1.1 	A bill for an act
1.2 	relating to data privacy; providing for protection of a student's personal user 
1.3 	name and password; providing for enforcement;proposing coding for new law 
1.4 	in Minnesota Statutes, chapter 121A.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [121A.80] STUDENT USER NAME AND PASSWORD PRIVACY 
1.7 	PROTECTION.
1.8 		Subdivision 1.Definitions. (a) As used in this section, the following terms have 
1.9 	the meanings given them.
1.10 	(b) "Personal social media account" means an account with an electronic medium 
1.11 	or service where users may create, share, and view user-generated content, including but 
1.12 	not limited to uploading or downloading videos or still photographs, blogs, video blogs, 
1.13 	podcasts, messages, e-mails, or Internet Web site profiles or locations. Personal social 
1.14 	media account does not include an account opened at an employer's behest, or provided by 
1.15 	an employer, and intended to be used solely on behalf of the employer, or to an account 
1.16 	opened at a school's behest, or provided by a school, and intended to be used solely on 
1.17 	behalf of the school.
1.18 	(c) "Educational institution" means:
1.19 	(1) a private or public school, institution, or school district, or any subdivision 
1.20 	thereof, that offers participants, students, or trainees an organized course of study or 
1.21 	training that is academic, trade-oriented, or preparatory for gainful employment, as well as 
1.22 	school employees and agents acting under the authority or on behalf of an educational 
1.23 	institution; or
2.1 	(2) a state or local educational agency authorized to direct or control an entity listed 
2.2 	in clause (1).
2.3 	(d) "Prospective student" means an applicant for admission to an educational 
2.4 	institution.
2.5 	(e) "Specific content" means data or information on a personal social media account 
2.6 	that is identified with sufficient particularity to:
2.7 	(1) demonstrate prior knowledge of the content's details; and
2.8 	(2) distinguish the content from other data or information on the account with which 
2.9 	it may share similar characteristics.
2.10 	(f) "Student" means any student, participant, or trainee, whether full time or part 
2.11 	time, in an organized course of study at an educational institution.
2.12 		Subd. 2.Prohibited disclosure requirements. An educational institution shall not:
2.13 	(1) require, request, or coerce a student or prospective student to disclose the user 
2.14 	name and password, password, or any other means of authentication, or provide access 
2.15 	through the user name or password, to a personal social media account;
2.16 	(2) require, request, or coerce a student or prospective student to access a personal 
2.17 	social media account in the presence of a school employee or school volunteer, including 
2.18 	but not limited to a coach, teacher, or school administrator, in a manner that enables the 
2.19 	school employee or school volunteer to observe the contents of the account; or
2.20 	(3) compel a student or prospective student to add anyone, including a coach, 
2.21 	teacher, school administrator, or other school employee or school volunteer, to their list of 
2.22 	contacts associated with a personal social media account or require, request, or otherwise 
2.23 	coerce a student or applicant to change the settings that affect a third party's ability to view 
2.24 	the contents of a personal social networking account.
2.25 		Subd. 3.Prohibited educational institution actions. An educational institution 
2.26 	shall not:
2.27 	(1) take any action or threaten to take any action to discharge, discipline, prohibit 
2.28 	from participating in curricular or extracurricular activities, or otherwise penalize a student 
2.29 	for a student's refusal to disclose any information specified in subdivision 2, clause (1), 
2.30 	for refusal to take any action specified in subdivision 2, clause (2), or for refusal to add a 
2.31 	coach, teacher, school administrator, or other school employee or school volunteer to their 
2.32 	list of contacts associated with a personal social media account or to change the settings 
2.33 	that affect a third party's ability to view the contents of a personal social media account, as 
2.34 	specified in subdivision 2, clause (3); or
2.35 	(2) fail or refuse to admit any prospective student as a result of the prospective 
2.36 	student's refusal to disclose any information specified in subdivision 2, clause (1), or for 
3.1 	refusal to take any action specified in subdivision 2, clause (2), for refusal to add a coach, 
3.2 	teacher, school administrator, or other school employee or school volunteer to their list 
3.3 	of contacts associated with a personal social media account or to change the settings 
3.4 	that affect a third party's ability to view the contents of a personal social media account, 
3.5 	as specified in subdivision 2, clause (3).
3.6 		Subd. 4.Permitted educational institution actions. Nothing in this section shall 
3.7 	prevent an educational institution from:
3.8 	(1) accessing information about a student or prospective student that is publicly 
3.9 	available;
3.10 	(2) complying with state and federal laws, rules, and regulations and the rules of 
3.11 	self-regulatory organizations, where applicable;
3.12 	(3) requesting or requiring a student or prospective student to share specific 
3.13 	content that has been reported to the school, without requesting or requiring a student or 
3.14 	prospective student to provide a user name and password, password, or other means of 
3.15 	authentication that provides access to a personal social media account, for the purpose of:
3.16 	(i) ensuring compliance with applicable laws or regulatory requirements; or
3.17 	(ii) investigating an allegation, based on receipt of specific information, of the 
3.18 	unlawful harassment or bullying of another student by the student or prospective student 
3.19 	from whom the content is requested or required;
3.20 	(4) prohibiting a student or prospective student from using a personal social media 
3.21 	account for school purposes; or
3.22 	(5) prohibiting a student or prospective student from accessing or operating a 
3.23 	personal social media account during school hours or while on school property.
3.24 		Subd. 5.Inadvertent access. If an educational institution inadvertently receives 
3.25 	the user name and password, password, or other means of authentication that provides 
3.26 	access to a personal social media account of an employee, applicant, student, or 
3.27 	prospective student through the use of an otherwise lawful virus scan or firewall that 
3.28 	monitors the educational institution's network or educational institution-provided devices, 
3.29 	the educational institution is not liable for having the information, but may not use the 
3.30 	information to access the personal social media account of the student or prospective 
3.31 	student, may not share the information with anyone, and must delete the information 
3.32 	immediately or as soon as is reasonably practicable.
3.33 		Subd. 6.Enforcement. (a) Any educational institution, including its employees or 
3.34 	agents, that violates this section shall be subject to legal action for damages or equitable 
3.35 	relief, to be brought by any other person claiming a violation of this section has injured the 
3.36 	person or the person's reputation. A person so injured shall be entitled to actual damages, 
4.1 	including mental pain and suffering endured on account of violation of the provisions of 
4.2 	this section, and reasonable attorney fees and other costs of litigation.
4.3 	(b) Any educational institution employee or agent who violates this section may 
4.4 	be subject to disciplinary proceedings and punishment. For educational institution 
4.5 	employees who are represented under the terms of a collective bargaining agreement, this 
4.6 	section prevails except where it conflicts with the collective bargaining agreement, any 
4.7 	memorandum of agreement or understanding signed pursuant to the collective bargaining 
4.8 	agreement, or any recognized and established practice relative to the members of the 
4.9 	bargaining unit.
4.10 		Subd. 7.Severability. The provisions in this section are severable. If any part 
4.11 	or provision of this section, or the application of this section to any person, entity, or 
4.12 	circumstance, is held invalid, the remainder of this section, including the application of 
4.13 	the part or provision to other persons, entities, or circumstances, shall not be affected by 
4.14 	the holding and shall continue to have force and effect.

4.15 	EFFECTIVE DATE. This section is effective the day following final enactment.