1.1 	A bill for an act
1.2 	relating to education; directing the commissioner of education to develop a 
1.3 	detailed plan to ensure the privacy and security of students' personally identifiable 
1.4 	information, including education and workforce data.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. DATA SECURITY PLAN.
 1.7 		Subdivision 1.Plan components. To protect education and related workforce 
1.8 	data on individual students maintained by public schools, school districts, and state 
1.9 	agencies, and consistent with Minnesota Statutes, chapter 13, and sections 116J.401, 
1.10 	120B.11, 120B.12, 120B.30, 120B.31, 120B.35, 120B.36, 124D.49, 124D.52, 124D.861, 
1.11 	125A.085, and 127A.70, subdivision 2, among other student data-related provisions, the 
1.12 	commissioner of education must develop, publish, and oversee a detailed data security 
1.13 	plan combining administrative, physical, and technical safeguards that includes:
1.14 	(1) guidelines for:
1.15 	(i) authorizing access to the Statewide Longitudinal Education Data System and 
1.16 	other data systems containing personally identifiable information on students;
1.17 	(ii) authenticating authorized access to and the processing of personally identifiable 
1.18 	information on students; and
1.19 	(iii) sanctions for employees, contractors, grantees, researchers, and vendors who 
1.20 	fail to comply with the guidelines;
1.21 	(2) minimum privacy compliance standards based on reasonable and enforceable 
1.22 	security measures and practices, including background checks, training opportunities 
1.23 	and resources, physical and technical safeguards, and privacy and security agreements 
1.24 	for employees, contractors, grantees, researchers, and vendors with access to personally 
2.1 	identifiable information on students, among other privacy and security measures and 
2.2 	practices;
2.3 	(3) regular privacy and security compliance audits of the Statewide Longitudinal 
2.4 	Education Data System and other data systems; and
2.5 	(4) data retention, storage, disposal, and security policies and protocols that include:
2.6 	(i) safeguards for protecting, managing, accessing, and destroying students' 
2.7 	personally identifiable data; and
2.8 	(ii) plans, notices, and mitigation procedures for responding to data breaches, among 
2.9 	other such policies and protocols.
2.10 		Subd. 2.Plan costs. The commissioner of education must develop the data security 
2.11 	plan under subdivision 1 using existing Department of Education resources.
2.12 		Subd. 3.Plan implementation. The commissioner of education may not proceed to 
2.13 	implement the data security plan under this section until the plan is approved by law.

2.14 	EFFECTIVE DATE. This section is effective the day following final enactment.