MN SF953

Public postsecondary institutions must not publicly disclose students' email addresses, physical addresses, telephone numbers, or identification card photographs in directory information.

Institutions must maintain documentation of directory information requests for 100 or more students for four years and allow requested students to review that documentation.

Postsecondary institutions must obtain student consent before collecting location data and cannot require location data consent as a condition of enrollment, financial aid, or basic university services like campus Wi-Fi.

Technology providers must notify students within 30 days of each school year about location data collection, publish complete contracts on institutional websites, and cannot sell or use location data for commercial purposes including marketing.

Technology providers must establish written security procedures for location data, maintain logs of all data access for at least one year, and destroy or return all location data within 30 days of contract expiration.