EdLaw
Missouri — data breach notification (RSMo 162.1475 and 407.1500)
RSMo 162.1475 (L. 2018 H.B. 1606, effective 28 August 2018) requires a school district to notify parents, DESE and the state auditor of a breach of students' personal information, and takes its definition of "personal information" from RSMo 407.1500 (L. 2009 H.B. 62, effective 28 August 2009), Missouri's general breach-notification statute. Section 407.1500 binds any "person" — governments included — and requires a person that holds data it does not own to notify the owner immediately on discovering a breach.
Applicability to EdTech
- Vendors notify the district. "Any person that maintains or possesses records or data containing personal information of residents of Missouri that the person does not own or license ... shall notify the owner or licensee of the information of any breach of security immediately following discovery of the breach" (RSMo 407.1500.2(2)). A service holding a district's student data is that person.
- The district notifies families and the state. On a breach of electronic data including a student's personal information, the district sends written notification to the parent or legal guardian (RSMo 162.1475.2) and to DESE and the state auditor (162.1475.3).
- Scope of "personal information". First name or initial and last name combined with a Social Security number, driver's licence or government ID number, financial account credentials, unique electronic identifier or routing code with credentials, medical information or health insurance information (RSMo 407.1500.1(9)). Biometric data is not on the list, so a breach of, for example, voice recordings alone does not trigger these duties.
- Notice to the Attorney General and consumer reporting agencies when more than 1,000 consumers are notified at one time (407.1500.2(8)).
Contents
| Document | Covers |
|---|---|
| DATA-BREACH.md | RSMo 162.1475 and RSMo 407.1500, in full |
Key obligations at a glance
- Holding data for another: notify the owner or licensee immediately on discovering a breach — 407.1500.2(2).
- Owning or licensing data: notify affected consumers without unreasonable delay — 407.1500.2(1).
- School district: notify parents, DESE and the state auditor — 162.1475.2–3.
Enforcement
The Attorney General has exclusive authority to sue for actual damages for a willful and knowing violation of 407.1500 and may seek a civil penalty not exceeding $150,000 per breach or series of similar breaches discovered in a single investigation (RSMo 407.1500.4). Section 162.1475 sets no penalty.
Licence
The corpus reproduces RSMo 162.1475 and 407.1500 verbatim from the Missouri Revisor of Statutes.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
The Revisor's section pages (revisor.mo.gov, read 2026-10-08) end with the footer "©Missouri Legislature, all rights reserved." That notice can cover the site, but not the statutes the General Assembly enacts; the catchlines and session-law credits are the work of the Revisor of Statutes, an office of the Committee on Legislative Research, which is the General Assembly's own agency acting in its legislative duties — the situation Georgia v. Public.Resource.Org held to be outside copyright.
Conditions: none attach to the statute text. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, soft hyphens dropped, a backslash before a list designation's period so Markdown does not renumber it, nothing reworded).
Related
- Missouri — student data in the statewide longitudinal data system (RSMo 161.096) — the student-data governance statute and its vendor-contract terms
- Iowa — personal information security breach protection (Iowa Code ch. 715C) — a neighbouring breach statute that does list biometric data
- Kentucky personal information security (KRS 61.931–61.933) — a breach regime that names a school district's suppliers