Student Data Protection Regulations in the State of Montana

Montana HB 745 is a student data protection and personal privacy law that was enacted in 2020. The law was passed for the purpose of protecting the personal information of students that attend school within the state of Montana from unauthorized access, particularly as it concerns targeted marketing and advertising. With this being said, the law establishes the measures and protocols that school districts must follow in order to ensure that the personal information of their respective students is both protected and utilized for legitimate purposes, such as the furtherance of their educational journeys.

How are K-12 school purposes defined under the law?

Montana HB 745 defines school purposes to mean “activities that customarily take place at the direction of a school, teacher, or school district or aid in the administration of school activities, including but not limited to instruction in the classroom or at home, administrative activities, and collaboration between pupils, school personnel, or parents, or that are for the use and benefit of a school.” Alternatively, the law defines a K-12 online application as “an internet website, online service, cloud computing service, online application, or mobile application that is used primarily for K-12 school purposes and that was designed and is marketed for K-12 school purposes.”

What are the duties of online operators under the law?

Montana HB 745 mandates that educators, school administrators, and online operators take the following steps to protect the personal information of the respective students they serve:

• Online operators within Montana are forbidden from using the personal information of their students to engage in targeted advertising or marketing.
• Online operators are forbidden from using the personal information of a student to amass an online profile for the said student, except in the furtherance of K-12 school purposes.
• Online operators are only permitted to disclose the personal information of their students for the purposes of aiding them in furthering their academic careers.
• Online operators are responsible for implementing and maintaining security protocols and procedures that can be used to protect the personal information of their students. These protocols and procedures must be appropriate to the nature of the personal information that has been collected or disclosed.
• Online operators are responsible for deleting a student’s personal information at the behest of their school district.
• Any contracts that online operators forge with third parties must be in accordance with the provisions of the law.

What data elements are protected under the law?

In accordance with the Family Educational Rights and Privacy Act (FERPA), the data elements concerning K-12 students within the state of Montana that are legally protected from unauthorized use, access, modification, destruction, and disclosure include but are not limited to:

• Social security numbers.
• First and last names.
• Biometric identifiers.
• Criminal, medical, and health records.
• Socioeconomic information.
• Food purchases.
• Political affiliation.
• Text messages.
• Documents.
• Special education data.
• Juvenile dependency records.
• Grades and evaluations.
• Voice recordings.
• Photos.

How is Montana HB 745 enforced?

The provisions established in Montana HB 745 are enforced by the state attorney general. Subsequently, the state attorney general has a number of sanctions and penalties that they can impose against online operators, educators, and school administrators that are found to be in violation of the law. Most notably, any contracts concerning K-12 school purposes that do not abide by the sections set forth in the law will effectively be voided, and all information and monetary gains that have been attained from such contracts must be forfeited.

While no single law or regulation will be enough to stop data breaches or the illegal transmission of personal information, legislation such as Montana HB 745 provides parents of school children within the state with the legal protections necessary to ensure that student data does not fall into the wrong hands. More importantly, however, the provisions of the law also ensure that should the personal data of Montana students become compromised for any reason, the only operators, educators, and school administrators that were responsible for safeguarding such information will be held accountable.