PLEASE NOTE: Legislative Information cannot perform research, provide legal advice, or interpret Maine law. For legal assistance, please contact a qualified attorney.
An Act To Amend the Student Information Privacy Act
Be it enacted by the People of the State of Maine as follows:
Sec. 1. 20-A MRSA §953, sub-§1, ¶¶C and D, as enacted by PL 2015, c. 256, §1, are amended to read:
 
C. Sell student data. This prohibition does not apply to the purchase, merger or other type of acquisition of an operator by another entity as long as the operator or successor entity continues to be subject to the provisions of this section with respect to previously acquired student data subject to this chapter.;
 
D. Except as provided in subsection 3, disclose student personally identifiable information, unless the disclosure is made:
 
(1) To advance the kindergarten to grade 12 school purposes of the website, service or application, as long as the recipient of the student data disclosed:
 
(a) May not further disclose the student data except to allow or improve operability and functionality of the website, service or application within that student's classroom or school; and
 
(b) Is legally required to comply with the requirements of this chapter;
 
(2) To ensure legal or regulatory compliance or protect against liability;
 
(3) To respond to or participate in judicial process;
 
(4) To protect the security or integrity of the operator's website, service or application;
 
(5) To protect the safety of users or others; or
 
(6) To a service provider, as long as the operator contractually:
 
(a) Prohibits the service provider from using any student data for any purpose other than providing the contracted service to, or on behalf of, the operator;
 
(b) Requires the service provider to impose the restrictions of this subsection on its own service providers; and
 
(c) Requires the service provider to implement and maintain reasonable security procedures and practices as provided in subsection 2.;
Sec. 2.  20-A MRSA §953, sub-§1, ¶¶E to H  are enacted to read:
 
E.  Disclose student data obtained by the operator through a survey. An operator shall notify the student's parent or the eligible student at least 24 hours prior to disclosure under this paragraph. The notification must include the name of the person to whom the student data will be disclosed and the reason for the disclosure;
 
F.  Disclose student data that is biometric or medical information. An operator shall notify the student's parent or the eligible student at least 24 hours prior to disclosure under this paragraph. The notification must include the name of the person to whom the student data will be disclosed and the reason for the disclosure;
 
G.  Audio record, video record or use navigational data on a student's school-supplied personal digital device when the device is not located on school property; and
 
H.  Provide student data generated on a student's personal digital device to a law enforcement agency, unless the student data is provided pursuant to a court order.
 
SUMMARY
This bill amends the Student Information Privacy Act by adding to the restrictions on the release of student data certain information that may not be disclosed without explicit consent from a student's parent or a court order.