An Act To Amend the Student Information Privacy Act
Maine Legislature, Session 129, LD 1331
Committee: Education and Cultural Affairs
Sponsors: FECTEAU
Amends: 20-A MRSA §953

Legislative Document
No. 1331
H.P. 959
House of Representatives, March 19, 2019
An Act To Amend the Student Information Privacy Act
Reference to the Committee on Education and Cultural Affairs suggested and ordered 
printed.
ROBERT B. HUNT
Clerk
Presented by Representative FECTEAU of Augusta.
Be it enacted by the People of the State of Maine as follows:
Sec. 1.  20-A MRSA §953, sub-§1, ¶¶C and D, as enacted by PL 2015, c. 256, 
§1, are amended to read:
C.  Sell student data. This prohibition does not apply to the purchase, merger or other 
type of acquisition of an operator by another entity as long as the operator or 
successor entity continues to be subject to the provisions of this section with respect 
to previously acquired student data subject to this chapter.;
D.  Except as provided in subsection 3, disclose student personally identifiable 
information, unless the disclosure is made:
(1)  To advance the kindergarten to grade 12 school purposes of the website, 
service or application, as long as the recipient of the student data disclosed:
(a)  May not further disclose the student data except to allow or improve 
operability and functionality of the website, service or application within that 
student's classroom or school; and
(b)  Is legally required to comply with the requirements of this chapter;
(2)  To ensure legal or regulatory compliance or protect against liability;
(3)  To respond to or participate in judicial process;
(4)  To protect the security or integrity of the operator's website, service or 
application;
(5)  To protect the safety of users or others; or
(6)  To a service provider, as long as the operator contractually:
(a)  Prohibits the service provider from using any student data for any 
purpose other than providing the contracted service to, or on behalf of, the 
operator;
(b)  Requires the service provider to impose the restrictions of this subsection 
on its own service providers; and
(c)  Requires the service provider to implement and maintain reasonable 
security procedures and practices as provided in subsection 2.;
Sec. 2.  20-A MRSA §953, sub-§1, ¶¶E to H are enacted to read:
E.  Disclose student data obtained by the operator through a survey.  An operator 
shall notify the student's parent or the eligible student at least 24 hours prior to 
disclosure under this paragraph.  The notification must include the name of the 
person to whom the student data will be disclosed and the reason for the disclosure;
F.  Disclose student data that is biometric or medical information.  An operator shall 
notify the student's parent or the eligible student at least 24 hours prior to disclosure 
under this paragraph.  The notification must include the name of the person to whom 
the student data will be disclosed and the reason for the disclosure;
G.  Audio record, video record or use navigational data on a student's school-supplied 
personal digital device when the device is not located on school property; and
H.  Provide student data generated on a student's personal digital device to a law 
enforcement agency, unless the student data is provided pursuant to a court order.
SUMMARY
This bill amends the Student Information Privacy Act by adding to the restrictions on 
the release of student data certain information that may not be disclosed without explicit 
consent from a student's parent or a court order.