language: en · status: in-force · last checked: 2026-10-08

Minnesota — educational data and technology providers (Minn. Stat. §13.32; §13.05, subd. 11)

Minnesota has no separate student-privacy act. Its 2022 student data privacy law (Laws 2022, chapter 69) amended §13.32 (Educational data) of the Minnesota Government Data Practices Act (chapter 13). It defined technology provider and school-issued device in subdivision 1 and added subdivision 13 (technology providers), subdivision 14 (school-issued devices) and subdivision 15 (postsecondary exemption). Subdivision 13(a) also makes a technology provider subject to the Act's privatization rule in §13.05, subdivision 11, under which a contractor performing a government function must comply with chapter 13 "as if it were a government entity". This instrument carries those subdivisions together with subdivision 3, the list of permitted disclosures of private educational data. The earliest-enacted section reproduced is §13.32 itself, whose History credit begins "1979 c 328 s 18": Laws 1979, chapter 328, section 18 enacted it (as section 15.1693, "Educational data", with the definition of educational data and the list of permitted disclosures), and section 25 of that chapter made it effective on 1 July 1979; §13.05, subdivision 11 was added only by Laws 1999, chapter 250, article 1, section 42, and chapter 69's subdivisions are "effective for the 2022-2023 school year and later".

Applicability to EdTech

• Who is a technology provider. A person who contracts with a public educational agency or institution "to provide a school-issued device for student use" and creates, receives or maintains educational data under the contract (§13.32, subd. 1(g)). A "school-issued device" is hardware or software the school provides "to an individual student for that student's dedicated personal use", including one-to-one programmes (subd. 1(d)). Whether a shared classroom set, or software used on shared hardware, counts as dedicated personal use is a question to settle per deployment. The definition turns on those words.
• The data are not the provider's property (subd. 13(b)). Unless renewal is reasonably anticipated, the provider must destroy or return all educational data within 90 days of the contract's expiration (subd. 13(d)).
• Breach. After discovering a breach the provider must disclose to the school everything it needs to meet the government breach-notice duties of §13.055 (subd. 13(c)).
• No sale, sharing or commercial use. No sale, sharing or dissemination except as the section allows or by valid assignment, with assignees bound the same way (subd. 13(e)). No commercial use, including marketing or advertising to a student or parent. Providing the contracted services is not a commercial purpose, and de-identified aggregate data may be used to improve the service (subd. 13(f)).
• Contract terms are mandatory: security safeguards, with staff and contractor access only when authorised and necessary for their duties (subd. 13(g)). Parents may inspect a complete copy of any technology provider contract (subd. 13(i)), so the contract will be read by parents as well as the district. Within 30 days of the start of each school year the school must notify parents of each curriculum, testing or assessment technology provider with access to educational data (subd. 13(h)).
• Remote access to a school-issued device is barred by default. A government entity or technology provider must not electronically access or monitor a school-issued device's location tracking, its "audio or visual receiving, transmitting, or recording feature", or student interactions such as keystrokes and browsing (subd. 14(a)), except for the listed purposes, the first being a noncommercial educational purpose for instruction, technical support or exam-proctoring with advance notice (subd. 14(b)). Access for an imminent threat must be reported to the student or parent within 72 hours (subd. 14(c)). Remote device management, a teacher's live view of headsets and voice capture on a device given to one student all fall under this subdivision.
• The whole Data Practices Act follows the contract. Data created or held in performing a government function are subject to chapter 13, the contractor must comply "as if it were a government entity", and the §13.08 remedies apply to it (§13.05, subd. 11(a)).

Contents

Key obligations at a glance

• Educational data are not the provider's property; return or destroy within 90 days of contract end — subd. 13(b), (d).
• Breach information to the school for §13.055 notice — subd. 13(c).
• No sale, sharing or commercial use — subd. 13(e)–(f).
• Contract security terms and need-to-know access — subd. 13(g).
• No remote access to device location, camera, microphone or activity outside the listed exceptions — subd. 14.
• Comply with chapter 13 as a government entity would — §13.05, subd. 11.

Enforcement

Through the privatization rule the remedies of Minn. Stat. §13.08 apply to the contractor (§13.05, subd. 11(a)). §13.08 is reproduced, with the government breach-notice section §13.055, in Minn. Stat. §13.055 and §13.08.

Licence

The corpus reproduces these subdivisions verbatim from the Office of the Revisor of Statutes' publication of the 2025 Minnesota Statutes (read 2026-10-08). The section pages carry no copyright notice.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection." The headnotes and History credits are the Revisor's, an office of the legislature, made in the course of its legislative duties.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, whitespace collapsed, subdivisions selected, nothing reworded).

Related

• Minn. Stat. §13.055 and §13.08 — the breach-notice section subd. 13(c) points to, and the remedies §13.05, subd. 11 applies
• FERPA — the federal disclosures §13.32, subd. 3(e) incorporates by reference
• Illinois SOPPA — another state that requires published vendor lists and inspectable contracts
• California SOPIPA — the operator-binding model, which Minnesota did not adopt

Sources

• Office of the Revisor of Statutes — Minn. Stat. §13.32 (2025)
• Office of the Revisor of Statutes — Minn. Stat. §13.05 (2025)
• Laws of Minnesota 2022, chapter 69 — the session law that added subdivisions 13–15; each section: "This section is effective for the 2022-2023 school year and later"
• Office of the Revisor of Statutes — Laws of Minnesota 1979, chapter 328 — section 18 adds section 15.1693 (Educational data); section 25: "Sections 1 to 6, 8 to 22, and 24 are effective July 1, 1979"; approved 5 June 1979
• Office of the Revisor of Statutes — Laws of Minnesota 1999, chapter 250 — article 1, section 42 adds §13.05, subd. 11 [PRIVATIZATION]