Freshman Rep. Eric Lucero introduced six bills this month that address student data privacy in a number of areas, along with a flurry of other bills that focus on public safety and health and human services. His efforts mirror those of state legislators across the country who are tackling student data privacy for a third year, this time with an emphasis on social media, school-owned devices and non-academic data privacy, said Rachel Anderson, senior associate for policy and advocacy at the Data Quality Campaign, a Washington, D.C.-based advocacy group.
"What's happening in Minnesota is really indicative of where things are going this year," Anderson said.
Before being elected, Lucero scoured the websites of the state's 201 legislators to see how many of them had an information security background. The search turned up nothing. In contrast, Lucero has spent more than a decade in the private industry working on computer security.
Because many legislators don't necessarily understand data privacy and digital security, Lucero and multiple organizations have been sharing information with them since the last session, when the Legislature failed to pass a student data privacy backpack bill.
"Being that I'm in the computer security sector, ensuring data is secure is definitely one of my top priorities, not just in the context of education, but in all contexts," Lucero said.
The six student bills he wrote would bring common security practices from the private sector to government, including stronger user access controls for third parties as well as education institutions. Minnesota and seven other states introduced some student data bills influenced by the American Civil Liberties Union's model legislation — including Alabama, Alaska, Connecticut, Hawaii, Missouri, Nebraska and North Carolina.
Charles Samuelson, executive director of the ACLU of Minnesota, said, "Students have rights, particularly outside of schools and particularly outside of their own devices, and we're trying to get state law to codify that."
Throughout his legislation, Lucero said he has sought to make sure that parents have authority over what's happening to their children's data. For example, HF 2671 would require school districts to obtain written, parental consent 15 to 30 school days before they can ask students to fill out surveys. In writing, the school district would need to tell parents when the survey would take place, what information it would ask for, how it would use the answers and who would access the results. These types of surveys often cover non-academic questions about students' political beliefs, religious practices and sexual behavior.
In an interesting twist, state legislators across the country have introduced bills to crack down on surveys like this, yet the recently passed Every Student Succeeds Act calls for schools to collect more non-academic information, Anderson said. This dichotomy presents a dilemma for states that they will have to deal with.
As more schools provide mobile devices to students, states like Minnesota are trying to deal with the privacy and security concerns that go with them. Under HF 2898, schools and device manufacturers can't track the device's location without a warrant, a missing device report or a potential safety concern, the latter of which requires a written report within 72 hours of the tracking. The bill also doesn't allow them to market or build advertising profiles based on student data.
Along with mobile device concerns, personal social media posts have raised privacy concerns as some schools have disciplined students for off-campus speech. HF 2386 would prohibit education institutions from forcing students to reveal their passwords, show them what's on their personal social media accounts or add them as a friend or follower. They also cannot punish students for refusing to do any of these things.
"Spying on students by school districts — that has to stop," Samuelson said. "But also what has to happen is students have to have the right at home to express themselves on the Internet."