An Act To Safeguard Students' Personal and Private Information
Maine Legislature, Session 127, LD 1251
Committee: Education and Cultural Affairs
Sponsors: SAWICKI, MIRAMANT, ESPLING, FARRIN, GUERIN, SANDERSON, SIROCKI, GERZOFSKY

Legislative Document 
No. 1251 
H.P. 851 
House of Representatives, April 7, 2015 
An Act To Safeguard Students' Personal and Private Information 
Reference to the Committee on Education and Cultural Affairs suggested and ordered 
printed. 
ROBERT B. HUNT 
Clerk 
Presented by Representative SAWICKI of Auburn. 
Cosponsored by Senator MIRAMANT of Knox and 
Representatives: ESPLING of New Gloucester, FARRIN of Norridgewock, GUERIN of 
Glenburn, SANDERSON of Chelsea, SIROCKI of Scarborough, Senator: GERZOFSKY of 
Cumberland. 
Be it enacted by the People of the State of Maine as follows: 
Sec. 1.  20-A MRSA c. 221, sub-c. 1-A is enacted to read: 
SUBCHAPTER 1-A 
PROTECTION OF STUDENTS' PERSONAL AND PRIVATE DATA 
§6011.  Definitions 
As used in this subchapter, unless the context otherwise indicates, the following 
terms have the following meanings. 
1.  Disclosure.  "Disclosure" means to permit access to or the release, transfer or 
other communication of personally identifiable information contained in education 
records by any means, including oral, written or electronic means, to any party except the 
party identified as the party that provided or created the record. 
2.  Education record.  "Education record" means a record directly related to a 
student and maintained by the department or a school administrative unit or by a party 
acting for the department or a school administrative unit. 
3.  Eligible student.  "Eligible student" means a student who has reached 18 years of 
age. 
4.  Party.  "Party" means an individual, agency, institution or organization. 
5.  Personally identifiable information.  "Personally identifiable information" 
includes but is not limited to: 
A.  The student's name; 
B.  The name of the student's parent or other family members; 
C.  The address of the student or student's family; 
D.  A personal identifier, such as the student's social security number, student number 
or biometric record; 
E.  Other indirect identifiers, such as the student's date of birth, place of birth and 
mother's maiden name; 
F.  Other information that, alone or in combination, may be or is linked to a specific 
student that would allow a reasonable person in the school community, who does not 
have personal knowledge of any relevant circumstances, to identify the student with 
reasonable certainty; and 
G.  An education record requested by a person who the department or a school 
administrative unit reasonably believes knows the identity of the student to whom the 
education record relates. 
6.  Record.  "Record" means any information recorded in any way, including, but not 
limited to, by handwriting, print, computer media, videotape or audio tape, film, 
microfilm and microfiche. 
7.  Student.  "Student" means an individual who is or has been in attendance at a 
school within this State and regarding whom the department or a school administrative 
unit maintains education records. 
8.  Student database.  "Student database" means any computer system that houses or 
maintains data on students in prekindergarten to grade 12. 
9.  Written consent.  "Written consent" means consent that is signed by an eligible 
student or a parent, is dated on the day it was signed, is signed within 6 months before a 
disclosure, identifies the recipient and the purpose of the disclosure and states that the 
information will be used only for that purpose and will not be used or disclosed for any 
other purpose. 
§6012.  Restrictions on maintenance and disclosure 
1.  Disclosure prohibited.  The department or a school administrative unit may not 
directly or through contracts with outside parties maintain personally identifiable 
information from education records without the written consent of eligible students or 
parents unless maintenance of the information is: 
A.  Explicitly mandated in federal or state statute; 
B.  Administratively required for the proper performance of the department's or the 
school administrative unit's duties under the law and is relevant to and necessary for 
delivery of services; or 
C.  Designed to support a study of students or former students, as long as no 
personally identifiable information is retained on former students for more than 5 
years after the date of their last enrollment at a school. 
2.  Data collection, entry and maintenance prohibited.  The following information 
may not be collected, entered into any student database or maintained as education 
records by the department or a school administrative unit: 
A.  DNA, fingerprints or retina or iris pattern information or any information about 
the psychological characteristics of a student; 
B.  Student or family religious affiliation, beliefs or practices; 
C.  Student or family political affiliation, beliefs or practices; 
D.  Student or family member sexual orientation or beliefs about sexual orientation; 
or 
E.  Student or family gun ownership or usage. 
3.  Prohibited grants.  The department or a school administrative unit may not 
pursue or accept a grant, whether governmental or private, that would require the 
collection or reporting of any student information contained in subsection 2. 
4.  Disclosure and notification concerning maintenance of personally identifiable 
information.  The department and school administrative units shall publicly and 
conspicuously disclose on their publicly accessible websites and through annual 
electronic notification to the joint standing committee of the Legislature having 
jurisdiction over education matters the existence and nature of any personally identifiable 
information from education records that they, directly or through contracts with outside 
parties, maintain.  Such disclosure and notifications must include: 
A.  The name and location of the student database where the information is 
maintained; 
B.  The legal authority that authorizes the establishment and existence of the student 
database; 
C.  The principal purpose or purposes for which the information is intended to be 
used; 
D.  The categories of individuals on whom records are maintained in the student 
database; 
E.  The categories of records maintained in the student database; 
F.  Each expected disclosure of the records contained in the student database, 
including the categories of recipients and the purpose of the disclosure; 
G.  The policies and practices of the department and school administrative units 
regarding storage, retrievability, access controls, retention and disposal of the 
records; 
H.  The title and business address of the department or school administrative unit 
official who is responsible for the student database, and the name and business 
address of any contractor or other outside party maintaining the student database for 
or on behalf of the department or a school administrative unit; 
I.  The procedure whereby an eligible student or a parent can be notified upon request 
if the student database contains a record pertaining to the student or the parent's child; 
J.  The procedure whereby an eligible student or a parent can be notified upon request 
regarding how to gain access to a record pertaining to the student or the parent's child 
contained in the student database, and how the student or parent can contest the 
record's content; and 
K.  The categories of sources of records in the student database. 
5.  Access to personally identifiable information restricted.  Except as otherwise 
authorized by this section, access to personally identifiable information in the student 
database is restricted to the authorized representatives of the department and the school 
administrative unit who require such access to perform their assigned duties.  The 
department and the school administrative unit shall designate only parties that are under 
their direct control to act as their authorized representatives to conduct an audit or 
evaluation, or any compliance or enforcement activity in connection with legal 
requirements that relate to state-supported or unit-supported educational programs, when 
the audit, evaluation or activity requires or is used as the basis for granting access to 
personally identifiable information. 
6.  Disclosure without written consent restricted.  The department or a school 
administrative unit may not disclose personally identifiable information from education 
records of students without the written consent of eligible students or parents to a 
contractor, consultant or other party to whom the department or the school administrative 
unit has outsourced institutional services or functions unless the contractor, consultant or 
other party: 
A.  Performs an institutional service or function for which the department or the 
school administrative unit would otherwise use its own employees; 
B.  Is under the direct control of the department or the school administrative unit with 
respect to the use and maintenance of education records; 
C.  Limits internal access to education records to those individuals who are 
determined to have legitimate educational interests; 
D.  Does not use the education records for any purposes other than those explicitly 
authorized in the party's contract; 
E.  Does not disclose any personally identifiable information to any other party; 
F.  Maintains reasonable administrative, technical and physical safeguards to protect 
the security, confidentiality and integrity of personally identifiable information in its 
custody; 
G.  With respect to personally identifiable information stored in a student database 
that is accessed over the Internet or other public network, protects such data through a 
secure encrypted protocol.  Access through a web browser must use at a minimum 
Hypertext Transfer Protocol Secure, while access through other means must use the 
industry standard encryption technologies applicable to the most sensitive component 
of the record.  With respect to records concerning a student's physical, mental or 
psychological health, "industry standard" means a technology or methodology 
specified by the Secretary of the United States Department of Health and Human 
Services in guidance issued under Section 13402(h)(2) of the American Recovery and 
Reinvestment Act, Public Law 111-5; 
H.  With respect to data that is in motion or in the party's custody, protects such data 
from unauthorized disclosure using industry standard encryption technologies 
applicable to the most sensitive component of the data in its custody.  With respect to 
records concerning a student's physical, mental or psychological health, "industry 
standard" means a technology or methodology specified by the Secretary of the 
United States Department of Health and Human Services in guidance issued under 
Section 13402(h)(2) of the American Recovery and Reinvestment Act, Public Law 
111-5; 
I.  Has sufficient administrative and technical procedures to monitor continuously the 
security of personally identifiable information in the party's custody; 
J.  Conducts a security audit annually and provides the results of that audit to the 
department and each school administrative unit and school that provided education 
records to the party; 
K.  Provides the department or the school administrative unit with a breach-
remediation plan acceptable to the department or the school administrative unit 
before initial receipt of education records; 
L.  Reports all suspected or actual security breaches to the department or the school 
administrative unit that provided education records to the party as soon as possible 
but not later than 48 hours after a suspected or actual breach is known or would have 
been known by exercising reasonable diligence; 
M.  In the event of a security breach or unauthorized disclosure of personally 
identifiable information, pays all costs and liabilities incurred by the department or 
the school administrative unit related to the security breach or unauthorized 
disclosure, including but not limited to the costs of responding to inquiries about the 
security breach or unauthorized disclosure, of notifying subjects of personally 
identifiable information about the security breach or unauthorized disclosure, of 
mitigating the effects of the security breach or unauthorized disclosure for the 
subjects of personally identifiable information and of investigating the cause and 
consequences of the security breach or unauthorized disclosure; and 
N.  Destroys or returns to the department or the school administrative unit all 
personally identifiable information in the party's custody upon request or at the 
termination of the contract, whichever occurs first. 
7.  Disclosure without consent for studies.  The department or a school 
administrative unit may disclose personally identifiable information from an education 
record of a student without the consent of the eligible student or parent to a party 
conducting studies for or on behalf of the department or the school administrative unit to: 
A.  Develop, validate or administer predictive tests; or 
B.  Administer student-aid programs if the outside party conducting the study meets 
all of the requirements for contractors set forth in subsection 6. 
8.  Disclosure and notification before authorized nonconsensual disclosure.  
Before any nonconsensual disclosures authorized by subsections 6 and 7, the department 
or a school administrative unit shall publicly and conspicuously disclose on their publicly 
accessible websites and through electronic notification to the joint standing committee of 
the Legislature having jurisdiction over education matters the existence and nature of any 
contracts or agreements pursuant to which the department or school administrative unit 
intends to disclose personally identifiable information from education records to a 
contractor, outsourcing entity or 3rd party conducting a study.  The disclosure and 
notification must include: 
A.  The name and location of the student database where any personally identifiable 
information would be maintained by a contractor, outsourcing entity or 3rd party; 
B.  The principal purpose or purposes for which the personally identifiable 
information is intended to be used; 
C.  The categories of individuals whose records would be disclosed to the contractor, 
outsourcing entity or 3rd party; 
D.  The categories of records maintained by the contractor, outsourcing entity or 3rd 
party; 
E.  Expected uses of the records disclosed to the contractor, outsourcing entity or 3rd 
party; 
F.  The policies and practices of the contractor, outsourcing entity or 3rd party 
regarding storage, retrievability, access controls, retention and disposal of the 
records; 
G.  The title and business address of the department or school administrative unit 
official who is responsible for the contract or agreement, and the name and business 
address of the contractor, outsourcing entity or 3rd party directly responsible for 
education records maintained pursuant to a contract or agreement; 
H.  The procedure whereby an eligible student or a parent can be notified upon 
request regarding how to gain access to any record pertaining to the student or the 
parent's child maintained by the contractor, outsourcing entity or 3rd party and how 
the student or the parent can contest the record's contents; and 
I.  The categories of sources of records in the student database containing education 
records. 
9.  Collection or disclosure for commercial use prohibited.  The department or a 
school administrative unit may not, without the written consent of eligible students or 
parents, facilitate, arrange, contract for or authorize a 3rd party to collect personally 
identifiable information of students or disclose personally identifiable information from 
education records to any party for a commercial use, including but not limited to 
marketing products or services, or creation of individual, household or group profiles; nor 
may such disclosure be made for provision of services other than contracting, studies and 
audits or evaluations as authorized and limited by subsections 6 and 7. 
10.  Disclosure to noneducation government agency prohibited.  The department 
or a school administrative unit may not disclose personally identifiable information from 
education records to any noneducation government agency, including but not limited to 
the Department of Labor, whether within or outside the State, or to any party that intends 
to use or disclose the personally identifiable information for the purpose of workforce-
development or economic planning without the written consent of eligible students or 
parents. 
11.  Disclosure to governmental or private entity outside this State restricted.  
Subject to the provisions of this subsection, the department or a school administrative unit 
may not disclose personally identifiable information from education records to any 
governmental or private entity outside this State without the written consent of eligible 
students or parents, except that the department or the school administrative unit may 
disclose personally identifiable information in the following circumstances: 
A.  When a student has transferred to a school out of state; 
B.  When a student voluntarily participates in an out-of-state program and the data 
transfer is a condition or requirement of participation; or 
C.  When a student is classified as a "migrant" for federal reporting purposes. 
12.  Disclosure to United States Department of Education restricted.  The 
department or a school administrative unit may not disclose to the United States 
Department of Education any student-level information, whether or not personally 
identifiable, from education records without the prior notification of the joint standing 
committee of the Legislature having jurisdiction over education matters. 
13.  Data match practices restricted.  The department or a school administrative 
unit may not append education records with personally identifiable information obtained 
from other federal or state agencies through data matches without the written consent of 
eligible students or parents unless the data matches are: 
A.  Explicitly mandated by federal or state statute; or 
B.  Administratively required for the proper performance of the department's or the 
school administrative unit's duties under the law and are relevant to and necessary for 
delivery of services. 
14.  Administrative use.  Nothing in this section limits the administrative use of 
education records by a person acting exclusively in the person's capacity as an employee 
of the department or a school administrative unit. 
§6013.  Violations 
1.  Civil penalty; disqualification.  A violation of this subchapter by a contractor, 
consultant or other party that has entered into a contract or other agreement with the 
department or a school administrative unit and is subject to the provisions of this 
subchapter is punishable by a civil penalty of up to $5,000 and may result in permanent 
disqualification by the department or the school administrative unit from access to 
education records.  Each violation involving a different individual student is considered a 
separate violation for purposes of civil penalties under this subsection. 
2.  Enforcement by Attorney General.  The Attorney General has the authority to 
enforce compliance with this subchapter. 
3.  No private right of action against department or school administrative unit.  
Nothing in this subchapter may be construed as creating a private right of action against 
the department or a school administrative unit. 
§6014.  Effective date; application 
This subchapter takes effect July 1, 2016 and applies to school years beginning with 
the 2016-2017 academic year. 
SUMMARY 
This bill establishes data privacy practices for the Department of Education and 
school administrative units.  It prohibits the department and school administrative units 
from disclosing personally identifiable information about students without the written 
consent of the parents of children under 18 years of age and the written consent of the 
students themselves when the students are at least 18 years of age.  There are specific 
exceptions to the prohibitions.  The bill also prohibits the collection, entry and 
maintenance of certain information about students and their families.  A contractor, 
consultant or other party that has entered into a contract or other agreement with the 
department or a school administrative unit who violates the restrictions is subject to a 
$5,000 civil penalty per violation and disqualification from future access to education 
records.