Law / United States / 
Minnesota
Educational data: technology providers and school-issued devices
Minn. Stat. § 13.32, subdivisions 13 to 15
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Retention, Breach notice
As of .
What it requires
- If you are a technology provider, that is, a person who contracts with a public educational agency or institution to provide a school-issued device for student use and who creates, receives or maintains educational data under or incidental to the contract, comply with section 13.05, subdivision 11 as if you were a government entity.
- Do not sell, share or disseminate educational data, except as section 13.32 provides or as part of a valid delegation or assignment of your contract, and do not use educational data for any commercial purpose, including marketing or advertising to a student or parent.
- If educational data you maintain are subject to a breach of the security of the data, disclose to the public educational agency or institution all information necessary to fulfill the requirements of section 13.055.
- Unless renewal of the contract is reasonably anticipated, within 90 days of the expiration of the contract destroy or return to the public educational agency or institution all educational data created, received or maintained under or incidental to the contract.
- Have a contract with the public educational agency or institution that requires appropriate security safeguards, including that your employees or contractors have access to educational data only if authorized and only when necessary to fulfill their official duties.
- Do not electronically access or monitor the location-tracking feature of a school-issued device, its audio or visual features, or student interactions with it (including keystrokes and web-browsing activity), except for a noncommercial educational purpose with advance notice, under a judicial warrant, for a missing or stolen device, for an imminent threat to life or safety, to comply with law, or to take part in federal or state funding programs; after access for an imminent threat, notify the student or parent within 72 hours.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 13.09(a) makes a person who willfully violates the provisions of chapter 13 guilty of a misdemeanor.
What this law does
A technology provider is a person who contracts with a public educational agency or institution to provide a school-issued device for student use and who creates, receives or maintains educational data pursuant or incidental to the contract. A technology provider is subject to the provisions of section 13.05, subdivision 11.
Section 13.05, subdivision 11 makes data a private person collects under a government contract subject to chapter 13, and requires the private person to comply as if it were a government entity. A technology provider must not sell, share or disseminate educational data, except as the section provides or as part of a valid delegation or assignment of its contract with a public educational agency or institution.
A technology provider must not use educational data for any commercial purpose, including marketing or advertising to a student or parent. Within 90 days of the expiration of the contract, a technology provider must destroy or return to the public educational agency or institution all educational data created, received or maintained under the contract, unless renewal is reasonably anticipated.
A technology provider whose educational data are subject to a breach of the security of the data must disclose to the public educational agency or institution all information necessary to fulfill the requirements of section 13.055. A government entity or technology provider must not electronically access or monitor a school-issued device's location-tracking feature, its audio or visual features, or student interactions with it, except in the circumstances the subdivision lists.
A postsecondary institution is exempt from subdivisions 13 and 14, and the exemption extends to a technology provider for purposes of a contract with a postsecondary institution. Section 13.09 makes a person who willfully violates the provisions of chapter 13 guilty of a misdemeanor. The section of the session law that added the technology provider definition makes that section effective for the 2022-2023 school year and later.
Section 2 of that session law, which added subdivision 13 of section 13.32, makes that section effective for the 2022-2023 school year and later. Section 3 of that session law, which added subdivision 14 of section 13.32, makes that section effective for the 2022-2023 school year and later. Section 4 of that session law, which added subdivision 15 of section 13.32, makes that section effective for the 2022-2023 school year and later.
When LexLint raises it
When your app profile says your app serves under-18s.