1.1 	A bill for an act
1.2 	relating to education; creating the Student Data Privacy Act; providing penalties;
1.3 	amending Minnesota Statutes 2016, section 13.319, by adding a subdivision; 
1.4 	proposing coding for new law in Minnesota Statutes, chapter 125B.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2016, section 13.319, is amended by adding a subdivision 
1.7 	to read:
1.8 		Subd. 9.Technological devices for students. Sections 125B.30 to 125B.36 regulate 
1.9 	some educational data on students maintained using a software application or obtained from 
1.10 	certain technological devices.

1.11 	Sec. 2. [125B.30] CITATION.
1.12 	Sections 125B.30 to 125B.36 may be cited as the "Student Data Privacy Act."

1.13 	Sec. 3. [125B.31] DEFINITIONS.
1.14 	(a) For the purposes of sections 125B.30 to 125B.36 and consistent with section 13.32, 
1.15 	the following terms have the meanings given them.
1.16 	(b) "Aggregate data" means educational data under section 120B.11, 120B.35, or 
1.17 	127A.70, subdivision 2, paragraph (b), or other data an educational institution collects and 
1.18 	reports at the group, cohort, or institutional level that contains no personally identifiable 
1.19 	student information.
2.1 	(c) "De-identified data" means educational data on students in which personally 
2.2 	identifiable student information is removed or obscured to prevent the unintended disclosure 
2.3 	of a student's identity or other personally identifiable student information.
2.4 	(d) "Education research" means the systematic gathering and study of empirical, 
2.5 	personally identifiable student information to acquire knowledge, answer questions, identify 
2.6 	trends, or improve educational instruction or effectiveness on behalf of an educational 
2.7 	institution.
2.8 	(e) "Educational data" has the meaning given in section 13.32, subdivision 1, paragraph 
2.9 	(a).
2.10 	(f) "Educational institution" means:
2.11 	(1) a nonpublic school under section 123B.41, subdivision 9, excluding a home school;
2.12 	(2) an early learning and care program participating in the quality rating and improvement 
2.13 	system under section 124D.142 or a prekindergarten program under section 124D.151;
2.14 	(3) a public elementary, kindergarten, middle, secondary, or vocational center school 
2.15 	under section 120A.05, subdivision 9, 10a, 11, 13, or 17;
2.16 	(4) a school district under section 120A.05, subdivision 10;
2.17 	(5) a charter school under chapter 124E; or
2.18 	(6) a state or local educational agency authorized to direct or control an educational 
2.19 	institution under clauses (1) to (5).
2.20 	(g) "Eligible student" means a student who is age 18 or older or who is attending a 
2.21 	postsecondary institution.
2.22 	(h) "Law enforcement official" means an officer or employee of a state agency or a 
2.23 	political subdivision, or an agent of the agency or subdivision, authorized by law or an 
2.24 	agreement with an educational institution to investigate or conduct an official inquiry into 
2.25 	a student's possible law violation, to arrest a student, or to prosecute or otherwise conduct 
2.26 	a criminal, civil, or administrative proceeding arising from a student's alleged law violation. 
2.27 	A law enforcement official is not a school employee under paragraph (p).
2.28 	(i) "Location tracking technology" means any hardware, software, or application that 
2.29 	collects or reports data to identify the geophysical location of a technological device.
2.30 	(j) "One-to-one device" means a technological device an educational institution provides 
2.31 	to a student under a one-to-one program.
3.1 	(k) "One-to-one device provider" means a person or entity under contract or other 
3.2 	agreement to provide a one-to-one device to a student or educational institution under a 
3.3 	one-to-one program, and includes any business or nonprofit entity directly or indirectly 
3.4 	owned by the entity providing the one-to-one device.
3.5 	(l) "One-to-one program" means a program under which an educational institution 
3.6 	provides a technological device to a student for overnight or at-home use.
3.7 	(m) "Opt-in agreement" means a verifiable, written or electronically generated, signed 
3.8 	agreement under which a parent, guardian, or eligible student voluntarily grants a school 
3.9 	employee, SIS provider, or one-to-one device provider limited access to personally 
3.10 	identifiable student information.
3.11 	(n) "Parent" means a parent, guardian, or other person having legal custody of a child 
3.12 	as defined in section 120A.22, subdivision 3.
3.13 	(o) "Personally identifiable student information" means educational data on a student 
3.14 	under section 13.32 or Code of Federal Regulations, title 34, section 99.3, when it appears 
3.15 	with direct identifiers, including but not limited to the student's or parent's name, date of 
3.16 	birth, student identification number, address, telephone number, e-mail address, biometric 
3.17 	information, Social Security number, or other information that would allow the student to 
3.18 	be discovered.
3.19 	(p) "School employee" means an individual employed and compensated by an educational 
3.20 	institution who provides education-related services at a physical location owned or leased 
3.21 	by an educational institution or online under section 124D.095 at the direction of an 
3.22 	educational institution.
3.23 	(q) "SIS provider" means an entity that sells, leases, provides, operates, or maintains a 
3.24 	student information system for the benefit of an educational institution.
3.25 	(r) "Student" means a child subject to the compulsory attendance requirements under 
3.26 	section 120A.22 enrolled full time or part time in an educational institution.
3.27 	(s) "Student information system" or "SIS" means a software application or cloud-based 
3.28 	service that allows an educational institution to input, maintain, manage, or retrieve 
3.29 	educational data or personally identifiable student information, including applications to 
3.30 	track or share personally identifiable student information in real time.
3.31 	(t) "Technological device" means any computer, cellular phone, smartphone, digital 
3.32 	camera, video camera, audio recording device, or other electronic device used to create, 
3.33 	store, or transmit information as electronic data.

4.1 	Sec. 4. [125B.32] STUDENT INFORMATION SYSTEMS.
4.2 		Subdivision 1.SIS contracts; requirements; prohibitions. (a) Any contract or other 
4.3 	agreement between an educational institution and an SIS provider under which the SIS 
4.4 	provider sells, leases, provides, operates, or maintains an SIS for the benefit of the educational 
4.5 	institution shall expressly direct the SIS provider to:
4.6 	(1) establish, implement, and maintain appropriate security measures, consistent with 
4.7 	department guidelines and current best practices, to protect educational data and personally 
4.8 	identifiable student information the SIS provider creates, sends, receives, stores, or transmits 
4.9 	to operate the SIS;
4.10 	(2) affirm that all data stored on the SIS is the property of the educational institution 
4.11 	and is not the property of the SIS provider and contain the notice requirements in section 
4.12 	13.05, subdivision 11, when the contract is with a public educational institution;
4.13 	(3) establish and implement policies and procedures to respond to data breaches involving 
4.14 	an unauthorized person or entity  acquiring or accessing personally identifiable student 
4.15 	information on the SIS that, at a minimum:
4.16 	(i) require the SIS provider to provide notice to all affected parties, including parents, 
4.17 	guardians, eligible students, teachers, and school administrators, within 14 days after 
4.18 	discovering the breach by United States mail or e-mail, or if the SIS provider has insufficient 
4.19 	or out-of-date contact information for ten or more individuals, the SIS provider must provide 
4.20 	substitute individual notice by posting the notice on its Web site for at least 90 days:
4.21 	(A) briefly describing the breach, including a description of the educational data the 
4.22 	unauthorized person or entity acquired or accessed, or is reasonably believed to have acquired 
4.23 	or accessed;
4.24 	(B) informing the affected parties about the educational data the SIS provider maintains 
4.25 	on the student;
4.26 	(C) describing the steps affected individuals should take to protect themselves from 
4.27 	potential harm;
4.28 	(D) briefly describing what the SIS provider is doing to investigate the breach, mitigate 
4.29 	the harm, and prevent further breaches; and
4.30 	(E) providing contact information for the SIS provider so affected individuals may obtain 
4.31 	more information; and
4.32 	(ii) satisfy all other applicable notice requirements;
5.1 	(4) permanently delete all data stored on the SIS and destroy all nondigital records 
5.2 	containing any educational data retrieved from the SIS within 30 days after the educational 
5.3 	institution terminates the SIS provider's contract, except where:
5.4 	(i) the SIS provider and the person authorized to sign an opt-in agreement under 
5.5 	subdivision 2 direct the SIS provider to retain educational data, specifically identified data, 
5.6 	or nondigital records for a student's benefit; or
5.7 	(ii) before deleting the stored data, the educational institution directs the terminated SIS 
5.8 	provider to transfer data stored on the SIS to another designated SIS provider at the 
5.9 	educational institution's expense; and
5.10 	(5) comply with all obligations and restrictions applicable to SIS providers in sections 
5.11 	125B.30 to 125B.36.
5.12 	(b) A contract or other agreement under paragraph (a) shall expressly prohibit the SIS 
5.13 	provider from:
5.14 	(1) analyzing, interacting with, sharing, or transferring any educational data or personally 
5.15 	identifiable student information the educational institution transmits to the SIS except as 
5.16 	allowed by the opt-in agreement in subdivision 2, paragraph (b);
5.17 	(2) selling any educational data or personally identifiable student information stored on 
5.18 	or retrieved from the SIS unless the SIS is sold as part of a sale or merger of the SIS 
5.19 	provider's business and the new purchaser or controlling person or entity is subject to sections 
5.20 	125B.30 to 125B.36 and any existing contract or agreement binding successors and assigns;
5.21 	(3) using any educational data or personally identifiable student information stored on 
5.22 	or retrieved from the SIS for marketing or advertising directed at a student, parent, guardian, 
5.23 	or school employee, except under an opt-in agreement signed under subdivision 2; and
5.24 	(4) using any educational data or personally identifiable student information stored on 
5.25 	or retrieved from the SIS to develop a profile of a student or group of students for a 
5.26 	commercial or noneducational purpose.
5.27 		Subd. 2.Opt-in agreements. (a) A valid opt-in agreement shall specifically identify:
5.28 	(1) the educational data on a student contained in the SIS, including student attendance 
5.29 	and disciplinary records, that the SIS provider may access, analyze, interact with, share, or 
5.30 	transfer;
6.1 	(2) the SIS provider authorized to access, analyze, interact with, share, or transfer 
6.2 	educational data in the SIS and what the SIS provider is authorized to do with that educational 
6.3 	data, including allowing:
6.4 	(i) the SIS provider to analyze or interact with the educational data or personally 
6.5 	identifiable student information to meet a contractual obligation to the educational institution 
6.6 	to analyze or interact with the data for an educational purpose;
6.7 	(ii) the educational institution to determine, and document in writing, that sharing specific 
6.8 	educational data or personally identifiable student information is needed to safeguard 
6.9 	students' health or safety;
6.10 	(iii) the SIS provider to de-identify or aggregate educational data or personally identifiable 
6.11 	student information at the request of the educational institution to:
6.12 	(A) enable the educational institution to comply with federal, state, or local reporting 
6.13 	and data-sharing requirements; or
6.14 	(B) undertake education research; or
6.15 	(iv) the SIS provider to access the data to test and improve the value and performance 
6.16 	of the SIS for the educational institution and the SIS provider permanently deletes any 
6.17 	copied data and any data analysis within 60 days after creating the copy or the data analysis;
6.18 	(3) the educational purpose for the SIS to access the educational data; and
6.19 	(4) the individual student subject to the opt-in agreement.
6.20 	(b) The opt-in agreement is valid only if signed by:
6.21 	(1) a parent or guardian, if the student is under age 18; or
6.22 	(2) an eligible student.
6.23 	(c) An opt-in agreement signed under this subdivision may include a provision to 
6.24 	authorize an SIS provider to share or transfer educational data if:
6.25 	(1) the purpose of the transfer is to benefit:
6.26 	(i) an operational, administrative, analytical, or educational function of the educational 
6.27 	institution, including education research; or
6.28 	(ii) the student's education;
6.29 	(2) the opt-in agreement specifically identifies:
6.30 	(i) the educational data to be shared or transferred;
7.1 	(ii) when and with whom the educational data will be shared or transferred; and
7.2 	(iii) the anticipated benefits to the educational institution or student; and
7.3 	(3) the SIS provider includes a record of the educational data to be shared or transferred 
7.4 	prior to the opt-in agreement being signed.
7.5 	(d) Any person or entity that accesses or possesses any educational data or personally 
7.6 	identifiable student information from an SIS provider is subject to the same restrictions and 
7.7 	obligations under this section as the SIS provider providing the educational data or personally 
7.8 	identifiable student information to that person or entity.
7.9 	(e) An opt-in agreement is invalid if it grants general authority to access, analyze, interact 
7.10 	with, share, or transfer educational data or personally identifiable student information in an 
7.11 	SIS.
7.12 	(f) Except as authorized in this section, no SIS provider, school employee, or other 
7.13 	person or entity that receives educational data or personally identifiable student information, 
7.14 	directly or indirectly, from an SIS under an opt-in agreement may share, sell, or otherwise 
7.15 	transfer the information to another person or entity consistent with the requirements in 
7.16 	section 13.05, subdivision 11.
7.17 	(g) A parent, guardian, or eligible student under paragraph (b) may revoke the agreement 
7.18 	at any time by transmitting written notice to the educational institution. The educational 
7.19 	institution must notify the SIS provider within 14 days after receiving the revocation notice.
7.20 	(h) An SIS provider that accesses, analyzes, interacts with, shares, or transfers educational 
7.21 	data or personally identifiable student information to another person or entity must show it 
7.22 	acted under an opt-in agreement signed under this subdivision.
7.23 	(i) An educational institution must not withhold an educational benefit from or penalize 
7.24 	a student, parent, or guardian who does not sign or who revokes an opt-in agreement.
7.25 	(j) An opt-in agreement must be renewed at least annually.
7.26 		Subd. 3.School employees. (a) Subject to written authority from the educational 
7.27 	institution, and for purposes of this subdivision, school employees may access and interact 
7.28 	with educational data and personally identifiable student information on an SIS to perform 
7.29 	their professional duties. To access or interact with educational data or personally identifiable 
7.30 	student information on an SIS, a school employee must receive periodic training to ensure 
7.31 	the school employee understands and can comply with the requirements of this section.
8.1 	(b) A school employee may transfer educational data to the employing educational 
8.2 	institution or another trained school employee only if:
8.3 	(1) the school employee has completed periodic and at least annual training in data 
8.4 	practices under this subdivision and section 125B.35, and for compliance with section 
8.5 	121A.065 and the federal Family Educational Rights and Privacy Act (FERPA);
8.6 	(2) the school employee is a teacher transferring educational data to a district-approved 
8.7 	software application for classroom record keeping or management purposes;
8.8 	(3) any third party with access to the software application is expressly prohibited from 
8.9 	reviewing or interacting with the transferred data; and
8.10 	(4) the teacher deletes the data transferred to the software application within 30 days 
8.11 	after the teacher no longer uses the data for classroom record keeping or management 
8.12 	purposes.
8.13 		Subd. 4.Parent or guardian access to educational data. (a) Consistent with state and 
8.14 	federal data practices law as applied to this subdivision, a parent, guardian, or eligible 
8.15 	student, upon transmitting a written request to an educational institution, may inspect and 
8.16 	review the student's educational data and personally identifiable student information stored 
8.17 	on an SIS. An educational institution must give parents, guardians, and eligible students an 
8.18 	opportunity to correct or remove inaccurate educational data.
8.19 	(b) The right of a parent or guardian to review a minor student's educational record or 
8.20 	other personally identifiable student information does not apply where:
8.21 	(1) the minor student supplied health information to the educational institution; and
8.22 	(2) the responsible authority determines that withholding the data is in the minor student's 
8.23 	best interest under sections 13.02, subdivision 8, and 144.29.
8.24 	(c) When a student is age 18 or older, the rights of a parent or guardian under this 
8.25 	subdivision terminate and the eligible student assumes those rights.
8.26 	(d) An educational institution must:
8.27 	(1) review and respond to requests made under this subdivision within five days after 
8.28 	receiving the request; and
8.29 	(2) provide a parent, guardian, or eligible student a hearing if the educational institution 
8.30 	denies the parent, guardian, or eligible student's request to correct or remove inaccurate 
8.31 	information and, if the school does not amend the record after the hearing, allow the parent, 
8.32 	guardian, or eligible student to insert a statement in the record contesting the information.
9.1 		Subd. 5.Requirements for deleting data in an SIS. An educational institution must 
9.2 	permanently delete all educational data and personally identifiable student information on 
9.3 	a student stored in an SIS within one school year after a student graduates, withdraws, or 
9.4 	is expelled from the educational institution. This provision does not apply to:
9.5 	(1) a student's name and Social Security number;
9.6 	(2) a student's transcript, graduation record, letters of recommendation, and other 
9.7 	information required by a postsecondary institution for admission to the institution or by a 
9.8 	potential employer;
9.9 	(3) educational data and personally identifiable student information that is part of an 
9.10 	ongoing disciplinary, administrative, or judicial action or proceeding;
9.11 	(4) de-identified educational data retained at the request of the educational institution 
9.12 	for education research or analysis; and
9.13 	(5) educational data or personally identifiable student information required by law or a 
9.14 	judicial order or warrant to be retained.
9.15 		Subd. 6.Requirements for deleting physical or digital copies of educational data.
 9.16 	Within 180 days of receiving notice under subdivision 7, an SIS provider or other third 
9.17 	party possessing or controlling educational data or other personally identifiable student 
9.18 	information related to a student's graduation, withdrawal, or expulsion from an educational 
9.19 	institution must permanently destroy or delete all physical or digital copies of the data. This 
9.20 	provision does not apply to:
9.21 	(1) educational data or personally identifiable student information that is part of an 
9.22 	ongoing disciplinary, administrative, or judicial action or proceeding;
9.23 	(2) aggregated or de-identified educational data obtained for education research;
9.24 	(3) educational data or personally identifiable student information required by law or a 
9.25 	judicial order or warrant to be retained; and
9.26 	(4) specifically identified educational data or personally identifiable student information, 
9.27 	where:
9.28 	(i) the person authorized to sign a valid opt-in agreement under subdivision 2, paragraph 
9.29 	(b), requests the data be retained; and
9.30 	(ii) the SIS provider and educational institution agree to retain the data.
9.31 		Subd. 7.Notice to SIS provider and third parties. Within 90 days, an educational 
9.32 	institution must notify its SIS provider when a student graduates, withdraws, or is expelled 
10.1 	from school, and the SIS provider then must immediately notify any third party it allowed 
10.2 	to access that student's education record or personally identifiable student information of 
10.3 	the student's changed status.
10.4 		Subd. 8.Access under law, judicial warrant, or audit. Except as provided under this 
10.5 	section, no person or entity, other than an educational institution, school employee, or SIS 
10.6 	provider shall access or interact with an SIS or SIS data unless authorized by law, under a 
10.7 	judicial warrant, or as part of an educational institution audit.
10.8 		Subd. 9.Directory information permitted. Consistent with section 13.32, subdivision 
10.9 	5, an educational institution may provide directory information to a vendor providing 
10.10 	photographs, class rings, yearbooks or student publications, memorabilia, or other similar 
10.11 	goods or services to students if the vendor agrees in writing:
10.12 	(1) not to sell or transfer the data to any other person or entity;
10.13 	(2) to use the data solely for the purpose for which it was provided; and
10.14 	(3) to destroy the data after using the data for its intended purpose.
10.15 		Subd. 10.Interaction with other law. Nothing in this section supersedes or otherwise 
10.16 	changes the classification of data in chapter 13, or limits any law that enhances privacy 
10.17 	protections to students or otherwise restricts access to students' educational records or 
10.18 	personally identifiable student information.

10.19 	Sec. 5. [125B.33] ONE-TO-ONE PROGRAMS; ACCESS TO DATA.
10.20 		Subdivision 1.General rule; contract. (a) When an educational institution or one-to-one 
10.21 	device provider provides a student with a technological device in a one-to-one program, no 
10.22 	school employee or one-to-one device provider, or their agent, may access or track the 
10.23 	student's one-to-one device, activity, or data, either remotely or in person, except as consistent 
10.24 	with this section.
10.25 	(b) Any contract or other agreement between an educational institution and a one-to-one 
10.26 	device provider for a one-to-one provider to provide one-to-one devices for the benefit of 
10.27 	the educational institution shall:
10.28 	(1) affirm that the student's educational data on the devices are the property of the student 
10.29 	and the educational institution and not the property of the one-to-one device provider;
10.30 	(2) contain the notice requirements in section 13.05, subdivision 11, when the contract 
10.31 	is with a public educational institution; and
11.1 	(3) prohibit the sale, sharing, or use of educational data or personally identifiable student 
11.2 	information in violation of sections 125B.30 to 125B.36.
11.3 		Subd. 2.Exceptions. No school employee or one-to-one device provider, or their agent, 
11.4 	may access any data such as the browser, keystroke, or location history the student inputs 
11.5 	into, stores upon, or sends or receives on the student's one-to-one device, nor may the school 
11.6 	employee or one-to-one device provider analyze, interact with, share, or transfer such data 
11.7 	except when:
11.8 	(1) the data is de-identified or aggregate data;
11.9 	(2) the school employee accessing the data:
11.10 	(i) is the student's teacher;
11.11 	(ii) is receiving or reviewing the information for an educational purpose consistent with 
11.12 	the teacher's professional duties; and
11.13 	(iii) does not use the information or permit another person or entity to use the information 
11.14 	for any other purpose;
11.15 	(3) a school employee or one-to-one device provider, or their agent, is authorized to 
11.16 	access the educational data under an opt-in agreement under subdivision 9;
11.17 	(4) a school employee reasonably suspects the student violated or is violating a law or 
11.18 	a school rule and data on the one-to-one device contains evidence of the suspected violation, 
11.19 	subject to the following limitations:
11.20 	(i) before searching a student's one-to-one device, the school employee must document 
11.21 	the basis for the reasonable suspicion and notify the student and the student's parent or legal 
11.22 	guardian of the suspected violation and what data will be accessed in searching for evidence 
11.23 	of the violation. An educational institution, consistent with other law, may seize a student's 
11.24 	one-to-one device to prevent the student from deleting data pending parent notification if:
11.25 	(A) the prenotification seizure period does not exceed 48 hours; and
11.26 	(B) the school employee securely stores the one-to-one device on educational institution 
11.27 	property and does not access it during the prenotification seizure period;
11.28 	(ii) searches of a student's one-to-one device are strictly limited to finding evidence of 
11.29 	the suspected violation and must immediately cease when the school employee finds evidence 
11.30 	of the suspected violation. A school employee who copies, shares, or transfers any data or 
11.31 	any other student information unrelated to the suspected violation violates this item; and
12.1 	(iii) when a student is suspected of illegal conduct, no school employee or law 
12.2 	enforcement official may search the one-to-one device without first securing a judicial 
12.3 	warrant under clause (5) even if the student is also suspected of violating another law or 
12.4 	school rule;
12.5 	(5) a school employee or law enforcement official reasonably suspects the student 
12.6 	engaged in or is engaging in illegal conduct, reasonably suspects data on the student's 
12.7 	one-to-one device contain evidence of the suspected illegal conduct, and secures a judicial 
12.8 	warrant to search the device;
12.9 	(6) doing so is needed to update or upgrade a one-to-one device's software, or protect 
12.10 	the device from cyber threats, and access is limited to that purpose;
12.11 	(7) doing so is needed to respond to an imminent threat to life or safety and access is 
12.12 	limited to that purpose. Within 72 hours of accessing a student's data on a one-to-one device 
12.13 	under this clause, the school employee or law enforcement official who accessed the 
12.14 	one-to-one device must provide a written description of the precise threat allowing access 
12.15 	and the data accessed to the educational institution and the eligible student, parent, or 
12.16 	guardian; or
12.17 	(8) the information sent from the one-to-one device is posted on a Web site that:
12.18 	(i) is accessible to the general public; or
12.19 	(ii) is accessible to a specific school employee granted written permission by the eligible 
12.20 	student, parent, or guardian to view the content.
12.21 		Subd. 3.Use of location tracking technology. No law enforcement official, school 
12.22 	employee, or one-to-one device provider, or their agent, may use a student's one-to-one 
12.23 	device's location tracking technology to track a one-to-one device's real-time or historical 
12.24 	location unless:
12.25 	(1) such use is ordered under a judicial warrant;
12.26 	(2) a parent, guardian, or the student to whom the one-to-one device was provided notifies 
12.27 	a school employee or law enforcement official that the one-to-one device is missing or 
12.28 	stolen; or
12.29 	(3) doing so is needed to respond to an imminent threat to life or safety and access is 
12.30 	limited to that purpose. Within 72 hours of accessing the location tracking technology of a 
12.31 	student's one-to-one device, the school employee or law enforcement official who accessed 
12.32 	the one-to-one device must provide a written description of the precise threat allowing 
13.1 	access and the data and features accessed to the educational institution and the eligible 
13.2 	student, parent, or guardian.
13.3 		Subd. 4.No access to audio or video receiving, transmitting, or recording functions; 
13.4 	exceptions. No school employee or one-to-one device provider, or their agent, may activate 
13.5 	or access any audio or video receiving, transmitting, or recording function on a student's 
13.6 	one-to-one device unless:
13.7 	(1) the student initiates a video chat or audio chat with the school employee or one-to-one 
13.8 	device provider;
13.9 	(2) the activation or access is ordered under a judicial warrant; or
13.10 	(3) doing so is needed to respond to an imminent threat to life or safety and access is 
13.11 	limited to that purpose. Within 72 hours of accessing the audio or video receiving, 
13.12 	transmitting, or recording functions of a student's one-to-one device, the school employee 
13.13 	or law enforcement official who accessed the one-to-one device must provide a written 
13.14 	description of the precise threat allowing access and the data and features accessed to the 
13.15 	educational institution and the eligible student, parent, or guardian.
13.16 		Subd. 5.No access to student's password-protected software, Web site accounts, or 
13.17 	applications; exceptions. No school employee or their agent may use a one-to-one device, 
13.18 	or require a student to use a one-to-one device in their presence, to view the student's 
13.19 	password-protected software, Web site accounts, or applications except when:
13.20 	(1) the school employee is a teacher;
13.21 	(2) the student is enrolled in and participating in a class taught by the teacher; and
13.22 	(3) viewing of the one-to-one device serves an educational purpose in that class.
13.23 		Subd. 6.Prohibited uses of educational data. No one-to-one device provider or its 
13.24 	agent may use any educational data stored on or retrieved from a one-to-one device in a 
13.25 	manner inconsistent with an opt-in agreement under subdivision 9 or to:
13.26 	(1) market or provide advertising directed at a student, parent, guardian, or school 
13.27 	employee, except under an opt-in agreement signed under subdivision 9; or
13.28 	(2) develop a student profile for any commercial or other noneducational purpose.
13.29 		Subd. 7.Training required. Notwithstanding other provisions in this section, to 
13.30 	supervise, direct, or participate in a one-to-one program, or to access any one-to-one device 
13.31 	or its data, a school employee must receive periodic and at least annual training under section 
13.32 	125B.35 to ensure the school employee understands and complies with the provisions of 
14.1 	this section, section 121A.065, and the federal Family Educational Rights and Privacy Act 
14.2 	(FERPA).
14.3 		Subd. 8.No sharing of personally identifiable student information; exceptions. No 
14.4 	school employee or one-to-one device provider that obtains or receives educational data 
14.5 	from a one-to-one device may transfer the information except:
14.6 	(1) to another trained school employee and the employee accesses the information as 
14.7 	part of the employee's professional duties; or
14.8 	(2) where a one-to-one device provider is authorized access under an opt-in agreement 
14.9 	signed under subdivision 9.
14.10 		Subd. 9.Opt-in agreements. (a) For purposes of this section, and to the extent applicable, 
14.11 	a valid opt-in agreement must comply with the requirements in section 125B.32, subdivision 
14.12 	2, and must specifically identify:
14.13 	(1) the educational data on the one-to-one device to which access is granted;
14.14 	(2) the school employee or one-to-one device provider authorized to access, analyze, 
14.15 	and interact with the educational data on the one-to-one device;
14.16 	(3) the educational purpose for which the school employee or one-to-one device provider 
14.17 	will access, analyze, and interact with the educational data on the one-to-one device; and
14.18 	(4) the individual student subject to the opt-in agreement.
14.19 	(b) The opt-in agreement is valid only if signed by:
14.20 	(1) a parent or guardian, if the student is under age 18; or
14.21 	(2) an eligible student.
14.22 	(c) An opt-in agreement is invalid if it grants a one-to-one device provider:
14.23 	(1) general authority to access a student's one-to-one device; or
14.24 	(2) authority to collect all educational data or personally identifiable student information 
14.25 	generated by or used in connection with a specific program or application.
14.26 	(d) A parent, guardian, or eligible student under paragraph (b) may revoke an opt-in 
14.27 	agreement at any time by transmitting written notice to an educational institution. An 
14.28 	educational institution must notify all affected parties within 14 days after receiving the 
14.29 	revocation notice.
15.1 	(e) A one-to-one device provider that accesses, analyzes, or interacts with educational 
15.2 	data or personally identifiable student information on a one-to-one device must show it 
15.3 	acted under an opt-in agreement signed under this subdivision.
15.4 	(f) An educational institution must not withhold a one-to-one device or a related 
15.5 	educational benefit, or punish a student, parent, or guardian based upon:
15.6 	(1) a decision by an eligible student, parent, or guardian to not sign, or to revoke, an 
15.7 	opt-in agreement; or
15.8 	(2) a student's refusal to open, close, or maintain an e-mail account or other electronic 
15.9 	communication or social media account with a specific service provider.
15.10 	(g) A one-to-one device provider violates paragraph (f), clause (1), if it requires an 
15.11 	eligible student, parent, or guardian to agree to give the provider access to personally 
15.12 	identifiable student information as a condition of receiving access to the one-to-one device.
15.13 	(h) An opt-in agreement must be renewed at least annually.
15.14 		Subd. 10.No sale, sharing, or transfer of personally identifiable student information; 
15.15 	exception. No school employee or one-to-one device provider, or their agent, who receives 
15.16 	or collects educational data or personally identifiable student information from a one-to-one 
15.17 	device may share, sell, or otherwise transfer such data to another person or entity unless, 
15.18 	in the case of a one-to-one device provider, the information is sold as part of a sale or merger 
15.19 	of the one-to-one device provider's business. Any entity buying educational data or personally 
15.20 	identifiable student information is subject to the same restrictions and obligations under 
15.21 	this section as the one-to-one device provider that acquired or sold the educational data or 
15.22 	personally identifiable student information.
15.23 		Subd. 11.Direct access prohibited; exceptions. Only a student, student's parent or 
15.24 	guardian, educational institution, school employee, or one-to-one device provider subject 
15.25 	to the limitations of this section may access, review, or interact with a one-to-one device 
15.26 	and its data, unless access is otherwise authorized under law, by a judicial warrant, or with 
15.27 	the express permission of the parent, guardian, or eligible student to whom the one-to-one 
15.28 	device is issued.
15.29 		Subd. 12.Return of one-to-one device; data deletion. When a student permanently 
15.30 	returns a one-to-one device to the educational institution or to the one-to-one device provider 
15.31 	who provided it, the educational institution or one-to-one device provider must permanently 
15.32 	delete all data stored on the one-to-one device without otherwise accessing the data on the 
16.1 	one-to-one device and must return the one-to-one device to its default factory settings within 
16.2 	180 days of receiving the one-to-one device.
16.3 		Subd. 13.Personally identifiable educational data; general exceptions. The provisions 
16.4 	of this section on collecting and using educational data or personally identifiable student 
16.5 	information do not apply to a student's information collected by a software program, Web 
16.6 	site, or application that is incidental to the use of that software program, Web site, or 
16.7 	application that was not:
16.8 	(1) preloaded on the one-to-one device unless approved by the district for educational 
16.9 	purposes;
16.10 	(2) the target of a link preloaded on the one-to-one device; and
16.11 	(3) promoted, marketed, or advertised in connection with issuing the one-to-one device.

16.12 	Sec. 6. [125B.34] LIMITATIONS ON USE.
16.13 	Evidence or information obtained or collected in violation of sections 125B.30 to 125B.36 
16.14 	is inadmissible in any civil or criminal trial or legal proceeding, student disciplinary action, 
16.15 	or administrative hearing.

16.16 	Sec. 7. [125B.35] ANNUAL TRAINING REQUIRED TO PROTECT EDUCATIONAL 
16.17 	DATA.
16.18 		Subdivision 1.Training required. Every school district must conduct annual training 
16.19 	sessions for administrative staff, IT directors, teachers, and any other individual with access 
16.20 	to educational data to ensure compliance with the federal Family Educational Rights and 
16.21 	Privacy Act (FERPA) and to prevent any unauthorized access, disclosure, or misuse of 
16.22 	educational data, as defined in United States Code, title 20, section 1232g, and Code of 
16.23 	Federal Regulations, title 34, part 99.
16.24 		Subd. 2.Best practices. Training sessions under subdivision 1 shall include discussion 
16.25 	and materials on FERPA best practices, which may include but are not limited to:
16.26 	(1) maintaining awareness of relevant data privacy laws;
16.27 	(2) maintaining awareness of all online educational services used in the district;
16.28 	(3) maintaining policies to evaluate and approve online educational services;
16.29 	(4) using written contracts governing the use of educational data;
16.30 	(5) maintaining transparency with students and their parents or legal guardians; and
17.1 	(6) considering when parental consent may be appropriate or required under applicable 
17.2 	law.

17.3 	Sec. 8. [125B.36] PENALTIES.
17.4 	(a) Any person or entity that violates sections 125B.30 to 125B.36 is subject to legal 
17.5 	action for damages or equitable relief brought by a person claiming injury to the person or 
17.6 	the person's reputation. A prevailing plaintiff may be awarded equitable relief, special and 
17.7 	general damages, and reasonable attorney fees and costs.
17.8 	(b) Nothing in sections 125B.30 to 125B.36 limits the civil or criminal liability of a 
17.9 	person or entity who violates the federal Family Educational Rights and Privacy Act 
17.10 	(FERPA), as defined in United States Code, title 20, section 1232g, and Code of Federal 
17.11 	Regulations, title 34, part 99, or under the Data Practices Act, section 13.08 or 13.09.

17.12 	Sec. 9. EFFECTIVE DATE.
 17.13 	Sections 1 to 8 are effective January 1, 2018.