EdLaw
Missouri — student data in the statewide longitudinal data system (RSMo 161.096)
RSMo 161.096, enacted by L. 2014 H.B. 1490 and effective 28 August 2014, requires the state board of education to adopt a rule on student data accessibility, transparency and accountability in the statewide longitudinal data system run by the Department of Elementary and Secondary Education (DESE). It restricts access to personally identifiable student data, requires a data security plan, requires anti-sale and anti-advertising terms in contracts with private vendors, and bars collection of certain student data, including student biometric information. Missouri has no SOPIPA-style statute binding operators directly (see Meta).
Applicability to EdTech
- Vendor contract terms. DESE must ensure that "any contracts that govern databases, assessments, or instructional supports that include student or redacted data and are outsourced to private vendors include express provisions that safeguard privacy and security, including provisions that prohibit private vendors from selling student data or from using student data in furtherance of advertising, with penalties for noncompliance" (RSMo 161.096.1(6)). The duty sits with the department; vendors meet it as contract terms.
- Contractor access. Access to personally identifiable student data in the statewide system is restricted to listed groups, including "contractors working on behalf of the department who require such access to perform their assigned duties as required by law" (RSMo 161.096.1(2)(a)).
- Biometric data. DESE shall not collect, nor shall school districts report, "Student biometric information" (RSMo 161.096.3(3)). The bar applies to state collection and district reporting, not to a vendor's own processing, but it signals how biometric data is treated in Missouri schools.
- Civil penalties. A violation of the rule by an organization or entity other than a state agency, school board or institution is punishable by civil penalties of up to $1,000, $5,000 on a second violation and $10,000 on subsequent violations involving the same student (RSMo 161.096.5). A private vendor is such an entity.
Contents
| Document | Covers |
|---|---|
| STUDENT-DATA-SYSTEM.md | RSMo 161.096 in full |
Key obligations at a glance
- Contracts outsourcing student data to private vendors must prohibit selling it or using it for advertising, with penalties for noncompliance — 161.096.1(6).
- DESE's data security plan covers access authentication, privacy and security audits, breach planning and notification, retention and disposal, and encryption — 161.096.1(4).
- No state collection or district reporting of student biometric information, political affiliation or religion — 161.096.3.
Enforcement
The Attorney General may investigate, bring a civil action, seek civil penalties and seek injunctive relief, "including but not limited to a prohibition on obtaining personally identifiable information for an appropriate time period" (RSMo 161.096.6); penalty amounts are in 161.096.5. The state board rule the section mandates is not extracted here.
Licence
The corpus reproduces RSMo 161.096 verbatim from the Missouri Revisor of Statutes.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
The Revisor's section pages (revisor.mo.gov, read 2026-10-08) end with the footer "©Missouri Legislature, all rights reserved." That notice can cover the site, but not the statutes the General Assembly enacts; the catchlines and session-law credits are the work of the Revisor of Statutes, an office of the Committee on Legislative Research, which is the General Assembly's own agency acting in its legislative duties — the situation Georgia v. Public.Resource.Org held to be outside copyright.
Conditions: none attach to the statute text. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, soft hyphens dropped, a backslash before a list designation's period so Markdown does not renumber it, nothing reworded).
Related
- Missouri — data breach notification (RSMo 162.1475 and 407.1500) — the breach layer for school districts and for vendors holding data on their behalf
- SDPC supplemental state terms for Missouri — the contract exhibit used in Missouri NDPA agreements
- FERPA — the federal layer named in 161.096.1(2) and 161.096.1(6)