1.1 	A bill for an act
1.2 	relating to government data practices; requiring public postsecondary institutions 
1.3 	to keep certain student information private; requiring consent before collecting 
1.4 	student location data;amending Minnesota Statutes 2022, section 13.32, subdivision 
1.5 	5; proposing coding for new law in Minnesota Statutes, chapter 135A.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. Minnesota Statutes 2022, section 13.32, subdivision 5, is amended to read:
1.8 		Subd. 5.Directory information. (a) Information designated as directory information 
1.9 	pursuant to the provisions of United States Code, title 20, section 1232g, and Code of Federal 
1.10 	Regulations, title 34, section 99.37, which are in effect on January 3, 2012, is public data 
1.11 	on individuals, to the extent required under federal law.
1.12 	(b) When conducting the directory information designation and notice process required 
1.13 	by federal law, an educational agency or institution shall give parents and students notice 
1.14 	of the right to refuse to let the agency or institution designate any or all data about the student 
1.15 	as directory information. This notice may be given by any means reasonably likely to inform 
1.16 	the parents and students of the right.
1.17 	(c) A public postsecondary institution must maintain documentation of a request for 
1.18 	directory information on 100 students or more for four years from the date of the request. 
1.19 	A public postsecondary institution's directory information policy must not permit an 
1.20 	individual's e-mail address, physical address, telephone number, or identification card 
1.21 	photograph to be publicly disclosed. A student whose directory information has been 
1.22 	requested must be allowed to review the documentation maintained by the institution 
1.23 	regarding that request.

2.1 	Sec. 2. [135A.146] STUDENT LOCATION DATA.
2.2 		Subdivision 1.Definition. "Technology provider" means a person who:
2.3 	(1) contracts with a public or private postsecondary educational institution to provide 
2.4 	technological devices for student use or to provide access to a software or online application; 
2.5 	and
2.6 	(2) creates, receives, or maintains location data pursuant or incidental to a contract with 
2.7 	a public or private postsecondary educational institution.
2.8 		Subd. 2.Consent. (a) A public or private postsecondary educational institution must 
2.9 	not collect data on a student's location without the student consenting to having location 
2.10 	data collected. A public or private postsecondary educational institution must not require a 
2.11 	student's consent to location data collection as a condition of:
2.12 	(1) enrolling in the institution or any program or class;
2.13 	(2) receiving a scholarship or other financial aid award; or
2.14 	(3) entering into a dining contract, housing contract, or any other agreement for the 
2.15 	provision of a basic university service, including connecting to campus Wi-Fi.
2.16 	(b) A student who gives consent to having location data collected may revoke that consent 
2.17 	at any time.
2.18 		Subd. 3.Notice. (a) Within 30 days of the start of each school year, a public or private 
2.19 	postsecondary educational institution must give students notice, by United States mail, 
2.20 	e-mail, or other direct form of communication, of any technology provider contract gathering 
2.21 	a student's location data. The notice must:
2.22 	(1) be written in plain language;
2.23 	(2) identify each technology provider collecting location data;
2.24 	(3) identify the location data gathered by the technology provider contract;
2.25 	(4) include information about the consent required in subdivision 2, including the right 
2.26 	to revoke consent; and
2.27 	(5) include information about how to access a copy of the contract in accordance with 
2.28 	paragraph (b).
2.29 	(b) A public or private postsecondary educational institution must publish a complete 
2.30 	copy of any contract with a technology provider on the institution's website for the duration 
2.31 	of the contract.
3.1 		Subd. 4.Location data. (a) A technology provider contracting with a public 
3.2 	postsecondary institution is subject to the provisions of section 13.05, subdivision 11. An 
3.3 	assignee or delegate that creates, receives, or maintains location data is subject to the same 
3.4 	restrictions and obligations under this section as the technology provider.
3.5 	(b) Location data created, received, or maintained by a technology provider pursuant or 
3.6 	incidental to a contract with a public or private postsecondary educational institution are 
3.7 	not the technology provider's property.
3.8 	(c) If location data maintained by the technology provider are subject to a breach of the 
3.9 	security of the data, as defined in section 13.055, the technology provider must, following 
3.10 	discovery of the breach, disclose to the public postsecondary educational institution all 
3.11 	information necessary to fulfill the requirements of section 13.055.
3.12 	(d) Within 30 days of the expiration of the contract, unless renewal of the contract is 
3.13 	reasonably anticipated, a technology provider must destroy or return to the appropriate 
3.14 	public or private postsecondary educational institution all location data created, received, 
3.15 	or maintained pursuant or incidental to the contract.
3.16 	(e) A technology provider must not:
3.17 	(1) sell, share, or disseminate location data, except as provided by this section or as part 
3.18 	of a valid delegation or assignment of its contract with a public or private postsecondary 
3.19 	educational institution; or
3.20 	(2) use location data for any commercial purpose, including but not limited to marketing 
3.21 	or advertising to a student or parent.
3.22 		Subd. 5.Procedures. (a) A technology provider must establish written procedures to 
3.23 	ensure appropriate security safeguards are in place for location data. A technology provider's 
3.24 	written procedures must require that:
3.25 	(1) only authorized employees or contractors can access the location data;
3.26 	(2) a person is authorized to access location data only if access is necessary to fulfill 
3.27 	official duties; and
3.28 	(3) all actions in which location data are entered, updated, accessed, shared, or 
3.29 	disseminated are recorded in a log of use that includes the identity of the person interacting 
3.30 	with the data and what action was performed. Information recorded in the log of use must 
3.31 	be retained for at least one year.
4.1 	(b) A technology provider's written procedures establishing security safeguards for 
4.2 	location data are public data, unless classified as not public under any other applicable law.

4.3 	EFFECTIVE DATE. This section is effective July 1, 2023.