Rep. Scott Drury

Filed: 5/27/2014

 

 


 

 


 
09800SB3092ham001LRB098 15075 KTG 59710 a

1
AMENDMENT TO SENATE BILL 3092

2    AMENDMENT NO. ______. Amend Senate Bill 3092 by replacing
3everything after the enacting clause with the following:
 
4    "Section 5. The Illinois School Student Records Act is
5amended by changing Sections 2 and 6 as follows:
 
6    (105 ILCS 10/2)  (from Ch. 122, par. 50-2)
7    Sec. 2. As used in this Act,
8    (a) "Student" means any person enrolled or previously
9enrolled in a school.
10    (b) "School" means any public preschool, day care center,
11kindergarten, nursery, elementary or secondary educational
12institution, vocational school, special educational facility
13or any other elementary or secondary educational agency or
14institution and any person, agency or institution which
15maintains school student records from more than one school, but
16does not include a private or non-public school.

 

 

09800SB3092ham001- 2 -LRB098 15075 KTG 59710 a

1    (c) "State Board" means the State Board of Education.
2    (d) "School Student Record" means any writing or other
3recorded information concerning a student and by which a
4student may be individually or personally identified,
5maintained by a school or at its direction or by an employee of
6a school, regardless of how or where the information is stored.
7The following shall not be deemed school student records under
8this Act: writings or other recorded information maintained by
9an employee of a school or other person at the direction of a
10school for his or her exclusive use; provided that all such
11writings and other recorded information are destroyed not later
12than the student's graduation or permanent withdrawal from the
13school; and provided further that no such records or recorded
14information may be released or disclosed to any person except a
15person designated by the school as a substitute unless they are
16first incorporated in a school student record and made subject
17to all of the provisions of this Act. School student records
18shall not include information maintained by law enforcement
19professionals working in the school.
20    (e) "Student Permanent Record" means the minimum personal
21information necessary to a school in the education of the
22student and contained in a school student record. Such
23information may include the student's name, birth date,
24address, grades and grade level, parents' names and addresses,
25attendance records, and such other entries as the State Board
26may require or authorize.

 

 

09800SB3092ham001- 3 -LRB098 15075 KTG 59710 a

1    (f) "Student Temporary Record" means all information
2contained in a school student record but not contained in the
3student permanent record. Such information may include family
4background information, intelligence test scores, aptitude
5test scores, psychological and personality test results,
6teacher evaluations, and other information of clear relevance
7to the education of the student, all subject to regulations of
8the State Board. The information shall include information
9provided under Section 8.6 of the Abused and Neglected Child
10Reporting Act. In addition, the student temporary record shall
11include information regarding serious disciplinary infractions
12that resulted in expulsion, suspension, or the imposition of
13punishment or sanction. For purposes of this provision, serious
14disciplinary infractions means: infractions involving drugs,
15weapons, or bodily harm to another.
16    (g) "Parent" means a person who is the natural parent of
17the student or other person who has the primary responsibility
18for the care and upbringing of the student. All rights and
19privileges accorded to a parent under this Act shall become
20exclusively those of the student upon his 18th birthday,
21graduation from secondary school, marriage or entry into
22military service, whichever occurs first. Such rights and
23privileges may also be exercised by the student at any time
24with respect to the student's permanent school record.
25    (h) "Eligible Student" means a student who has reached 18
26years of age.

 

 

09800SB3092ham001- 4 -LRB098 15075 KTG 59710 a

1(Source: P.A. 92-295, eff. 1-1-02.)
 
2    (105 ILCS 10/6)  (from Ch. 122, par. 50-6)
3    Sec. 6. (a) No school student records or information
4contained therein may be released, transferred, disclosed or
5otherwise disseminated, except as follows:
6        (1) To a parent or student or person specifically
7    designated as a representative by a parent, as provided in
8    paragraph (a) of Section 5. ;
9        (2) To an employee or official of the school or school
10    district or State Board with current demonstrable
11    educational or administrative interest in the student, in
12    furtherance of such interest. ;
13        (3) To the official records custodian of another school
14    within Illinois or an official with similar
15    responsibilities of a school outside Illinois, in which the
16    student has enrolled, or intends to enroll, upon the
17    request of such official or student. ;
18        (4) Except as set forth in subparagraph (4.5) of this
19    paragraph (a), to To any person or entity for the purpose
20    of research, statistical reporting, or planning, audit, or
21    evaluation, provided that (i) such research, statistical
22    reporting, or planning, audit, or evaluation is
23    permissible under and undertaken in accordance with the
24    federal Family Educational Rights and Privacy Act (20
25    U.S.C. 1232g) and (ii) the school board, school district,

 

 

09800SB3092ham001- 5 -LRB098 15075 KTG 59710 a

1    school, or State Board requires the person or entity to do
2    the following:
3            (A) Not use, share, disclose, or compile the school
4        student records or information contained therein for
5        any purpose other than that for which the information
6        is provided, which purpose shall be set forth in
7        writing by the school board, school district, school,
8        or State Board and signed by the person or entity.
9            (B) Not use, share, disclose, or compile the school
10        student records or information contained therein for
11        any commercial purpose, including, but not limited to,
12        advertising or profiling.
13            (C) Not, in any way whatsoever, allow, facilitate,
14        or aid in the marketing or advertising of a product or
15        service to a student whose school student records or
16        the information contained therein has been received by
17        the person or entity.
18            (D) Take all reasonable steps to protect the school
19        student records and information contained therein in a
20        manner that meets or exceeds reasonable and
21        appropriate commercial best practices. Where the
22        school student records or information contained
23        therein is maintained in an electronic format,
24        reasonable and appropriate commercial best practices
25        include, at a minimum, all of the following:
26                (i) Valid encryption processes for data at

 

 

09800SB3092ham001- 6 -LRB098 15075 KTG 59710 a

1            rest in the person or entity's own data storage
2            systems that are consistent with NIST Special
3            Publication 800-111, Guide to Storage Encryption
4            Technologies for End User Devices.
5                (ii) Valid encryption processes for data in
6            motion on public networks that comply, as
7            appropriate, with NIST Special Publications
8            800-52, Guidelines for the Selection and Use of
9            Transport Layer Security (TLS) Implementations;
10            NIST Special Publication 800-77, Guide to IPsec
11            VPNs; or NIST Special Publication 800-113, Guide
12            to SSL VPNs, or others that are Federal Information
13            Processing Standards (FIPS) Publication 140-2
14            validated.
15            (E) Delete a school student record and information
16        contained therein if any of the following occurs:
17                (i) The school student record and information
18            contained therein is no longer being used for the
19            purpose directed by the school board, school
20            district, school, or State Board.
21                (ii) A parent or eligible student requests
22            deletion, unless the school student record or
23            information contained therein is being used or
24            maintained at the direction of a school board,
25            school district, or school, or the State Board and
26            is under the direct control of such school board,

 

 

09800SB3092ham001- 7 -LRB098 15075 KTG 59710 a

1            school district, school, or State Board.
2                (iii) The school board, school district,
3            school, or State Board requests deletion.
4        (4.1) Nothing in paragraph (4) shall prohibit a person
5    or entity from sharing, disclosing, or compiling school
6    student records or the information contained therein if
7    other provisions of federal or State law require such
8    sharing, disclosure, or compilation, and the person or
9    entity complies with the requirements of federal and State
10    law in protecting that information.
11        (4.2) If a school board, school district, or school, or
12    the State Board is unable to gain compliance by a person or
13    entity with the requirements of paragraph (4), but
14    determines that releasing, transferring, disclosing, or
15    otherwise disseminating school student records or
16    information contained therein to such a person or entity is
17    essential to an educational objective, the school board,
18    school district, school, or State Board may release,
19    transfer, disclose, or otherwise disseminate such school
20    student records and the information contained therein
21    provided that all of the following occurs:
22            (A) The school board, school district, school, or
23        State Board publicly notifies parents and eligible
24        students at least 21 days in advance of the student's
25        school student records or information contained
26        therein being released, transferred, disclosed, or

 

 

09800SB3092ham001- 8 -LRB098 15075 KTG 59710 a

1        otherwise disseminated of: (i) the planned release,
2        transfer, disclosure, or dissemination; and (ii) the
3        purpose of the planned release, transfer, disclosure,
4        or dissemination.
5            (B) The school board, school district, school, or
6        State Board provides parents and eligible students
7        with (i) the opportunity to opt out of having the
8        relevant school student records or information
9        contained therein released, transferred, disclosed, or
10        otherwise disseminated; and (ii) instructions setting
11        forth how to opt out. ;
12        (4.5) To researchers at an accredited post-secondary
13    educational institution or an organization conducting
14    research pursuant to a specific, written agreement with the
15    school or school district or State Board and in accordance
16    with the federal Family Educational Rights and Privacy Act,
17    provided that such researchers and organizations comply
18    with the following requirements:
19            (A) The nature of the research shall be first
20        publicly disclosed in advance of the research being
21        conducted by providing general notice regarding
22        planned studies or research to parents, guardians, or
23        eligible students prior to the beginning of each school
24        year and by posting an updated notice of additional
25        research or studies on the Internet website of the
26        school board, school district, school, or State Board

 

 

09800SB3092ham001- 9 -LRB098 15075 KTG 59710 a

1        as additional research or studies are added. If the
2        school board, school district, or school does not have
3        an Internet website that can be updated with notice of
4        additional research or studies, the school board,
5        school district, or school shall send written
6        notification to affected parents, guardians, or
7        eligible students as additional research or studies
8        are added. Any notice provided under this paragraph
9        shall set forth, in general terms, the nature of the
10        research, the persons to whom the research will apply,
11        and the topics thereof. The notice requirements in this
12        paragraph do not apply to eligible students or parents
13        or guardians of students who have graduated or left the
14        school, school district, or State as of the effective
15        date of this amendatory Act of the 98th General
16        Assembly.
17            (B) The post-secondary educational institution or
18        an organization conducting research and the school,
19        school district, or State Board shall enter into a data
20        use agreement which shall be signed by the party
21        gaining access to the data and the school board, school
22        district, or school and which complies with the federal
23        Family Educational Rights and Privacy Act and its
24        accompanying regulations and, at a minimum, sets forth
25        the following:
26                (i) a requirement that the post-secondary

 

 

09800SB3092ham001- 10 -LRB098 15075 KTG 59710 a

1            educational institution or the organization
2            conducting research shall abide by all
3            requirements of this subdivision (B);
4                (ii) the purpose, scope, subjects, and
5            duration of the study or studies, the information
6            to be disclosed, and the person or persons to whom
7            the information shall be disclosed; the person or
8            persons to whom the information shall be disclosed
9            may be updated to include additional persons;
10                (iii) a requirement that the persons described
11            in item (ii) shall use school student records only
12            to meet the purpose or purposes of the study as set
13            forth pursuant to item (ii) and only after written
14            or other recorded information concerning a student
15            and by which a student may be individually
16            identified has been removed from such records;
17                (iv) a requirement that the post-secondary
18            educational institution or the organization
19            conducting research shall use written or other
20            recorded information concerning a student and by
21            which a student may be individually or personally
22            identified only to link data files and, in such
23            instances, the post-secondary educational
24            institution or the organization conducting
25            research shall designate in writing the person or
26            persons to whom such information will be

 

 

09800SB3092ham001- 11 -LRB098 15075 KTG 59710 a

1            disclosed;
2                (v) a requirement that the post-secondary
3            educational institution or the organization
4            conducting research shall destroy all written or
5            other recorded information that individually or
6            personally identifies a student when the
7            information is no longer needed, but in no event
8            later than 36 months after the study has been
9            completed;
10                (vi) a requirement that the post-secondary
11            educational institution or the organization
12            conducting research shall certify in writing that
13            it has the capacity to and shall restrict access to
14            school student records and shall maintain the
15            security of all written and electronic information
16            received pursuant to this Section in compliance
17            with rules that shall be adopted by the State
18            Board, which shall be consistent with and
19            regularly updated to comply with commonly accepted
20            data-security practices, including, but not
21            limited to, those set forth by the United States
22            Department of Education Privacy Technical
23            Assistance Center;
24                (vii) a requirement that, in compliance with
25            the rules adopted pursuant to item (vi), the
26            post-secondary educational institution or the

 

 

09800SB3092ham001- 12 -LRB098 15075 KTG 59710 a

1            organization conducting research shall develop,
2            implement, maintain, and use appropriate
3            administrative, technical, and physical security
4            measures to preserve the confidentiality,
5            integrity, and availability of all school student
6            records.
7            (C) The post-secondary educational institution or
8        the organization conducting research shall use
9        personally identifiable information from school
10        student records only to meet the purpose or purposes of
11        the study as stated in the written data use agreement
12        described in subdivision (B) of this subparagraph
13        (4.5).
14        For purposes of this subparagraph (4.5), any
15    information by which a student may be individually or
16    personally identified shall be released, transferred,
17    disclosed, or otherwise disseminated only as contemplated
18    by the data use agreement between the parties containing
19    the provisions set forth in subdivision (B) of this
20    subparagraph (4.5). The school student records shall be
21    redacted prior to analysis by the post-secondary
22    educational institution or the organization conducting
23    research. Any personally identifiable information used to
24    link data sets shall be stored in a secure data file or
25    location outside of the secure data storage where redacted
26    information from the school student records is stored. The

 

 

09800SB3092ham001- 13 -LRB098 15075 KTG 59710 a

1    post-secondary educational institution or the organization
2    conducting research shall implement and adhere to policies
3    and procedures that restrict access to information by which
4    a student may be individually or personally identified. The
5    post-secondary educational institution or the organization
6    conducting research shall designate an individual to act as
7    the custodian of the personally identifiable information
8    who is responsible for restricting access to that
9    information.
10        Nothing in this subparagraph (4.5) shall prohibit the
11    State Board or any school or school district from providing
12    personally identifiable information about individual
13    students to an accredited post-secondary educational
14    institution or an organization conducting research
15    pursuant to a specific, written agreement with the school
16    or school district or State Board and in accordance with
17    the federal Family Educational Rights and Privacy Act,
18    where necessary for the State Board, school, or school
19    district to comply with State or federal statutory
20    mandates.
21        (5) Pursuant to a court order, provided that the parent
22    shall be given prompt written notice upon receipt of such
23    order of the terms of the order, the nature and substance
24    of the information proposed to be released in compliance
25    with such order and an opportunity to inspect and copy the
26    school student records and to challenge their contents

 

 

09800SB3092ham001- 14 -LRB098 15075 KTG 59710 a

1    pursuant to Section 7. ;
2        (6) To any person as specifically required by State or
3    federal law. ;
4        (6.5) To juvenile authorities when necessary for the
5    discharge of their official duties who request information
6    prior to adjudication of the student and who certify in
7    writing that the information will not be disclosed to any
8    other party except as provided under law or order of court.
9    For purposes of this Section "juvenile authorities" means:
10    (i) a judge of the circuit court and members of the staff
11    of the court designated by the judge; (ii) parties to the
12    proceedings under the Juvenile Court Act of 1987 and their
13    attorneys; (iii) probation officers and court appointed
14    advocates for the juvenile authorized by the judge hearing
15    the case; (iv) any individual, public or private agency
16    having custody of the child pursuant to court order; (v)
17    any individual, public or private agency providing
18    education, medical or mental health service to the child
19    when the requested information is needed to determine the
20    appropriate service or treatment for the minor; (vi) any
21    potential placement provider when such release is
22    authorized by the court for the limited purpose of
23    determining the appropriateness of the potential
24    placement; (vii) law enforcement officers and prosecutors;
25    (viii) adult and juvenile prisoner review boards; (ix)
26    authorized military personnel; (x) individuals authorized

 

 

09800SB3092ham001- 15 -LRB098 15075 KTG 59710 a

1    by court. ;
2        (7) Subject to regulations of the State Board, in
3    connection with an emergency, to appropriate persons if the
4    knowledge of such information is necessary to protect the
5    health or safety of the student or other persons. ;
6        (8) To any person, with the prior specific dated
7    written consent of the parent designating the person to
8    whom the records may be released, provided that at the time
9    any such consent is requested or obtained, the parent shall
10    be advised in writing that he has the right to inspect and
11    copy such records in accordance with Section 5, to
12    challenge their contents in accordance with Section 7 and
13    to limit any such consent to designated records or
14    designated portions of the information contained therein.
15    ;
16        (9) To a governmental agency, or social service agency
17    contracted by a governmental agency, in furtherance of an
18    investigation of a student's school attendance pursuant to
19    the compulsory student attendance laws of this State,
20    provided that the records are released to the employee or
21    agent designated by the agency. ;
22        (10) To those SHOCAP committee members who fall within
23    the meaning of "state and local officials and authorities",
24    as those terms are used within the meaning of the federal
25    Family Educational Rights and Privacy Act, for the purposes
26    of identifying serious habitual juvenile offenders and

 

 

09800SB3092ham001- 16 -LRB098 15075 KTG 59710 a

1    matching those offenders with community resources pursuant
2    to Section 5-145 of the Juvenile Court Act of 1987, but
3    only to the extent that the release, transfer, disclosure,
4    or dissemination is consistent with the Family Educational
5    Rights and Privacy Act. ;
6        (11) To the Department of Healthcare and Family
7    Services in furtherance of the requirements of Section
8    2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or
9    Section 10 of the School Breakfast and Lunch Program Act. ;
10    or
11        (12) To the State Board or another State government
12    agency or between or among State government agencies in
13    order to evaluate or audit federal and State programs or
14    perform research and planning, but only to the extent that
15    the release, transfer, disclosure, or dissemination is
16    consistent with the federal Family Educational Rights and
17    Privacy Act (20 U.S.C. 1232g).
18    (b) No information may be released pursuant to
19subparagraphs (3) or (6) of paragraph (a) of this Section 6
20unless the parent receives prior written notice of the nature
21and substance of the information proposed to be released, and
22an opportunity to inspect and copy such records in accordance
23with Section 5 and to challenge their contents in accordance
24with Section 7. Provided, however, that such notice shall be
25sufficient if published in a local newspaper of general
26circulation or other publication directed generally to the

 

 

09800SB3092ham001- 17 -LRB098 15075 KTG 59710 a

1parents involved where the proposed release of information is
2pursuant to subparagraph 6 of paragraph (a) in this Section 6
3and relates to more than 25 students.
4    (c) A record of any release of information pursuant to this
5Section must be made and kept as a part of the school student
6record and subject to the access granted by Section 5. Such
7record of release shall be maintained for the life of the
8school student records and shall be available only to the
9parent and the official records custodian. Each record of
10release shall also include:
11        (1) The nature and substance of the information
12    released;
13        (2) The name and signature of the official records
14    custodian releasing such information;
15        (3) The name of the person requesting such information,
16    the capacity in which such a request has been made, and the
17    purpose of such request;
18        (4) The date of the release; and
19        (5) A copy of any consent to such release.
20    (d) Except for the student and his parents, no person to
21whom information is released pursuant to this Section and no
22person specifically designated as a representative by a parent
23may permit any other person to have access to such information
24without a prior consent of the parent obtained in accordance
25with the requirements of subparagraph (8) of paragraph (a) of
26this Section.

 

 

09800SB3092ham001- 18 -LRB098 15075 KTG 59710 a

1    (e) Nothing contained in this Act shall prohibit the
2publication of student directories which list student names,
3addresses and other identifying information and similar
4publications which comply with regulations issued by the State
5Board.
6(Source: P.A. 95-331, eff. 8-21-07; 95-793, eff. 1-1-09;
796-107, eff. 7-30-09; 96-1000, eff. 7-2-10.)
 
8    Section 10. The Children's Privacy Protection and Parental
9Empowerment Act is amended by changing Section 10 as follows:
 
10    (325 ILCS 17/10)
11    Sec. 10. Prohibited act.
12    (a) The sale or purchase of personal information concerning
13an individual known to be a child without parental consent is
14prohibited.
15    (b) This Section does not apply when the sale or purchase
16described in subsection (a) is made under a criminal or civil
17investigation that is otherwise lawful.
18(Source: P.A. 93-462, eff. 1-1-04.)
 
19    (325 ILCS 17/15 rep.)
20    Section 15. The Children's Privacy Protection and Parental
21Empowerment Act is amended by repealing Section 15.".