HB0811ham003 99TH GENERAL ASSEMBLY

Rep. Scott Drury

Filed: 3/28/2016

09900HB0811ham003 LRB099 04631 NHT 44553 a

AMENDMENT TO HOUSE BILL 811

AMENDMENT NO. ______. Amend House Bill 811 by replacing everything after the enacting clause with the following:

"Section 5. The School Code is amended by adding Section 22-82 as follows:

(105 ILCS 5/22-82 new)

Sec. 22-82. Student data privacy.

(a) It is the intent of the General Assembly to help ensure that information generated by and about students in the course of and in connection with their education is safeguarded and that student privacy is honored, respected, and protected. The General Assembly finds the following:

(1) Information generated by and about students in the course of and in connection with their education is a vital resource for teachers and school staff in planning education programs and services, scheduling students into appropriate classes, and completing reports for educational agencies.

(2) Information generated by and about students in the course of and in connection with their education is critical to educators in helping students successfully graduate from high school and being ready to enter the workforce or postsecondary education.

(3) While information generated by and about students in the course of and in connection with their education is important for educational purposes, it is also critically important to ensure that the information is protected, safeguarded, and kept private and used only by appropriate educational authorities or their permitted designees, and then only to serve the best interests of the student. To that end, this Section helps ensure that information generated by and about students in the course of and in connection with their education is protected and expectations of privacy are honored.

(b) In this Section:

"Breach" means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personally identifiable information, student data, or a school student record.

"Eligible student" has the meaning set forth in the Illinois School Student Records Act.

"Parent" has the meaning set forth in the Illinois School Student Records Act.

"Personally identifiable information" has the meaning set forth in the Illinois School Student Records Act.

"Profile" means a file or other mechanism used to collect, retain, and use student data or other information by which to identify or otherwise keep track of an individual student or group of students.

"Record" has the meaning set forth in the Illinois School Student Records Act.

"School" has the meaning set forth in the Illinois School Student Records Act.

"School authority" has the meaning set forth in the Illinois School Student Records Act.

"School purpose" means any activity that is directed by or takes place at the direction of a school authority. Advertising that is not otherwise specifically authorized in this Section is not a school purpose.

"School student record" has the meaning set forth in the Illinois School Student Records Act.

"State Board" means the State Board of Education.

"Student" has the meaning set forth in the Illinois School Student Records Act.

"Student data" means any information or records regarding a student collected by or provided to a vendor for or in connection with a school purpose, including personally identifiable information and information that is linked to personally identifiable information. "Student data" does not include aggregated information or records to the extent no student may be individually identified therefrom in any manner whatsoever or other information or records that do not include personally identifiable information or other data by which a student may be identified in any manner whatsoever. "Student data" does include aggregated information or records that are capable of being de-aggregated or reconstructed to the point that any student may be individually identified therefrom.

"Targeted advertising" means advertising to an individual student or group of students in which the advertisements are selected based on a known or assumed trait of the student or group of students or information obtained or inferred from the student's or group of students' online behavior within a vendor's product or service or the student's or group of students' use of a vendor's products or services. This term does not include:

(1) information sent by a vendor to a specific individual or group of individuals to advise them of updates or improvements to products, sites, or services that are already being utilized by the individual or group of individuals, provided that the school authority or the individual or group of individuals have consented to receiving information about updates and improvements; or

(2) school purpose advertisements at an online location based on a student's current visit to that location without collection and retention of the student's online activities over time.

"Vendor" means any entity that, for a fee or free of charge:

(1) provides a product or service to a school authority that collects, retains, or uses student data;

(2) designs or markets a product or service for use by a school authority that collects, retains, or uses student data; or

(3) knows or reasonably should know that a product or service that collects, retains, or uses student data will be used for a school purpose.

(c) It shall be unlawful for any vendor in possession of student data or any subcontractor, agent, independent contractor, or other entity that receives student data from a vendor to:

(1) engage in targeted advertising based in whole or in part on student data;

(2) sell, lease, provide, or rent student data to any person, entity, or third party other than the school authority or State Board, unless there has been a purchase, merger, or other type of acquisition of the vendor by another entity, in which case the sale of previously collected student data is permitted, provided that the successor entity agrees in writing to be subject to and bound by the provisions of this Section and any agreement governed by this Section and a copy of the successor entity's agreement with the vendor that relates to this Section is provided to the school authority, redacted to prevent disclosure of confidential or proprietary information;

(3) exercise or claim any rights, implied or otherwise, to any student data, unless otherwise authorized by this Section;

(4) disclose or otherwise allow any third party to have access to student data, unless such disclosure is:

(A) made only in furtherance of a school purpose and the recipient of the student data is legally required to comply with this Section;

(B) to the extent permitted by federal law, to law enforcement to protect the safety of users or others or the security or integrity of the vendor's service;

(C) required by court order or State or federal law;

(D) made in connection with research being conducted pursuant to and in compliance with subsection (a-5) of Section 6 of the Illinois School Student Records Act;

(E) to ensure legal or regulatory compliance; or

(F) to a subcontractor, agent, independent contractor or other entity, for the purposes of enabling the vendor to meet its contractual obligations to the school authority, that first acknowledges in writing that it has read and understands the requirements of this Section and agrees in writing to be bound by its provisions and the terms of any agreement entered into between the vendor and the school authority, with a copy of such written acknowledgement and agreement being provided to the school authority;

(5) create, generate, or otherwise amass a profile about any student if the profile is based on any student data, for any purpose other than a school purpose;

(6) require a school authority or its employees, agents, volunteers, or students to indemnify a vendor or pay the vendor's attorney's fees or costs in connection with any dispute arising out of or otherwise connected to student data, except in the case of willful or wanton conduct by a school authority or its employee or agent, in which case indemnification by the school authority may be permitted;

(7) require a school authority or its employees, agents, volunteers, or students to arbitrate any dispute arising out of or otherwise connected to student data;

(8) enter into any agreement with a school authority that authorizes in any manner activities prohibited by this Section; and

(9) modify or otherwise alter the terms and conditions of any agreement with a school authority related to student data without the express consent of the school authority or its designee, which may not be the vendor.

(d) Any vendor who receives any student data in any manner shall:

(1) implement and maintain appropriate administrative, physical, and technical safeguards to secure the student data from unauthorized access, destruction, use, modification, or disclosure in a manner that is at least as protective as any rules adopted by the State Board and any guidance provided by the United States Department of Education Privacy and Technical Assistance Center;

(2) within the most expedient time possible and without unreasonable delay, notify the school authority of any breach, regardless of whether it is the school authority's student data;

(3) to the extent feasible, delete the student data, school student record, or personally identifiable information of a specific student at the request of the student's school or school authority;

(4) designate an officer or employee as a responsible person who shall be trained in a manner so as to ensure compliance with this Section and ensure the security and confidentiality of student data and who shall work with the official records custodian of the school authority under subsection (a) of Section 4 of the Illinois School Student Records Act;

(5) unless otherwise required by federal or State law, within a reasonable amount of time after the completion or termination of the terms of any agreement with a school authority under which a vendor gained access to student data, not to exceed 60 days:

(A) delete or return to the school authority all student data, unless the student data is stored on a backup tape or other backup medium, in which case the data shall be overwritten in the most expedient manner possible in the normal course of business; and

(B) provide a written certification that such deletion has occurred;

(6) if directed by the school authority, correct or delete student data that the student's parents or guardians or the eligible student would be permitted to access and correct in the student's school student records with the school authority under federal or State law;

(7) permit a school authority or its designee to audit and inspect, on an annual basis or after any breach, the vendor's practices with respect to any student data received by the vendor from the school authority or any student profiles, provided that this requirement shall be satisfied if the vendor provides the school authority with an independent, third-party audit acceptable to the school authority that has been conducted within the previous 12 months or, in the case of a breach, within 3 months after the breach;

(8) permit the school authority access to any student data provided by the school authority, provided that the student data is stored with the vendor, in order for the school authority to comply with any law that may require disclosure;

(9) consistent with the provisions of this Section, be permitted to diagnose, evaluate, or correct problems with or otherwise modify or improve the vendor's product or service;

(10) be permitted to use student data that does not contain any personally identifiable information and has otherwise been stripped of or does not contain identifying information for the purpose of:

(A) adaptive, personalized, or customized learning;

(B) demonstrating the effectiveness of the product or service; or

(C) developing, supporting, and improving educational sites, services, or applications;

(11) agree that any dispute arising out of or otherwise connected to student data shall be litigated using Illinois law, the proper venue is in the county or federal court district in which the school district is located, and the court in the proper venue shall have jurisdiction over the vendor; and

(12) agree that the student data continues to be the property of and under the control of the school authority and that the vendor has a limited, nonexclusive license to the student data solely for the purpose of performing its obligations under the agreement required by subsection (e) of this Section or supporting, maintaining, diagnosing, or improving the vendor's product or service.

(e) Any vendor who seeks to receive from a school authority or the State Board in any manner any student data is required to enter into a written agreement with the school authority before any records may be transferred, which agreement shall contain the following:

(1) provisions consistent with each prohibition or requirement set forth in subsections (c) and (d) of this Section;

(2) a listing of the categories or types of student data to be provided to the vendor;

(3) a statement of the product or service being provided to the school authority by the vendor;

(4) a statement that the vendor is acting as a school official with a legitimate educational interest, is performing an institutional service or function for which the school authority would otherwise use employees, under the direct control of the school authority with respect to the use and maintenance of student data, and is using such student data only for an authorized purpose and will not re-disclose it to third parties or affiliates, unless otherwise permitted under this Section, without permission from the school authority or pursuant to court order;

(5) a description of the actions the vendor will take, including a description of the training the vendor will provide to anyone who will receive or have access to student data, to ensure the security and confidentiality of student data; compliance with this subdivision (5) shall not, in itself, absolve the vendor of liability in the event of an unauthorized disclosure of student data; and

(6) a statement that the agreement is the entire agreement between the school authority, including school authority employees and other end users, and the vendor.

(f) Each school authority shall adopt a policy regarding which school employees have the power to bind the school authority to the terms of any non-verbal agreements, whether electronic, click-through, click-wrap, or in writing and require an original copy of each agreement's terms and conditions to be maintained at the school authority's primary place of business. Each school authority shall prohibit individual school employees not authorized to bind the school authority to such agreements from entering into any agreement with vendors without written authorization from the school authority and require that any school entering into any agreement with a vendor is subject to the requirements of this Section and that oral agreements are prohibited. Any oral agreement is void as against public policy. If a vendor enters into an agreement with an employee or other end users who are not authorized through the school authority's policy to enter into such an agreement, then the school authority shall have the authority to unilaterally cancel the agreement. This Section shall not be construed to limit individual school employees outside of the scope of their employment from entering into agreements with vendors on their own behalf and for a non-school purpose, provided that no student data is provided to the vendors.

(g) The State Board shall create, publish, and make publicly available all categories of data collected by the State Board that contain personally identifiable information.

(h) In the event of a breach resulting, in whole or in part, from the vendor's conduct, in addition to any other remedies available to the school authority under law or equity, the vendor shall reimburse the school authority in full for all reasonable costs and expenses incurred by the school authority as a result of the vendor's conduct in investigating and remediating the breach, including, but not limited to:

(1) providing notification to those students whose personally identifiable information was compromised, to their parents or guardians in the event a student is under the age of 18, and to regulatory agencies or other entities as required by law or contract;

(2) providing one year's credit monitoring to those students and eligible students whose student data was exposed in such a manner during the breach that a reasonable person would have cause to believe that it could impact his or her credit or financial security;

(3) legal fees, audit costs, fines, and other fees or damages imposed against the school authority as a result of the security breach; and

(4) providing any other notifications or fulfilling any other requirements adopted by the State Board or under State or federal laws.

(i) The State Board shall develop, publish, and make publicly available model student data privacy policies and procedures that comply with relevant State and federal law.

(j) Within 180 days after the effective date of this amendatory Act of the 99th General Assembly, the State Board shall create a model notice that school authorities shall use to provide notice to parents, guardians, and eligible students about vendors. It shall be titled "Student Data Shared With Vendors" and state, in general terms, what types of student data are collected by the school authority and shared with vendors under this Section and the purposes of collecting and using the student data. Upon the creation of the notice described in this subsection (j), a school authority shall, at the beginning of each school year, provide such notice to parents, guardians, and eligible students by the same means generally used to send notices to them.

(k) In addition to any other penalties, any agreement governed by this Section that fails to comply with the requirements of this Section shall be rendered void if, upon notice and a reasonable opportunity to cure, the noncompliant party fails to cure any defect. Written notice of noncompliance may be provided by either party to the agreement. Any vendor subject to an agreement voided under this subsection (k) is required, within 60 days, to delete or return to the school authority all student data and information contained in student profiles and, in the event of deletion, provide a written certification that such deletion has occurred. Any vendor that fails to cure any defect in the agreement is not be entitled to any further payment required under the agreement and shall return to the school authority all payments made from the date of notification of non-compliance by the school authority.

(l) Nothing in this Section shall be construed to:

(1) restrict adaptive, personalized, or customized learning, subject to the requirements of this Section;

(2) prohibit a vendor from complying with its obligations under federal or State law;

(3) impose a duty on a provider of an interactive computer service, as defined in Chapter 5 of Title 47 of the United States Code, to review or enforce compliance with this Section by third-party content providers, provided that this subdivision (3) has no impact on the obligations of vendors;

(4) impose a duty on a provider of an electronic store, a gateway, a marketplace, or any other means of purchasing or downloading software or applications to review or enforce compliance with this Section, unless the provider described in this subdivision (4) is also a vendor subject to the provisions of this Section or has a financial interest in or control over a vendor subject to the provisions of this Section;

(5) impede the ability of students to download, transfer, or otherwise save or maintain their own student data, provided that nothing in this subdivision (5) shall allow a vendor to circumvent or engage in conduct prohibited by this Section;

(6) limit Internet service providers from providing Internet connectivity to school authorities, students, and students' parents or guardians, provided that the provision of such Internet connectivity does not violate any of the provisions of this Section; and

(7) apply to an entity acting entirely outside of its vendor capacity.

Section 10. The Illinois School Student Records Act is amended by changing Sections 2, 6, and 9 as follows:

(105 ILCS 10/2) (from Ch. 122, par. 50-2)

Sec. 2. As used in this Act: ,

"Biometric information" has the meaning set forth in subsection (a) of Section 10-20.40 of the School Code.

"Eligible student" means a student who has reached 18 years of age or is attending a post-secondary educational institution.

"Parent" means a person who is the natural parent of a student or other person who has the primary responsibility for the care and upbringing of a student. All rights and privileges accorded to a parent under this Act shall become exclusively those of the student upon his or her 18th birthday or upon attendance at a post-secondary educational institution. Such rights and privileges may also be exercised by the student at any time with respect to the student's permanent school record.

"Personally identifiable information" means any data concerning a student by which a student may be individually or personally identified and includes, but is not limited to:

(1) the student's name;

(2) the name of the student's parent or other family members;

(3) the address of the student or the student's family;

(4) a personal identifier, such as the student's social security number, student number, or biometric information;

(5) other indirect identifiers, such as the student's date of birth, place of birth, or mother's maiden name;

(6) other information that, alone or in combination, is linked or linkable to a specific student and that would allow a reasonable person in the school community who does not have personal knowledge of the relevant circumstances to identify the student with reasonable certainty; or

(7) information requested by a person whom a school reasonably believes knows the identity of the student to whom the school student record relates.

"Record" means any information maintained in any way, including, but not limited to, electronically-generated data, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.

"Research entity" means an accredited post-secondary educational institution or an organization conducting research for or on behalf of a school authority or the State Board.

"Research study" means the gathering of data, information, and facts by a research entity for the advancement of knowledge.

"School" means any preschool, day care center, kindergarten, nursery, elementary or secondary educational institution, vocational school, special education facility, or other elementary or secondary educational agency or institution that receives public funds, as well as any person, agency, or institution that maintains school student records from more than one school, but does not include a private or non-public school.

"School authority" means any school board, school district, board of directors, or other governing body of a school established under the School Code or through any other means.

"School student record" means any writing or other recorded information concerning a student by which a student may be individually or personally identified that is maintained by a school or at its direction or by an employee of a school, regardless of how or where the information is stored. Writings or other recorded information maintained by an employee of a school or other person at the direction of a school for his or her exclusive use shall not be deemed school student records under this Act; provided that all such writings and other recorded information are destroyed not later than the student's graduation or permanent withdrawal from the school and provided further that no such records or recorded information may be released or disclosed to any person except a person designated by the school as a substitute, unless they are first incorporated in a school student record and made subject to all of the provisions of this Act. "School student record" does not include information maintained by law enforcement professionals working in the school.

"State Board" means the State Board of Education.

"Student" means any person enrolled or previously enrolled in a school.

"Student permanent record" means the minimum personal information necessary to a school in the education of a student and contained in a school student record. Such information may include the student's name, birth date, address, grades and grade level, parents' names and addresses, and attendance records and such other entries as the State Board may require or authorize.

"Student temporary record" means all information contained in a school student record but not contained in the student permanent record. Such information may include family background information, intelligence test scores, aptitude test scores, psychological and personality test results, teacher evaluations, and other information of clear relevance to the education of the student, all subject to rules of the State Board. The information shall include information provided under Section 8.6 of the Abused and Neglected Child Reporting Act and information regarding serious disciplinary infractions that resulted in expulsion, suspension, or the imposition of a punishment or sanction. For purposes of this definition, "serious disciplinary infractions" means infractions involving drugs, weapons, or bodily harm to another.

(a) "Student" means any person enrolled or previously enrolled in a school.

(b) "School" means any public preschool, day care center, kindergarten, nursery, elementary or secondary educational institution, vocational school, special educational facility or any other elementary or secondary educational agency or institution and any person, agency or institution which maintains school student records from more than one school, but does not include a private or non-public school.

(c) "State Board" means the State Board of Education.

(d) "School Student Record" means any writing or other recorded information concerning a student and by which a student may be individually identified, maintained by a school or at its direction or by an employee of a school, regardless of how or where the information is stored. The following shall not be deemed school student records under this Act: writings or other recorded information maintained by an employee of a school or other person at the direction of a school for his or her exclusive use; provided that all such writings and other recorded information are destroyed not later than the student's graduation or permanent withdrawal from the school; and provided further that no such records or recorded information may be released or disclosed to any person except a person designated by the school as a substitute unless they are first incorporated in a school student record and made subject to all of the provisions of this Act. School student records shall not include information maintained by law enforcement professionals working in the school.

(e) "Student Permanent Record" means the minimum personal information necessary to a school in the education of the student and contained in a school student record. Such information may include the student's name, birth date, address, grades and grade level, parents' names and addresses, attendance records, and such other entries as the State Board may require or authorize.

(f) "Student Temporary Record" means all information contained in a school student record but not contained in the student permanent record. Such information may include family background information, intelligence test scores, aptitude test scores, psychological and personality test results, teacher evaluations, and other information of clear relevance to the education of the student, all subject to regulations of the State Board. The information shall include information provided under Section 8.6 of the Abused and Neglected Child Reporting Act. In addition, the student temporary record shall include information regarding serious disciplinary infractions that resulted in expulsion, suspension, or the imposition of punishment or sanction. For purposes of this provision, serious disciplinary infractions means: infractions involving drugs, weapons, or bodily harm to another.

(g) "Parent" means a person who is the natural parent of the student or other person who has the primary responsibility for the care and upbringing of the student. All rights and privileges accorded to a parent under this Act shall become exclusively those of the student upon his 18th birthday, graduation from secondary school, marriage or entry into military service, whichever occurs first. Such rights and privileges may also be exercised by the student at any time with respect to the student's permanent school record.

(Source: P.A. 92-295, eff. 1-1-02.)

(105 ILCS 10/6) (from Ch. 122, par. 50-6)

Sec. 6. (a) No school student records or information contained therein may be released, transferred, disclosed or otherwise disseminated, except as follows:

(1) to a parent or student or person specifically designated as a representative by a parent, as provided in paragraph (a) of Section 5;

(2) to an employee or official of the school or school district or State Board with current demonstrable educational or administrative interest in the student, in furtherance of such interest;

(3) to the official records custodian of another school within Illinois or an official with similar responsibilities of a school outside Illinois, in which the student has enrolled, or intends to enroll, upon the request of such official or student;

(4) to any person for the purpose of research, statistical reporting, or planning, provided that such research, statistical reporting, or planning is permissible under and undertaken in accordance with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g);

(5) pursuant to a court order, provided that the parent shall be given prompt written notice upon receipt of such order of the terms of the order, the nature and substance of the information proposed to be released in compliance with such order and an opportunity to inspect and copy the school student records and to challenge their contents pursuant to Section 7;

(6) to any person as specifically required by State or federal law;

(6.5) to juvenile authorities when necessary for the discharge of their official duties who request information prior to adjudication of the student and who certify in writing that the information will not be disclosed to any other party except as provided under law or order of court. For purposes of this Section "juvenile authorities" means: (i) a judge of the circuit court and members of the staff of the court designated by the judge; (ii) parties to the proceedings under the Juvenile Court Act of 1987 and their attorneys; (iii) probation officers and court appointed advocates for the juvenile authorized by the judge hearing the case; (iv) any individual, public or private agency having custody of the child pursuant to court order; (v) any individual, public or private agency providing education, medical or mental health service to the child when the requested information is needed to determine the appropriate service or treatment for the minor; (vi) any potential placement provider when such release is authorized by the court for the limited purpose of determining the appropriateness of the potential placement; (vii) law enforcement officers and prosecutors; (viii) adult and juvenile prisoner review boards; (ix) authorized military personnel; (x) individuals authorized by court;

(7) subject to regulations of the State Board, in connection with an emergency, to appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons;

(8) to any person, with the prior specific dated written consent of the parent designating the person to whom the records may be released, provided that at the time any such consent is requested or obtained, the parent shall be advised in writing that he has the right to inspect and copy such records in accordance with Section 5, to challenge their contents in accordance with Section 7 and to limit any such consent to designated records or designated portions of the information contained therein;

(9) to a governmental agency, or social service agency contracted by a governmental agency, in furtherance of an investigation of a student's school attendance pursuant to the compulsory student attendance laws of this State, provided that the records are released to the employee or agent designated by the agency;

(10) to those SHOCAP committee members who fall within the meaning of "state and local officials and authorities", as those terms are used within the meaning of the federal Family Educational Rights and Privacy Act, for the purposes of identifying serious habitual juvenile offenders and matching those offenders with community resources pursuant to Section 5-145 of the Juvenile Court Act of 1987, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the Family Educational Rights and Privacy Act;

(11) to the Department of Healthcare and Family Services in furtherance of the requirements of Section 2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or Section 10 of the School Breakfast and Lunch Program Act; or

(12) to the State Board or another State government agency or between or among State government agencies in order to evaluate or audit federal and State programs or perform research and planning, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g).

(a-5) Pursuant to subparagraph (4) of paragraph (a) of this Section, a school authority or the State Board may provide school student records to researchers at a research entity conducting research for, or on behalf of, a school, school authority, or the State Board if any such research is conducted in accordance with the federal Family Educational Rights and Privacy Act and does not take place until the following requirements are complied with:

(1) For those school authorities that maintain a website, the school authority shall maintain a webpage on the website that contains a short description of all current and scheduled research studies using personally identifiable information obtained from the school authority without obtaining consent from parents, including the nature of each study, the categories of students whose records will be used in each listed study, and the names of all research entities involved in each listed study. The school authority shall update the website to include any new or approved research studies at least 3 months but not more than 4 months after issuing the notice described in subparagraph (3) of this paragraph (a-5) and again at least 6 months but not more than 7 months after issuing the notice described in subparagraph (3) of this paragraph (a-5).

(2) For those school authorities that do not maintain a website, the school authority shall provide the information described in subparagraph (1) of this paragraph (a-5) in the same notice required in subparagraph (3) of this paragraph (a-5). The school authority shall provide supplemental notices that include any new or approved research studies at least 3 months but not more than 4 months after issuing the notice described in subparagraph (3) of this paragraph (a-5) and again at least 6 months but not more than 7 months after issuing the notice described in subparagraph (3) of this paragraph (a-5).

(3) Prior to the beginning of each school year, the school authority shall provide notice to parents, guardians and eligible students regarding current and scheduled research studies using personally identifiable information obtained from the school authority without obtaining consent from parents. The notice shall be sent by the same means generally used to send notices to parent, guardians, and eligible students and shall contain the following:

(A) the general purposes of conducting the educational research;

(B) the website address containing the information described in subparagraph (1) of this paragraph (a-5), if applicable, which website address shall also be set forth in the school authority's student handbook; and

(C) that the State Board conducts research studies and shall provide the website address for that part of the State Board's website that contains a list of the current and scheduled research studies to be conducted.

(4) A written data use agreement that complies with the federal Family Educational Rights and Privacy Act and its accompanying regulations and, at a minimum, contains the following provisions is entered into by and between the party gaining access to the records of the school authority or State Board and the entity with the legal authority to permit the use of the data:

(A) The research entity has read, understands, and will abide by all requirements of this paragraph (a-5).

(B) A statement of the purpose, scope, and duration of the research study or studies, as well as a description of the records to be used as part of the study and the person or persons to whom the records will be disclosed, provided that the list of persons to whom the records may be disclosed may be amended from time to time with the agreement of all parties to the data use agreement.

(C) The research entity shall use school student records only to meet the purpose or purposes of the study as set forth in subdivision (B) of this subparagraph (4).

(D) The research entity may only use records containing personally identifiable information of a student or by which a student may otherwise be individually or personally identified: (i) to link school student records of particular students to other records of the same students or (ii) to identify eligible students for research studies for which written parental, guardian, or eligible student consent will be obtained for participation and the person or persons to whom such information will be disclosed is set forth in the data use agreement.

(E) The research entity shall destroy all records containing personally identifiable information of a student or that otherwise individually or personally identifies a student when the information is no longer needed, but in no event later than 36 months after the research study has been completed.

(F) The research entity shall certify in writing that it has the capacity to and shall restrict access to school student records to the person or persons set forth in subdivision (b) of this subparagraph (4).

(G) The research entity shall certify in writing that it shall maintain the security of all records received pursuant to this paragraph (a-5) in compliance with rules adopted by the State Board, which rules shall be consistent and regularly updated to comply with commonly accepted data-security practices, including, but not limited to, those set forth by the United States Department of Education Privacy Technical Assistance Center.

(H) In compliance with the rules adopted pursuant to subdivision (g) of this subparagraph (4) and any other rules that may be necessary and adopted by the State Board, the research entity shall develop, implement, maintain, and use appropriate administrative, technical, and physical security measures to preserve the confidentiality and integrity of all school student records.

(5) Research entities may only use records containing personally identifiable information of a student or by which a student may otherwise be personally or individually identified: (i) to link school student records of particular students to other records of the same students or (ii) to identify eligible students for research studies for which written parental, guardian, or eligible student consent will be obtained for participation and the person or persons to whom such information will be disclosed is set forth in the data use agreement.

(6) The research entity shall use personally identifiable information from school student records only to meet the purpose or purposes of the research study or studies as stated in the data use agreement described in subparagraph (4).

(7) Any information by which a student may be individually or personally identified shall be released, transferred, disclosed, or otherwise disseminated only as contemplated by the written data use agreement described in subparagraph (4).

(8) All school student records shall have personally identifiable information removed prior to analysis by the research entity.

(9) The research entity shall implement and adhere to policies and procedures that restrict access to records that have personally identifiable information.

(A) The research entity shall designate an individual to act as the custodian of the records with personally identifiable information who is responsible for restricting access to those records and provide the name of that individual to the entity with the legal authority to permit the use of the records.

(B) Any personally identifiable information used to link school student records of particular students to other records of the same students shall be securely stored in a location separate and apart from the location of the school student records that have had personally identifiable data removed.

Nothing in this subparagraph (a-5) shall prohibit the State Board or any school authority from providing personally identifiable information about individual students to a research entity pursuant to a specific, written agreement with a school authority or State Board and in accordance with the federal Family Educational Rights and Privacy Act, where necessary for the school board or State Board to comply with State or federal statutory mandates.

(b) No information may be released pursuant to subparagraph (3) or (6) of paragraph (a) of this Section 6 unless the parent receives prior written notice of the nature and substance of the information proposed to be released, and an opportunity to inspect and copy such records in accordance with Section 5 and to challenge their contents in accordance with Section 7. Provided, however, that such notice shall be sufficient if published in a local newspaper of general circulation or other publication directed generally to the parents involved where the proposed release of information is pursuant to subparagraph (6) of paragraph (a) of this Section 6 and relates to more than 25 students.

(c) A record of any release of information pursuant to this Section must be made and kept as a part of the school student record and subject to the access granted by Section 5. Such record of release shall be maintained for the life of the school student records and shall be available only to the parent and the official records custodian. Each record of release shall also include:

(1) the nature and substance of the information released;

(2) the name and signature of the official records custodian releasing such information;

(3) the name of the person requesting such information, the capacity in which such a request has been made, and the purpose of such request;

(4) the date of the release; and

(5) a copy of any consent to such release.

(d) Except for the student and his parents, no person to whom information is released pursuant to this Section and no person specifically designated as a representative by a parent may permit any other person to have access to such information without a prior consent of the parent obtained in accordance with the requirements of subparagraph (8) of paragraph (a) of this Section.

(e) Nothing contained in this Act shall prohibit the publication of student directories which list student names, addresses and other identifying information and similar publications which comply with regulations issued by the State Board.

(Source: P.A. 99-78, eff. 7-20-15.)

(105 ILCS 10/9) (from Ch. 122, par. 50-9)

Sec. 9. (a) Any person aggrieved by any violation of this Act may institute an action for injunctive relief in the Circuit Court of the County in which the violation has occurred or the Circuit Court of the County in which the school is located.

(b) Any person injured by a wilful or negligent violation of this Act may institute an action for damages in the Circuit Court of the County in which the violation has occurred or the Circuit Court of the County in which the school is located.

(c) In the case of any successful action under paragraph (a) or (b) of this Section, any person or school found to have wilfully or negligently violated any provision of this Act is liable to the plaintiff for the plaintiff's damages, the costs of the action and reasonable attorneys' fees, as determined by the Court.

(d) Actions for injunctive relief to secure compliance with this Act may be brought by the State Board, by the State's Attorney of the County in which the alleged violation has occurred or the State's Attorney of the County in which the school is located, in each case in the Circuit Court of such County.

(e) Wilful failure to comply with any Section of this Act is a petty offense; except that any person who wilfully and maliciously falsifies any school student record, student permanent record or student temporary record shall be guilty of a Class A misdemeanor.

(f) Absent proof of malice, no cause of action or claim for relief, civil or criminal, may be maintained against any school, or employee or official of a school or person acting at the direction of a school for any statement made or judgment expressed in any entry to a school student record of a type which does not violate this Act or the regulations issued by the State Board pursuant to this Act; provided that this paragraph (f) does not limit or deny any defense available under existing law.

(g) In addition to any other penalties and remedies provided by this Section, any research entity that is found in any civil, criminal, or administrative proceeding authorized by this Section to have violated the requirements of paragraph (a-5) of Section 6 of this Act shall immediately cease conducting any research that utilizes school student records and shall be prohibited from conducting additional research studies based on such records and information for a period of 12 months after the date of the discovery of the violation.

(h) In addition to any other penalties and remedies provided by this Section, any school authority that is found in any civil, criminal, or administrative proceeding authorized by this Section to have violated the requirements of paragraph (a-5) of Section 6 of this Act shall be prohibited from entering into a data use agreement with any research entity for a period of 12 months after the date of the discovery of the violation, and all existing data use agreements governed by paragraph (a-5) of Section 6 of this Act shall be voided.

(Source: P.A. 84-712.)

Section 15. The Children's Privacy Protection and Parental Empowerment Act is amended by changing Section 5 as follows:

(325 ILCS 17/5)

Sec. 5. Definitions. As used in this Act:

"Child" means a person under the age of 18 16. "Child" does not include a minor emancipated by operation of law.

"Parent" means a parent, step-parent, or legal guardian.

"Personal information" means any of the following:

(1) A person's name.

(2) A person's address.

(3) A person's telephone number.

(4) A person's driver's license number or State of Illinois identification card as assigned by the Illinois Secretary of State or by a similar agency of another state.

(5) A person's social security number.

(6) Any other information that can be used to locate or contact a specific individual.

"Personal information" does not include any of the following:

(1) Public records as defined by Section 2 of the Freedom of Information Act.

(2) Court records.

(3) Information found in publicly available sources, including newspapers, magazines, and telephone directories.

(4) Any other information that is not known to concern a child.

(Source: P.A. 93-462, eff. 1-1-04.)".