 
2.10 	equivalent to an employee in exchange for services or labor or engages the services or labor 
2.11 	of an unpaid intern. The term includes an agent or designee of the employer.
2.12 		Subd. 7.Log-in information. "Log-in information" means a username and password, 
2.13 	password, or other means or credentials of authentication required to access or control:
2.14 	(1) a protected personal online account; or
2.15 	(2) an electronic device, which the employee's employer or the student's educational 
2.16 	institution has not supplied or paid for in full, that itself provides access to or control over 
2.17 	the account.
2.18 		Subd. 8.Log-in requirement. "Log-in requirement" means a requirement that log-in 
2.19 	information be provided before an online account or electronic device can be accessed or 
2.20 	controlled.
2.21 		Subd. 9.Online. "Online" means accessible by means of a computer network or the 
2.22 	Internet.
2.23 		Subd. 10.Person. "Person" means an individual, estate, business or nonprofit entity, 
2.24 	public corporation, government or governmental subdivision, agency, or instrumentality, 
2.25 	or other legal entity.
2.26 		Subd. 11.Protected personal online account. "Protected personal online account" 
2.27 	means an employee's or student's online account that is protected by a log-in requirement. 
2.28 	The term does not include an online account or the part of an online account:
2.29 	(1) that is publicly available; or
2.30 	(2) that the employer or educational institution has notified the employee or student 
2.31 	might be subject to a request for log-in information or content, and that:
3.1 	(i) the employer or educational institution supplies or pays for in full; or
3.2 	(ii) the employee or student creates, maintains, or uses primarily on behalf of or under 
3.3 	the direction of the employer or educational institution in connection with the employee's 
3.4 	employment or the student's education.
3.5 		Subd. 12.Publicly available. "Publicly available" means available to the general public.
3.6 		Subd. 13.Record. "Record" means information that is inscribed on a tangible medium 
3.7 	or that is stored in an electronic or other medium and is retrievable in perceivable form.
3.8 		Subd. 14.State. "State" means a state of the United States, the District of Columbia, the 
3.9 	United States Virgin Islands, or any territory or insular possession subject to the jurisdiction 
3.10 	of the United States.
3.11 		Subd. 15.Student. "Student" means an individual who participates in an educational 
3.12 	institution's organized program of study or training. The term includes:
3.13 	(1) a prospective student who express to the institution an interest in being admitted to, 
3.14 	applies for admission to, or is being recruited for admission by, the educational institution; 
3.15 	and
3.16 	(2) a parent or legal guardian of a student under the age of 18.

3.17 	Sec. 3. [13E.03] PROTECTION OF EMPLOYEE ONLINE ACCOUNT.
3.18 	(a) Subject to the exceptions in paragraph (b), an employer may not:
3.19 	(1) require, coerce, or request an employee to:
3.20 	(i) disclose the log-in information for the employee's protected personal online account;
3.21 	(ii) disclose the content of the employee's protected personal online account, except that 
3.22 	an employer may request an employee to add the employer to, or not remove the employer 
3.23 	from, the set of persons to whom the employee grants access to the content;
3.24 	(iii) alter the settings of the employee's protected personal online account in a manner 
3.25 	that makes the log-in information for, or content of, the account more accessible to others; 
3.26 	or
3.27 	(iv) access the employee's protected personal online account in the presence of the 
3.28 	employer in a manner that enables the employer to observe the log-in information for or 
3.29 	content of the account; or
3.30 	(2) take, or threaten to take, adverse action against an employee for failure to comply 
3.31 	with:
4.1 	(i) an employer requirement, coercive action, or request that violates clause (1); or
4.2 	(ii) an employer request under clause (1), item (ii), to add the employer to, or not remove 
4.3 	the employer from, the set of persons to which the employee grants access to the content 
4.4 	of a protected personal online account.
4.5 	(b) Nothing in paragraph (a) shall prevent an employer from:
4.6 	(1) accessing information about an employee that is publicly available;
4.7 	(2) complying with a federal or state law, court order, or rule of a self-regulatory 
4.8 	organization established by federal or state law, including a self-regulatory organization 
4.9 	defined in section 3(a)(26) of the Securities and Exchange Act of 1934, United States Code, 
4.10 	title 15, section 78c(a)(26); or
4.11 	(3) requiring or requesting, based on specific facts about the employee's protected 
4.12 	personal online account, access to the content of, but not the log-in information for, the 
4.13 	account in order to:
4.14 	(i) ensure compliance, or investigate noncompliance, with:
4.15 	(A) federal or state law; or
4.16 	(B) an employer prohibition against work-related employee misconduct of which the 
4.17 	employee has reasonable notice, that is in a record, and that was not created primarily to 
4.18 	gain access to a protected personal online account; or
4.19 	(ii) protect against:
4.20 	(A) a threat to safety;
4.21 	(B) a threat to employer information technology or communications technology systems 
4.22 	or to employer property; or
4.23 	(C) disclosure of information in which the employer has a proprietary interest or 
4.24 	information the employer has a legal obligation to keep confidential.
4.25 	(c) An employer that accesses employee content for a purpose specified in paragraph 
4.26 	(b), clause (3):
4.27 	(1) shall attempt reasonably to limit its access to content that is relevant to the specified 
4.28 	purpose;
4.29 	(2) shall use the content only for the specified purpose; and
4.30 	(3) may not alter the content unless necessary to achieve the specified purpose.
5.1 	(d) An employer that acquires the log-in information for an employee's protected personal 
5.2 	online account by means of otherwise lawful technology that monitors the employer's 
5.3 	network, or employer-provided devices, for a network security, data confidentiality, or 
5.4 	system maintenance purpose:
5.5 	(1) may not use the log-in information to access or enable another person to access the 
5.6 	account;
5.7 	(2) shall make a reasonable effort to keep the log-in information secure;
5.8 	(3) unless otherwise provided in clause (4), shall dispose of the log-in information as 
5.9 	soon as, as securely as, and to the extent reasonably practicable; and
5.10 	(4) shall, if the employer retains the log-in information for use in an ongoing investigation 
5.11 	of an actual or suspected breach of computer, network, or data security, make a reasonable 
5.12 	effort to keep the log-in information secure and dispose of it as soon as, as securely as, and 
5.13 	to the extent reasonably practicable after completing the investigation.

5.14 	Sec. 4. [13E.04] PROTECTION OF STUDENT ONLINE ACCOUNT.
5.15 	(a) Subject to the exceptions in paragraph (b), an educational institution may not:
5.16 	(1) require, coerce, or request a student to:
5.17 	(i) disclose the log-in information for the student's protected personal online account;
5.18 	(ii) disclose the content of the student's protected personal online account, except that 
5.19 	an educational institution may request a student to add the educational institution to, or not 
5.20 	remove the educational institution from, the set of persons to whom the student grants access 
5.21 	to the content;
5.22 	(iii) alter the settings of the student's protected personal online account in a manner that 
5.23 	makes the log-in information for or content of the account more accessible to others; or
5.24 	(iv) access the student's protected personal online account in the presence of the 
5.25 	educational institution in a manner that enables the educational institution to observe the 
5.26 	log-in information for or content of the account; or
5.27 	(2) take, or threaten to take, adverse action against a student for failure to comply with:
5.28 	(i) an educational institution requirement, coercive action, or request, that violates clause 
5.29 	(1); or
5.30 	(ii) an educational institution request under paragraph (a), clause (1), item (ii), to add 
5.31 	the educational institution to, or not remove the educational institution from, the set of 
6.1 	persons to which the student grants access to the content of a protected personal online 
6.2 	account.
6.3 	(b) Nothing in paragraph (a) shall prevent an educational institution from:
6.4 	(1) accessing information about a student that is publicly available;
6.5 	(2) complying with a federal or state law, court order, or rule of a self-regulatory 
6.6 	organization established by federal or state law; or
6.7 	(3) requiring or requesting, based on specific facts about the student's protected personal 
6.8 	online account, access to the content of, but not the log-in information for, the account in 
6.9 	order to:
6.10 	(i) ensure compliance, or investigate noncompliance, with:
6.11 	(A) federal or state law; or
6.12 	(B) an educational institution prohibition against education-related student misconduct 
6.13 	of which the student has reasonable notice, that is in a record, and that was not created 
6.14 	primarily to gain access to a protected personal online account; or
6.15 	(ii) protect against:
6.16 	(A) a threat to safety;
6.17 	(B) a threat to educational institution information technology or communications 
6.18 	technology systems or to educational institution property; or
6.19 	(C) disclosure of information in which the educational institution has a proprietary 
6.20 	interest or information the educational institution has a legal obligation to keep confidential.
6.21 	(c) An educational institution that accesses student content for a purpose specified in 
6.22 	paragraph (b), clause (3):
6.23 	(1) shall attempt reasonably to limit its access to content that is relevant to the specified 
6.24 	purpose;
6.25 	(2) shall use the content only for the specified purpose; and
6.26 	(3) may not alter the content unless necessary to achieve the specified purpose.
6.27 	(d) An educational institution that acquires the log-in information for a student's protected 
6.28 	personal online account by means of otherwise lawful technology that monitors the 
6.29 	educational institution's network, or educational-institution-provided devices, for a network 
6.30 	security, data confidentiality, or system maintenance purpose:
7.1 	(1) may not use the log-in information to access or enable another person to access the 
7.2 	account;
7.3 	(2) shall make a reasonable effort to keep the log-in information secure;
7.4 	(3) unless otherwise provided in clause (4), shall dispose of the log-in information as 
7.5 	soon as, as securely as, and to the extent reasonably practicable; and
7.6 	(4) shall, if the educational institution retains the log-in information for use in an ongoing 
7.7 	investigation of an actual or suspected breach of computer, network, or data security, make 
7.8 	a reasonable effort to keep the log-in information secure and dispose of it as soon as, as 
7.9 	securely as, and to the extent reasonably practicable after completing the investigation.

7.10 	Sec. 5. [13E.05] CIVIL ACTION.
7.11 	(a) The attorney general may bring a civil action against an employer or educational 
7.12 	institution for a violation of this chapter. A prevailing attorney general may obtain:
7.13 	(1) injunctive and other equitable relief; and
7.14 	(2) a civil penalty of up to $1,000 for each violation, but not exceeding $100,000 for all 
7.15 	violations caused by the same event.
7.16 	(b) An employee or student may bring a civil action against the individual's employer 
7.17 	or educational institution for a violation of this chapter. A prevailing employee or student 
7.18 	may obtain:
7.19 	(1) injunctive and other equitable relief;
7.20 	(2) actual damages; and
7.21 	(3) costs and reasonable attorney fees.
7.22 	(c) An action under paragraph (a) does not preclude an action under paragraph (b), and 
7.23 	an action under paragraph (b) does not preclude an action under paragraph (a).
7.24 	(d) This chapter does not affect a right or remedy available under law other than this 
7.25 	chapter.

7.26 	Sec. 6. [13E.06] UNIFORMITY OF APPLICATION AND CONSTRUCTION.
7.27 	In applying and construing this chapter, consideration must be given to the need to 
7.28 	promote uniformity of the law with respect to its subject matter among states that enact it.

8.1 	Sec. 7. [13E.07] RELATION TO ELECTRONIC SIGNATURES IN GLOBAL AND 
8.2 	NATIONAL COMMERCE ACT.
8.3 	This chapter modifies, limits, or supersedes the Electronic Signatures in Global and 
8.4 	National Commerce Act, United States Code, title 15, section 7001 et seq., but does not 
8.5 	modify, limit, or supersede section 101(c) of that act, United States Code, title 15, section 
8.6 	7001(c), or authorize electronic delivery of any of the notices described in section 103(b) 
8.7 	of that act, United States Code, title 15, section 7003(b).

8.8 	Sec. 8. [13E.08] SEVERABILITY.
8.9 	If any provision of this chapter or its application to any person or circumstance is held 
8.10 	invalid, the invalidity does not affect other provisions or applications of this chapter which 
8.11 	can be given effect without the invalid provision or application, and to this end the provisions 
8.12 	of this chapter are severable.

8.13 	Sec. 9. EFFECTIVE DATE.
 8.14 	This act is effective August 1, 2017.