Minnesota — educational data and technology providers (Minn. Stat. §13.32, subds. 1, 3, 13–15; §13.05, subd. 11)

(a) "Educational data" means data on individuals maintained by a public educational agency or institution or by a person acting for the agency or institution which relates to a student.

(b) "Juvenile justice system" includes criminal justice agencies and the judiciary when involved in juvenile justice activities.

(c) "Parent" means a parent of a student and includes a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian.

(d) "School-issued device" means hardware or software that a public educational agency or institution, acting independently or with a technology provider, provides to an individual student for that student's dedicated personal use. A school-issued device includes a device issued through a one-to-one program.

(e) "Student" means an individual currently or formerly enrolled or registered, applicants for enrollment or registration at a public educational agency or institution, or individuals who receive shared time educational services from a public agency or institution.

(f) "Substitute teacher" means an individual who performs on a temporary basis the duties of the individual who made the record, but does not include an individual who permanently succeeds to the position of the maker of the record.

(g) "Technology provider" means a person who:

(a) pursuant to section 13.05;

(b) pursuant to a valid court order;

(c) pursuant to a statute specifically authorizing access to the private data;

(d) to disclose information in health, including mental health, and safety emergencies pursuant to the provisions of United States Code, title 20, section 1232g(b)(1)(I), and Code of Federal Regulations, title 34, section 99.36;

(e) pursuant to the provisions of United States Code, title 20, sections 1232g(b)(1), (b)(4)(A), (b)(4)(B), (b)(1)(B), (b)(3), (b)(6), (b)(7), and (i), and Code of Federal Regulations, title 34, sections 99.31, 99.32, 99.33, 99.34, 99.35, and 99.39;

(f) to appropriate health authorities to the extent necessary to administer immunization programs and for bona fide epidemiologic investigations which the commissioner of health determines are necessary to prevent disease or disability to individuals in the public educational agency or institution in which the investigation is being conducted;

(g) when disclosure is required for institutions that participate in a program under title IV of the Higher Education Act, United States Code, title 20, section 1092;

(h) to the appropriate school district officials to the extent necessary under subdivision 6, annually to indicate the extent and content of remedial instruction, including the results of assessment testing and academic performance at a postsecondary institution during the previous academic year by a student who graduated from a Minnesota school district within two years before receiving the remedial instruction;

(i) to appropriate authorities as provided in United States Code, title 20, section 1232g(b)(1)(E)(ii), if the data concern the juvenile justice system and the ability of the system to effectively serve, prior to adjudication, the student whose records are released; provided that the authorities to whom the data are released submit a written request for the data that certifies that the data will not be disclosed to any other person except as authorized by law without the written consent of the parent of the student and the request and a record of the release are maintained in the student's file;

(j) to volunteers who are determined to have a legitimate educational interest in the data and who are conducting activities and events sponsored by or endorsed by the educational agency or institution for students or former students;

(k) to provide student recruiting information, from educational data held by colleges and universities, as required by and subject to Code of Federal Regulations, title 32, section 216;

(l) to the juvenile justice system if information about the behavior of a student who poses a risk of harm is reasonably necessary to protect the health or safety of the student or other individuals;

(m) with respect to Social Security numbers of students in the adult basic education system, to Minnesota State Colleges and Universities and the Department of Employment and Economic Development for the purpose and in the manner described in section 124D.52, subdivision 7;

(n) to the commissioner of education for purposes of an assessment or investigation of a report of alleged maltreatment of a student as mandated by chapter 260E. Upon request by the commissioner of education, data that are relevant to a report of maltreatment and are from charter school and school district investigations of alleged maltreatment of a student must be disclosed to the commissioner, including, but not limited to, the following:

(o) when the disclosure is of the final results of a disciplinary proceeding on a charge of a crime of violence or nonforcible sex offense to the extent authorized under United States Code, title 20, section 1232g(b)(6)(A) and (B), and Code of Federal Regulations, title 34, sections 99.31(a)(13) and (14);

(p) when the disclosure is information provided to the institution under United States Code, title 42, section 14071, concerning registered sex offenders to the extent authorized under United States Code, title 20, section 1232g(b)(7);

(q) when the disclosure is to a parent of a student at an institution of postsecondary education regarding the student's violation of any federal, state, or local law or of any rule or policy of the institution, governing the use or possession of alcohol or of a controlled substance, to the extent authorized under United States Code, title 20, section 1232g(i), and Code of Federal Regulations, title 34, section 99.31(a)(15), and provided the institution has an information release form signed by the student authorizing disclosure to a parent. The institution must notify parents and students about the purpose and availability of the information release forms. At a minimum, the institution must distribute the information release forms at parent and student orientation meetings;

(r) a student's name, home address, telephone number, email address, or other personal contact information may be disclosed to a public library for purposes of issuing a library card to the student; or

(s) with federally recognized Tribal Nations about Tribally enrolled or descendant students to the extent necessary for the Tribal Nation and school district or charter school to support the educational attainment of the student.

(a) A technology provider is subject to the provisions of section 13.05, subdivision 11.

(b) All educational data created, received, maintained, or disseminated by a technology provider pursuant or incidental to a contract with a public educational agency or institution are not the technology provider's property.

(c) If educational data maintained by the technology provider are subject to a breach of the security of the data, as defined in section 13.055, the technology provider must, following discovery of the breach, disclose to the public educational agency or institution all information necessary to fulfill the requirements of section 13.055.

(d) Unless renewal of the contract is reasonably anticipated, within 90 days of the expiration of the contract, a technology provider must destroy or return to the appropriate public educational agency or institution all educational data created, received, or maintained pursuant or incidental to the contract.

(e) A technology provider must not sell, share, or disseminate educational data, except as provided by this section or as part of a valid delegation or assignment of its contract with a public educational agency or institution. An assignee or delegee that creates, receives, or maintains educational data is subject to the same restrictions and obligations under this section as the technology provider.

(f) A technology provider must not use educational data for any commercial purpose, including but not limited to marketing or advertising to a student or parent. For purposes of this paragraph, a commercial purpose does not include providing the specific services contracted for by a public educational agency or institution. Nothing in this subdivision prohibits the operator's use of deidentified, aggregate information for improving, maintaining, developing, supporting, or diagnosing the operator's site, service, or operation.

(g) A contract between a technology provider and a public educational agency or institution must include requirements to ensure appropriate security safeguards for educational data. The contract must require that:

(h) Within 30 days of the start of each school year, a public educational agency or institution must give parents and students direct and timely notice, by United States mail, email, or other direct form of communication, of any curriculum, testing, or assessment technology provider contract affecting a student's educational data. The notice must:

(i) A public educational agency or institution must provide parents and students an opportunity to inspect a complete copy of any contract with a technology provider.

(a) Except as provided in paragraph (b), a government entity or technology provider must not electronically access or monitor:

(b) A government entity or technology provider may only engage in activities prohibited by paragraph (a) if:

(c) If a government entity or technology provider interacts with a school-issued device as provided in paragraph (b), clause (4), it must, within 72 hours of the access, notify the student to whom the school-issued device was issued or that student's parent and provide a written description of the interaction, including which features of the device were accessed and a description of the threat. This notice is not required at any time when the notice itself would pose an imminent threat to life or safety, but must instead be given within 72 hours after that imminent threat has ceased.

(a) A postsecondary institution is exempt from subdivisions 13 and 14. This exemption extends to a technology provider for purposes of a contract with a postsecondary institution.

(b) Subdivisions 13 and 14 shall not apply to a nonprofit national assessment provider solely for purposes of providing access to employment, educational scholarships and programs, financial aid, or postsecondary educational opportunities, if the provider secures express digital or written consent of the student or the student's parent or guardian, in response to clear and conspicuous notice.

(a) If a government entity enters into a contract with a private person to perform any of its functions, all of the data created, collected, received, stored, used, maintained, or disseminated by the private person in performing those functions is subject to the requirements of this chapter and the private person must comply with those requirements as if it were a government entity. All contracts entered into by a government entity must include a notice that the requirements of this subdivision apply to the contract. Failure to include the notice in the contract does not invalidate the application of this subdivision. The remedies in section 13.08 apply to the private person under this subdivision.

(b) This subdivision does not create a duty on the part of the private person to provide access to public data to the public if the public data are available from the government entity, except as required by the terms of the contract.