2014 -- S 2095 SUBSTITUTE A

========

LC003479/SUB A/3

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2014

____________

A N   A C T

RELATING TO EDUCATION AND LABOR - SOCIAL MEDIA PRIVACY AND STUDENT

DATA - CLOUD COMPUTING

     Introduced By: Senators Ruggerio, Miller, Lynch, Jabour, and Satchell

     Date Introduced: January 21, 2014

     Referred To: Senate Judiciary

     It is enacted by the General Assembly as follows:

     SECTION 1. Title 16 of the General Laws entitled "EDUCATION" is hereby amended

by adding thereto the following chapter:

CHAPTER 103

STUDENT SOCIAL MEDIA PRIVACY

     16-103-1. Definitions. -- For the purposes of this chapter:

     (1) "Social media account" means an electronic service or account, or electronic content,

including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and

text messages, email, online service or accounts, or Internet website profiles or locations. For the

purposes of this chapter, social media account does not include an account opened at a school's

behest, or provided by the school or intended to be used primarily on behalf of the school.

     (2) "Applicant" means an applicant for admission to an educational institution.

     (3) "Educational institution" or "school" means a private or public institution that offers

participants, students or trainees an organized course of study or training that is academic,

technical, trade-oriented or preparatory for gainful employment in a recognized occupation and

shall include any person acting as an agent of the institution.

     (4) "Student" means any student, participant, or trainee, whether full-time or part-time, in

an organized course of study at an educational institution.

     16-103-2. Social media password requests prohibited. -- No educational institution

shall:

     (1) Require, coerce or request a student or prospective student to disclose the password or

any other means for accessing a personal social media account;

     (2) Require, coerce or request a student or prospective student to access a personal social

media account in the presence of the educational institution's employee or representative; or

     (3) Require or coerce a student or prospective student to divulge any personal social

media account information.

     16-103-3. Social media access requests prohibited. -- No educational institution shall

compel a student or applicant, as a condition of acceptance or participation in curricular or

extracurricular activities, to add anyone, including a coach, teacher, school administrator, or other

school employee or school volunteer, to their list of contacts associated with a personal social

media account or require, request, or cause a student or applicant to alter settings that affect a

third party's ability to view the contents of a personal social media account.

     16-103-4. Disciplinary action prohibited. -- No educational institution shall:

     (1) Discharge, discipline, or otherwise penalize or threaten to discharge, discipline, or

otherwise penalize any student for a student's refusal to disclose or provide access to any

information specified in § 16-103-2 or for refusal to add a coach, teacher, administrator, or other

school employee or school volunteer to their list of contacts associated with a personal social

media account or to alter settings associated with a personal social media account, as specified in

§ 16-103-3; or

     (2) Fail or refuse to admit any applicant as a result of the applicant's refusal to disclose or

provide access to any information specified in § 16-103-2 or for refusal to add a coach, teacher,

school administrator, or other school employee or school volunteer to their list of contacts

associated with a personal social media account or to alter settings associated with a personal

social media account, as specified in § 16-103-3.

     16-103-5. Exceptions. -- This chapter shall not apply to information about a student that

is publicly available.

     16-103-6. Penalties for violations. -- In any civil action alleging a violation of this

chapter, the court may:

     (1) Award to a prevailing applicant or student declaratory relief, damages, and reasonable

attorneys' fees and costs; and

     (2) Award injunctive relief against any school, or agent of any educational institution

who commits or proposes to commit a violation of this chapter.

     SECTION 2. Title 16 of the General Laws entitled "EDUCATION" is hereby amended

LC003479/SUB A/3 - Page 2 of 5

by adding thereto the following chapter:

CHAPTER 104

STUDENT DATA-CLOUD COMPUTING

     16-104-1. Student data-cloud computing. -- (a) For the purposes of this chapter:

     (1) "Cloud computing service" means a service that enables convenient on-demand

network access to a shared pool of configurable computing resources to provide a student,

teacher, or staff member account-based productivity applications such as email, document

storage, and document editing that can be rapidly provisioned and released with minimal

management effort or cloud computing service provider interaction.

     (2) "Cloud computing service provider" means an entity other than a public elementary or

secondary school that operates a cloud computing service.

     (3) "Process" means to use, access, manipulate, scan, modify, transform, disclose, store,

transmit, transfer, retain, aggregate, or dispose of student data.

     (4) "Student data" means any information in any media or format created or provided: (i)

By a student; or (ii) By a school board employee about a student in the course of using a cloud

computing service, including the student's name, email address, postal address, email message,

documents, unique identifiers, and metadata.

     (b) Notwithstanding any general or special law to the contrary any person who provides a

cloud computing service to an educational institution operating within the state shall process data

of a student enrolled in kindergarten through twelfth (12th) grade for the sole purpose of providing

the cloud computing service to the educational institution and shall not process such data for any

commercial purposes, including, but not limited to, advertising purposes that benefit the cloud

computing service provider.

     (c) Each cloud computing service that enters into a contract to provide such services shall

certify in writing that it shall comply with the provisions of this section.

     SECTION 3. Title 28 of the General Laws entitled "LABOR AND LABOR

RELATIONS" is hereby amended by adding thereto the following chapter:

CHAPTER 56

EMPLOYEE SOCIAL MEDIA PRIVACY

     28-56-1. Definitions. -- For the purposes of this chapter:

     (1) "Social media account" means an electronic service or account, or electronic content,

including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and

text messages, email, online service or accounts, or Internet website profiles or locations. For the

purposes of this chapter, social media account does not include an account opened at an

LC003479/SUB A/3 - Page 3 of 5

employer's behest, or provided by an employer, or intended to be used primarily on behalf of the

employer.

     (2) "Applicant" means an applicant for employment.

     (3) "Employee" means an individual who provides services or labor for an employer for

wages or other remuneration.

     (4) "Employer" includes the state and all political subdivisions of the state, and any

person in this state, employing individuals, and any person acting in the interest of an employer

directly or indirectly.

     28-56-2. Social media password requests prohibited. -- No employer shall:

     (1) Require, coerce or request an employee or applicant to disclose the password or any

other means for accessing a personal social media account;

     (2) Require, coerce or request an employee or applicant to access a personal social media

account in the presence of the employer or representative;

     (3) Require or coerce an employee or applicant to divulge any personal social media

account information except when reasonably believed to be relevant to an investigation of

allegations of employee misconduct or workplace-related violation of applicable laws and

regulations and when not otherwise prohibited by law or constitution; provided, that the

information is accessed and used solely to the extent necessary for purposes of that investigation

or a related proceeding.

     28-56-3. Social media access requests prohibited. -- No employer shall compel an

employee or applicant to add anyone, including the employer or their agent, to their list of

contacts associated with a personal social media account or require, request, or cause an

employee or applicant to alter settings that affect a third party's ability to view the contents of a

personal social media account.

     28-56-4. Disciplinary actions prohibited. -- No employer shall:

     (1) Discharge, discipline, or otherwise penalize or threaten to discharge, discipline, or

otherwise penalize any employee for an employee's refusal to disclose or provide access to any

information specified in § 28-56-2 or for refusal to add the employer to their list of contacts

associated with a personal social media account or to alter the settings associated with a personal

social media account, as specified in § 28-56-3; or

     (2) Fail or refuse to hire any applicant as a result of the applicant's refusal to disclose or

provide access to any information specified in § 28-56-2 or for refusal to add the employer or

their agent to their list of contacts associated with a personal social media account or to alter the

settings associated with a personal social media account, as specified in § 28-56-3.

LC003479/SUB A/3 - Page 4 of 5

     28-56-5. Exceptions. -- (a) This chapter shall not apply to information about an applicant

or employee that is publicly available.

     (b) This chapter shall not prohibit or restrict an employer from complying with a duty to

screen employees or applicants before hiring or to monitor or retain employee communications

that is established by a self-regulatory organization as defined by the Securities and Exchange Act

of 1934, 15 U.S.C. 78c(a)(26) or under state or federal law or regulation to the extent necessary to

supervise communications of insurance or securities licensees for insurance or securities related

business purposes.

     28-56-6. Penalties for Violations. -- In any civil action alleging a violation of this

chapter, the court may:

     (1) Award to a prevailing applicant or employee declaratory relief, damages and

reasonable attorneys' fees and costs; and

     (2) Award injunctive relief against any employer or agent of any employer who commits

or proposes to commit a violation of this chapter.

     SECTION 4. This act shall take effect upon passage.

========

LC003479/SUB A/3

========

LC003479/SUB A/3 - Page 5 of 5

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO EDUCATION AND LABOR - SOCIAL MEDIA PRIVACY AND STUDENT

DATA - CLOUD COMPUTING

***

     This act would establish a social media privacy policy for students and employees. In

addition, the act would limit the use of student data and information obtained by certain cloud

computing service providers and would prohibit the use of such data for any commercial purpose.

Cloud computing is defined as a service which enables users to store and access certain

information via an on-demand network.

     This act would take effect upon passage.

========

LC003479/SUB A/3

========

LC003479/SUB A/3 - Page 6 of 5