1.1 	A bill for an act
1.2 	relating to data privacy; protecting student privacy in data on electronic devices 
1.3 	provided by an educational institution; providing penalties;proposing coding 
1.4 	for new law in Minnesota Statutes, chapter 125B.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [125B.30] DEFINITIONS.
1.7 	(a) For the purposes of sections 125B.30 to 125B.34, the following terms have 
1.8 	the meanings given them.
1.9 	(b) "1-to-1 program" means any program authorized by an educational institution 
1.10 	where a technological device is provided to a student by or through an educational 
1.11 	institution for overnight or at-home use.
1.12 	(c) "1-to-1 device" means a technological device provided to a student pursuant 
1.13 	to a 1-to-1 program.
1.14 	(d) "1-to-1 device provider" means a person or entity that provides a 1-to-1 device 
1.15 	to a student or educational institution pursuant to a 1-to-1 program, and includes any 
1.16 	business or nonprofit entities that share a parent, subsidiary, or sister relationship with 
1.17 	the entity that provides the 1-to-1 device.
1.18 	(e) "Aggregate data" means student-related data collected and reported by an 
1.19 	educational institution at the group, cohort, or institutional level that contains no 
1.20 	personally identifiable student information.
1.21 	(f) "De-identified" means having removed or obscured any personally identifiable 
1.22 	information from personally identifiable student information in a manner that prevents 
1.23 	the unintended disclosure of the identity of the student or information about the student. 
2.1 	Information shall not be considered de-identified if it meets the definition of "personally 
2.2 	identifiable student information" in paragraph (n).
2.3 	(g) "Educational institution" means:
2.4 	(1) a private or public school, institution, or school district, or any subdivision 
2.5 	thereof, that offers participants, students, or trainees an organized course of study or 
2.6 	training that is academic, trade-oriented, or preparatory for gainful employment, as well as 
2.7 	school employees acting under the authority or on behalf of an educational institution; or
2.8 	(2) a state or local educational agency authorized to direct or control an entity in 
2.9 	clause (1).
2.10 	(h) "Educational record" means an educational record as defined by United States 
2.11 	Code, title 20, section 1232g(a)(4), on the effective date of this section.
2.12 	(i) "Education research" means the systematic gathering of empirical information to 
2.13 	advance knowledge, answer questions, identify trends, or improve outcomes within the 
2.14 	field of education.
2.15 	(j) "Elementary school" means the grade levels falling under the definition of 
2.16 	"elementary school," as that term is interpreted by state law for purposes of section 9101 
2.17 	of the Elementary and Secondary Education Act of 1965 (United States Code, title 20, 
2.18 	section 7801 et seq.).
2.19 	(k) "Law enforcement official" means an officer or employee of any agency or 
2.20 	authority of the state of Minnesota, or a political subdivision or agent thereof, who is 
2.21 	empowered by law to investigate or conduct an official inquiry into a potential violation of 
2.22 	law, make arrests, or prosecute or otherwise conduct a criminal, civil, or administrative 
2.23 	proceeding arising from an alleged violation of law.
2.24 	(l) "Location tracking technology" means any hardware, software, or application that 
2.25 	collects or reports data that identifies the geophysical location of a technological device.
2.26 	(m) "Opt-in agreement" means a discrete, verifiable, written, or electronically 
2.27 	generated agreement by which, subject to the provisions of sections 125B.30 to 125B.34, 
2.28 	a student or the student's parent or legal guardian voluntarily grants a school employee, 
2.29 	SIS provider, or 1-to-1 device provider with limited permission to access and interact with 
2.30 	a specifically defined set of personally identifiable student information.
2.31 	(n) "Personally identifiable student information" means one or more of the following:
2.32 	(1) a student's name;
2.33 	(2) the name of a student's parent, legal guardian, or other family member;
2.34 	(3) the address of a student or student's parent, legal guardian, or other family 
2.35 	member;
2.36 	(4) a photograph, video, or audio recording that contains the student's image or voice;
3.1 	(5) indirect identifiers, including but not limited to a student's date of birth, place of 
3.2 	birth, mother's maiden name, Social Security number, student number, biometric record, 
3.3 	telephone number, credit card account number, insurance account number, financial 
3.4 	services account number, customer number, persistent online identifier, e-mail address, 
3.5 	social media address, or other electronic address;
3.6 	(6) any aggregate or de-identified student data that is capable of being disaggregated 
3.7 	or reconstructed to the point that individual students can be identified; and
3.8 	(7) any student data or other information that, alone or in combination, is linked 
3.9 	or linkable to a specific student that would allow a reasonable person who does not 
3.10 	have personal knowledge of the relevant circumstances to identify a specific student 
3.11 	with reasonable certainty.
3.12 	(o) "School employee" means an individual who is employed by an educational 
3.13 	institution, compensated through an annual salary or hourly wage paid by an educational 
3.14 	institution, and whose services are primarily rendered at a physical location that is owned 
3.15 	or leased by that educational institution. For purposes of sections 125B.30 to 125B.34, 
3.16 	individuals with law enforcement or school security responsibilities, including school 
3.17 	resource officers, school district police officers, contract or private security companies, 
3.18 	security guards, or other law enforcement personnel are not school employees.
3.19 	(p) "Student" means any student, participant, or trainee, whether full time or part 
3.20 	time, in an organized course of study at an educational institution.
3.21 	(q) "Student data" means data that is collected and stored by an educational 
3.22 	institution, or by a person or entity acting on behalf of that institution, and included in a 
3.23 	student's educational record.
3.24 	(r) "Technological device" means any computer, cellular phone, smartphone, digital 
3.25 	camera, video camera, audio recording device, or other electronic device that can be used 
3.26 	for creating, storing, or transmitting information in the form of electronic data.

3.27 	Sec. 2. [125B.31] 1-TO-1 PROGRAMS.
3.28 		Subdivision 1.General rule. When an educational institution or 1-to-1 device 
3.29 	provider provides a student with a technological device pursuant to a 1-to-1 program, no 
3.30 	school employee or 1-to-1 device provider, or an agent thereof, may access or track such a 
3.31 	device or the activity or data thereupon, either remotely or in person, except in accordance 
3.32 	with the provisions of this section.
3.33 		Subd. 2.Exceptions. No school employee or 1-to-1 device provider, or an agent 
3.34 	thereof, may access any data input into, stored upon, or sent or received by a student's 
4.1 	1-to-1 device, including but not limited to its browser, keystroke, or location history, nor 
4.2 	may such data be analyzed, interacted with, shared, or transferred unless:
4.3 	(1) the data being collected is not personally identifiable student information;
4.4 	(2) the data is being accessed by or on behalf of a school employee who:
4.5 	(i) is the student's teacher;
4.6 	(ii) is receiving or reviewing the information for an educational purpose consistent 
4.7 	with the teacher's professional duties; and
4.8 	(iii) does not use the information, or permit any other person or entity to use the 
4.9 	information, for any other purpose;
4.10 	(3) a school employee or 1-to-1 device provider or an agent thereof has been 
4.11 	authorized to access specific personally identifiable student information pursuant to an 
4.12 	opt-in agreement under subdivision 9;
4.13 	(4) a school employee has a reasonable suspicion that the student has violated or 
4.14 	is violating an educational institution policy and that data on the 1-to-1 device contains 
4.15 	evidence of the suspected violation, subject to the following limitations:
4.16 	(i) prior to searching a student's 1-to-1 device based on reasonable individualized 
4.17 	suspicion, the school employee shall document the reasonable individualized suspicion 
4.18 	and notify the student and the student's parent or legal guardian of the suspected violation 
4.19 	and what data will be accessed in searching for evidence of the violation. An educational 
4.20 	institution, subject to any other relevant legal restrictions, may seize a student's 1-to-1 
4.21 	device to prevent data deletion pending notification, provided that:
4.22 	(A) the prenotification seizure period is no greater than 48 hours; and 
4.23 	(B) the 1-to-1 device is stored securely on educational institution property and not 
4.24 	accessed during the prenotification seizure period;
4.25 	(ii) searches of a student's device based upon a reasonable individualized suspicion 
4.26 	that an educational institution policy has been violated shall be strictly limited to finding 
4.27 	evidence of the suspected policy violation and shall immediately cease upon finding 
4.28 	sufficient evidence of the suspected violation. It shall be a violation of this item to copy, 
4.29 	share, or transfer any data, or any information thereabout, that is unrelated to the specific 
4.30 	suspected violation which prompted the search of the 1-to-1 device; and
4.31 	(iii) when a student is suspected of illegal conduct, no search of the 1-to-1 device may 
4.32 	occur unless a judicial warrant has been secured according to clause (5) even if the student 
4.33 	is also suspected of a related or unrelated violation of  educational institution policy;
4.34 	(5) a school employee or law enforcement official reasonably suspects the student 
4.35 	has engaged or is engaging in illegal conduct, reasonably suspects data on the 1-to-1 
5.1 	device contains evidence of the suspected illegal conduct, and has secured a judicial 
5.2 	warrant for a search of the device;
5.3 	(6) doing so is necessary to update or upgrade a device's software, or protect the 
5.4 	device from cyberthreats, and access is limited to that purpose;
5.5 	(7) doing so is necessary in response to an imminent threat to life or safety and 
5.6 	access is limited to that purpose. Within 72 hours of accessing a 1-to-1 device's data in 
5.7 	response to an imminent threat to life or safety, the school employee or law enforcement 
5.8 	official who accessed the device shall provide the student whose device was accessed, the 
5.9 	student's parent or legal guardian, and the educational institution with a written description 
5.10 	of the precise threat that prompted the access and what data was accessed; or
5.11 	(8) the information sent from the device is posted on a Web site that:
5.12 	(i) is accessible by the general public; or
5.13 	(ii) is accessible by a specific school employee who was granted permission by 
5.14 	the student to view the content.
5.15 		Subd. 3.Use of location tracking technology. No school employee or 1-to-1 
5.16 	device provider, or an agent thereof, may use a student's 1-to-1 device's location tracking 
5.17 	technology to track a device's real-time or historical location, unless:
5.18 	(1) such use is ordered pursuant to a judicial warrant;  
5.19 	(2) the student to whom the device was provided, or the student's parent or legal 
5.20 	guardian, has notified a school employee or law enforcement official that the device is 
5.21 	missing or stolen; or
5.22 	(3) doing so is necessary in response to an imminent threat to life or safety and 
5.23 	access is limited to that purpose. Within 72 hours of accessing a 1-to-1 device's location 
5.24 	tracking technology in response to an imminent threat to life or safety, the school 
5.25 	employee or law enforcement official who accessed the device shall provide the student 
5.26 	whose device was accessed, the student's parent or legal guardian, and the educational 
5.27 	institution a written description of the precise threat that prompted the access and what 
5.28 	data and features were accessed.
5.29 		Subd. 4.No access to audio or video receiving, transmitting, or recording 
5.30 	functions; exceptions. No school employee or 1-to-1 device provider, or an agent thereof, 
5.31 	may activate or access any audio or video receiving, transmitting, or recording functions 
5.32 	on a student's 1-to-1 device, unless:
5.33 	(1) a student initiates a video chat or audio chat with the school employee or 1-to-1 
5.34 	device provider;
5.35 	(2) the activation or access is ordered pursuant to a judicial warrant; or
6.1 	(3) doing so is necessary in response to an imminent threat to life or safety and 
6.2 	access is limited to that purpose. Within 72 hours of accessing a 1-to-1 device's audio or 
6.3 	video receiving, transmitting, or recording functions in response to an imminent threat 
6.4 	to life or safety, the school employee or law enforcement official who accessed the 
6.5 	device shall provide the student whose device was accessed, the student's parent or legal 
6.6 	guardian, and the educational institution a written description of the precise threat that 
6.7 	prompted the access and what data and features were accessed.
6.8 		Subd. 5.No access to student's password-protected software, Web site accounts, 
6.9 	or applications; exceptions. No school employee, or an agent thereof, may use a 1-to-1 
6.10 	device, or require a student to use a 1-to-1 device in their presence, in order to view or 
6.11 	gain access to a student's password-protected software, Web site accounts or applications, 
6.12 	except where:
6.13 	(1) the school employee is a teacher;
6.14 	(2) the student is enrolled in and participating in a class taught by the teacher; and
6.15 	(3) the viewing of the 1-to-1 device relates exclusively to an educational purpose.
6.16 		Subd. 6.Prohibited uses of student data. No 1-to-1 device provider, or an agent 
6.17 	thereof, may use any student data or personally identifiable student information stored on 
6.18 	or retrieved from a 1-to-1 device to:
6.19 	(1) inform, influence, or direct marketing or advertising efforts directed at a student, 
6.20 	a student's parent or legal guardian, or a school employee, except pursuant to a valid 
6.21 	opt-in agreement; or
6.22 	(2) develop, in full or in part, a student profile for any commercial or other 
6.23 	noneducational purpose.
6.24 		Subd. 7.Training required. Notwithstanding any other provisions in this section, 
6.25 	no school employee may supervise, direct, or participate in a 1-to-1 program, or access 
6.26 	any 1-to-1 device or data thereupon, until the school employee has received adequate 
6.27 	training to ensure the school employee's understanding and compliance with the provisions 
6.28 	of this section.
6.29 		Subd. 8.No sharing of personally identifiable student information; exceptions.
 6.30 	No personally identifiable student information obtained or received from a 1-to-1 device 
6.31 	by a school employee or 1-to-1 device provider may be sold, shared, or otherwise 
6.32 	transferred to another person or entity, except:
6.33 	(1) to another school employee who has satisfied the requirements of subdivision 7 
6.34 	and is accessing the information in furtherance of the employee's professional duties; or
6.35 	(2) where a 1-to-1 device provider has been authorized to do so pursuant to an opt-in 
6.36 	agreement under subdivision 9.
7.1 		Subd. 9.Opt-in agreements. (a) For purposes of this section, a valid opt-in 
7.2 	agreement shall identify, with specificity:
7.3 	(1) the precise subset of personally identifiable student information on the 1-to-1 
7.4 	device to which the authority to access, analyze, and interact is being granted;
7.5 	(2) the name of the school employee or 1-to-1 device provider to whom the authority 
7.6 	to access, analyze, and interact with the personally identifiable student information on the 
7.7 	1-to-1 device is being granted;
7.8 	(3) the educational purpose for which the school employee or 1-to-1 device 
7.9 	provider is being granted the authority to access, analyze, and interact with the personally 
7.10 	identifiable student information on the 1-to-1 device; and
7.11 	(4) the individual student to whom the opt-in agreement applies.
7.12 	(b) An opt-in agreement shall only be valid if it has been signed by:
7.13 	(1) the student's parent or guardian, if the student is in elementary school;
7.14 	(2) the student and the student's parent or legal guardian, if the student has advanced 
7.15 	beyond elementary school but has not yet reached the age of majority; or
7.16 	(3) the student alone, if the student has reached the age of majority.
7.17 	(c) An opt-in agreement shall not be valid if it actually or effectively grants a 1-to-1 
7.18 	device provider:
7.19 	(1) general authority to access a student's 1-to-1 device; or
7.20 	(2) the authority to collect all the personally identifiable student information that is 
7.21 	generated by or used in connection with a specific program or application.
7.22 	(d) An opt-in agreement may be revoked at any time, upon written notice to an 
7.23 	educational institution, by the person eligible to authorize an opt-in agreement pursuant to 
7.24 	paragraph (b). Within 30 days of such a revocation, notice to any affected third parties 
7.25 	shall be made by the educational institution.
7.26 	(e) A 1-to-1 device provider that accesses, analyzes, or interacts with personally 
7.27 	identifiable student information on a 1-to-1 device shall bear the burden of proving that it 
7.28 	acted pursuant to a valid opt-in agreement.
7.29 	(f) No 1-to-1 device program offered to an educational institution or its students 
7.30 	may be conditioned upon the exclusive use of any software, application, Web site, or 
7.31 	Internet-based service sold to or provided by the 1-to-1 device provider.
7.32 	(g) No 1-to-1 device or related educational benefit may be withheld from, or punitive 
7.33 	measure taken against, a student or the student's parent or legal guardian:
7.34 	(1) based in whole or in part upon a decision not to sign, or to revoke, an opt-in 
7.35 	agreement; or
8.1 	(2) based in whole or in part upon a student's refusal to open, close, or maintain an 
8.2 	e-mail or other electronic communications or social media account with a specific service 
8.3 	provider.
8.4 	(h) A 1-to-1 device provider shall violate paragraph (g), clause (1), if it conditions 
8.5 	the offer, provision, or receipt of a 1-to-1 device upon a student's or the student's parent's or 
8.6 	legal guardian's agreement to provide access to personally identifiable student information.
8.7 		Subd. 10.No sale, sharing, or transfer of personally identifiable student 
8.8 	information; exception. No school employee or 1-to-1 device provider, or an agent 
8.9 	thereof, who receives or collects personally identifiable student information from a 1-to-1 
8.10 	device may share, sell or otherwise transfer such data to another person or entity unless, in 
8.11 	the case of a 1-to-1 device provider, such information is sold as part of a sale or merger of 
8.12 	the entirety of the 1-to-1 device provider's business. Any entity that purchases personally 
8.13 	identifiable student information pursuant to subdivision 9, paragraph (c), shall be subject 
8.14 	to the same restrictions and obligations under this section as the 1-to-1 device provider 
8.15 	from which the personally identifiable student information was obtained.
8.16 		Subd. 11.Direct access prohibited; exceptions. No person or entity, other than 
8.17 	an educational institution, school employee, or 1-to-1 device provider subject to the 
8.18 	limitations set forth in this section, shall be provided direct access to review or interact 
8.19 	with a 1-to-1 device and the data thereon, unless otherwise authorized to do so by law, 
8.20 	pursuant to a judicial warrant, or upon the express permission of the student to whom the 
8.21 	1-to-1 device is issued.
8.22 		Subd. 12.Return of 1-to-1 device; erase data. When a 1-to-1 device is 
8.23 	permanently returned by a student, the educational institution or 1-to-1 device provider 
8.24 	who provided it shall, without otherwise accessing the data on the 1-to-1 device, fully 
8.25 	erase all the data stored on the device and return the device to its default factory settings.
8.26 		Subd. 13.Personally identifiable student data; general exceptions. The 
8.27 	provisions of section 125B.32 that relate to the collection and use of personally identifiable 
8.28 	student information shall not apply to personally identifiable student information collected 
8.29 	by a 1-to-1 provider from a software program, Web site or application that was:
8.30 	(1) not preloaded on the 1-to-1 device;
8.31 	(2) not the target of a link that was preloaded on the 1-to-1 device; and
8.32 	(3) not promoted, marketed, or advertised in connection with the issuance of the 
8.33 	1-to-1 device.

8.34 	Sec. 3. [125B.32] LIMITATIONS ON USE.
9.1 	Evidence or information obtained or collected in violation of sections 125B.30 
9.2 	to 125B.34 shall not be admissible in any civil or criminal trial or legal proceeding, 
9.3 	disciplinary action, or administrative hearing.

9.4 	Sec. 4. [125B.33] PENALTIES.
9.5 	(a) Any person or entity who violates sections 125B.30 to 125B.34 shall be subject 
9.6 	to legal action for damages or equitable relief, to be brought by any other person claiming 
9.7 	that a violation of sections 125B.30 to 125B.34 has injured that person or that person's 
9.8 	reputation. A person so injured shall be entitled to actual damages, including mental pain 
9.9 	and suffering endured on account of violation of the provisions of sections 125B.30 to 
9.10 	125B.34, and reasonable attorney fees and other costs of litigation.
9.11 	(b) Any school employee who violates sections 125B.30 to 125B.34, or any 
9.12 	implementing rule or regulation, may be subject to disciplinary proceedings and 
9.13 	punishment. For school employees who are represented under the terms of a collective 
9.14 	bargaining agreement, sections 125B.30 to 125B.34 prevail except where they 
9.15 	conflict with the collective bargaining agreement, any memorandum of agreement or 
9.16 	understanding signed pursuant to the collective bargaining agreement, or any recognized 
9.17 	and established practice relative to the members of the bargaining unit.

9.18 	Sec. 5. [125B.34] SEVERABILITY.
9.19 	The provisions in sections 125B.30 to 125B.34 are severable. If any part or 
9.20 	provision of sections 125B.30 to 125B.34, or the application of sections 125B.30 to 
9.21 	125B.34 to any person, entity, or circumstance, is held invalid, the remainder of sections 
9.22 	125B.30 to 125B.34, including the application of such part or provision to other persons, 
9.23 	entities, or circumstances, shall not be affected by such holding and shall continue to 
9.24 	have force and effect.

9.25 	Sec. 6. EFFECTIVE DATE.
 9.26 	Sections 1 to 5 are effective January 1, 2017.