HB0810eng 99TH GENERAL ASSEMBLY

HB0810 Engrossed LRB099 04620 NHT 24649 b

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The School Code is amended by adding Sections 22-80 and 22-81 as follows:

(105 ILCS 5/22-80 new)

Sec. 22-80. Student data privacy.

(a) It is the intent of the General Assembly to help ensure that information generated by and about students in the course of, and in connection with, their education is safeguarded and that student privacy is honored, respected and protected. The General Assembly finds the following:

(1) Information generated by and about students in the course of, and in connection with, their education is a vital resource for teachers and school staff in planning education programs and services, scheduling students into appropriate classes and completing reports for educational agencies.

(2) Information generated by and about students in the course of, and in connection with, their education is critical to educators in helping students successfully graduate from high school and being ready to enter the workforce or postsecondary education.

(3) While information generated by and about students in the course of, and in connection with, their education is important for educational purposes, it is also critically important to ensure that the information is protected, safeguarded and kept private and used only by appropriate educational authorities or their permitted designees and then, only to serve the best interests of the student.

To that end, this Section will help ensure that information generated by and about students in the course of, and in connection with, their education is protected and expectations of privacy are honored.

(b) In this Section:

"Biometric record" shall have the meaning set forth in the Illinois School Student Records Act.

"Eligible student" shall have the meaning set forth in the Illinois School Student Records Act.

"Parent" shall have the meaning set forth in the Illinois School Student Records Act.

"Personally identifiable information" shall have the meaning set forth in the Illinois School Student Records Act.

"Record" shall have the meaning set forth in the Illinois School Student Records Act.

"School" shall have the meaning set forth in the Illinois School Student Records Act.

"School board" shall have the meaning set forth in the Illinois School Student Records Act.

"School student record" shall have the meaning set forth in the Illinois School Student Records Act.

"State Board" shall have the meaning set forth in the Illinois School Student Records Act.

"Student" shall have the meaning set forth in the Illinois School Student Records Act.

"Student data" means school student records, student permanent records, student temporary records, or any other records, personally identifiable information, or intellectual property of a student.

"Student permanent record" shall have the meaning set forth in the Illinois School Student Records Act.

"Student temporary record" shall have the meaning set forth in the Illinois School Student Records Act.

"Targeted advertising" means any form of advertising aimed directly at a specific individual or group of individuals based on a known or assumed trait or traits, including, but not limited to, age, gender, race, grade level, address, observed behavior, or academic achievement.

"Vendor" means any entity and its officers, employees, agents, independent contractors, and subcontractors that provides or offers to provide a product or service to a school board, which product or service is marketed or designed for school purposes or which the entity knows or reasonably should know will be used for school purposes.

(c) Any vendor who receives any student data from a school board or the State Board in any manner is prohibited from:

(1) advertising or marketing, including targeted advertising, based on:

(A) any information, including personally identifiable information, contained in the school student records, student permanent records, student temporary records, or any other records of a student;

(B) any information generated by or about students in connection with their use of the vendor's product or service; or

(C) any records created by the vendor as a result of students' use of the vendor's product or service;

(2) creating, generating, or otherwise amassing a profile about any student for any purpose other than to provide the school board with information about student academic growth or achievement;

(3) selling or otherwise disclosing the following to anyone other than the school board, unless such sale or disclosure is required by court order or to comply with the Illinois School Student Records Act or the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g) or is expressly authorized by this Section:

(A) any information, including personally identifiable information, contained in the school student records, student permanent records, student temporary records, or any other records of a student;

(B) any information generated by or about students in connection with their use of the vendor's product or service;

(C) any records created by the vendor as a result of students' use of the vendor's product or service; or

(D) any student's intellectual property;

(4) exercising or claiming any rights, implied or otherwise, to:

(A) any information, including personally identifiable information, contained in the school student records, student permanent records, student temporary records, or any other records of a student;

(B) any information generated by or about students in connection with their use of the vendor's product or service;

(C) any records created by the vendor as a result of students' use of the vendor's product or service; or

(D) any student's intellectual property;

(5) storing or processing outside the United States:

(A) any information, including personally identifiable information, contained in the school student records, student permanent records, student temporary records or any other records of a student;

(B) any information generated by or about students in connection with their use of the vendor's product or service;

(C) any records created by the vendor as a result of students' use of the vendor's product or service; or

(D) any student's intellectual property;

(6) transferring the following to any third party (including subcontractors), affiliate, or government agency other than the State Board, unless required by court order or expressly authorized by the school board in compliance with this Section:

(A) any information, including personally identifiable information, contained in the school student records, student permanent records, student temporary records, or any other records of a student;

(B) any information generated by or about students in connection with their use of the vendor's product or service;

(C) any records created by the vendor as a result of students' use of the vendor's product or service; or

(D) any student's intellectual property;

(7) permitting access by anyone to the following, unless such access is required for the vendor to provide its product or service to the school board:

(A) any information, including personally identifiable information, contained in the school student records, student permanent records, student temporary records or any other records of a student;

(B) any information generated by or about students in connection with their use of the vendor's product or service;

(C) any records created by the vendor as a result of students' use of the vendor's product or service; or

(D) any student's intellectual property;

(8) requiring a school board or its employees, agents, volunteers, or students to indemnify a vendor or pay the vendor's attorneys' fees or costs in connection with any dispute arising out of, or otherwise connected to, student data;

(9) requiring a school board or its employees, agents, volunteers, or students to arbitrate any dispute arising out of, or otherwise connected to, student data;

(10) entering into any contract or other agreement with a school board that authorizes in any manner activities prohibited by this Section; and

(11) modifying or otherwise altering the terms and conditions of any contract or other agreement with a school board related to student data without the express consent of the school board.

(d) Any vendor who receives any student data from a school board or the State Board in any manner shall:

(1) store and process such records and information in accordance with commercial best practices, which shall include, but not be limited to, data-security practices set forth by the United States Department of Education Privacy Technical Assistance Center and any rules adopted by the State Board;

(2) implement and maintain appropriate administrative, physical, and technical safeguards, to secure such records and information from unauthorized access, destruction, use, modification, or disclosure, which safeguards shall be consistent with any rules adopted by the State Board and any guidance provided by the United States Department of Education Privacy and Technical Assistance Center;

(3) immediately notify the school board of any security breach resulting in unauthorized access to any student data, regardless of whether it is the school board's student data;

(4) delete the personally identifiable information of a specific student:

(A) at the request of the student's school or school board; or

(B) at the request of an eligible student or a parent, provided the school board consents to the request;

(5) designate an officer or employee as a responsible person who shall be trained in a manner so as to ensure compliance with this Section and ensure the security and confidentiality of student data;

(6) within 30 days of the completion or termination of the terms of any contract with a school board related to student data, delete or return to the school board all student data and information and records generated therefrom and, in the event of deletion, provide a written certification that such deletion has occurred. In the event the vendor chooses to delete the data, records, and information described in this subdivision (6), it shall provide the school board with a written certification that the data, records, and information have been deleted, which certification shall be provided to the school board within 30 days of the termination of the contract;

(7) permit eligible students and parents to access and correct any information contained in the school student records, student permanent records, student temporary records, or any other records provided to the vendor by the school board;

(8) permit a school board to audit and inspect the vendor's practices with respect to any student data received by the vendor from the school board or any information or records generated therefrom;

(9) permit the school board access to any student data provided by the school board and any information and records generated therefrom in order for the school board to respond to a request under the Freedom of Information Act or pursuant to a court order;

(10) be permitted to diagnose and correct problems with the vendor's product or service, provided that to diagnose or correct a problem does not require the vendor to engage in any activities prohibited by this Section; and

(11) agree that any dispute arising out of, or otherwise connected to, student data shall be litigated using Illinois law and that the proper venue is the circuit court of the county in which the school board is located.

(e) Any vendor who seeks to receive from a school board or the State Board in any manner any student data is required to enter into a written contract with the school board before any records can be transferred, which contract shall contain the following:

(1) provisions consistent with each requirement set forth in subsections (c) and (d) of this Section;

(2) a listing of the precise student data to be provided to the vendor;

(3) a statement of the product or service being provided to the school board by the vendor;

(4) a statement that the vendor is a school official with a legitimate educational interest, performing an institutional service or function for which the school board would otherwise use employees, under the direct control of the school board with respect to the use and maintenance of student data, and is using such student data only for an authorized purpose and will not re-disclose it to third parties or affiliates without permission from the school board or pursuant to court order;

(5) a statement that the student data continues to be the property of and under the control of the school board, and the vendor has a limited, nonexclusive license solely for the purpose of performing its obligations under the contract;

(6) a description of the actions the vendor will take to ensure the security and confidentiality of student data; compliance with this requirement shall not, in itself, absolve the vendor of liability in the event of an unauthorized disclosure of student data; and

(7) a statement that the contract is the entire agreement between the school board (including school board employees and other end users) and the vendor.

(f) Each school board shall adopt a policy regarding which school employees have the power to bind the school board to the terms of any agreements, whether electronic, click-through, click-wrap, verbal, or in writing. If a vendor enters into an agreement with an employee or other end users who are not authorized through the school board's policy to enter into such an agreement, then the agreement shall be voidable by the school board.

(g) Each school board entering into a contract or agreement as allowed by this Section shall maintain an original copy of its term and conditions at the school board's primary place of business, including a copy of the terms and conditions set forth in any agreement described in subsection (f) of this Section.

(h) The State Board shall create, publish, and make publicly available all data elements collected by the State Board that contain personally identifiable information.

(i) In the event of a security breach resulting, in whole or in part, from the vendor's conduct, in addition to any other remedies available to the school board under law or equity, the vendor shall reimburse the school board in full for all costs and expenses incurred by the school board in investigating and remediating the breach, including, but not limited to:

(1) providing notification to those students and their parents, in the event the student is under the age of 18, whose personally identifiable information was compromised and to regulatory agencies or other entities as required by law or contract;

(2) providing one year's credit monitoring to those students and eligible students whose student data was exposed in such a manner during the breach that a reasonable person would have cause to believe that it could impact his or her credit or financial security; and

(3) payment of legal fees, audit costs, fines, and other fees or damages imposed against the school board as a result of the security breach.

(j) The State Board shall develop, publish, and make publicly available model student data privacy policies and procedures that comply with relevant state and federal law.

(k) Within 180 days after the effective date of this amendatory Act of the 99th General Assembly, the State Board shall create a model notice that school boards may use to provide notice to parents that states, in general terms, what types of student data are collected by the school board and shared with vendors under this Section and the purposes of collecting and using the student data. Upon the creation of the notice described in this subsection (k), a school board shall, at the beginning of each school year, provide such notice in writing or electronically to parents and eligible students.

(l) In addition to any other penalties, any contract governed by this Section that fails to comply with the requirements of this Section shall be rendered void if, upon notice and a reasonable opportunity to cure, the noncompliant party fails to cure any defect. Written notice of noncompliance may be provided by either party to the contract. Any vendor subject to a contract voided under this subdivision is required, within 60 days, to return all student data and any information or records generated therefrom in its possession to the school board. Any vendor that fails to cure any defect in the contract shall not be entitled to any payment required under the contract and shall return to the school board all payments previously made by the school board.

(105 ILCS 5/22-81 new)

Sec. 22-81. Educator data privacy.

(a) It is the intent of the General Assembly to help ensure that information generated by and about educators in the course of, and in connection with, the performance of their duties is safeguarded and that educator privacy is honored, respected and protected. The General Assembly finds the following:

(1) Information generated by and about educators in the course of, and in connection with, the performance of their duties is a vital resource for school boards, the State Board and research organizations in planning education programs and services, completing reports for educational agencies, and improving the performance of schools.

(2) Information generated by and about educators in the course of, and in connection with, the performance of their duties is critical to the performance and improvement of schools.

(3) While information generated by and about educators in the course of, and in connection with, the performance of their duties is important for educational purposes, it is also critically important to ensure that the information is protected, safeguarded and kept private and used only by appropriate educational authorities or their permitted designees.

To that end, this Section will help ensure that information generated by and about educators in the course of, and in connection with, the performance of their duties is protected and expectations of privacy are honored.

(b) In this Section:

"Biometric record" shall have the meaning set forth in the Illinois School Student Records Act.

"Educator" means any person employed by or otherwise working for a school board to provide educational services within a school.

"Educator data" means educator records or any other records containing personally identifiable information of an educator.

"Educator record" means any writing or other recorded information concerning an educator by which an educator may be individually or personally identified maintained by a school or at its direction or by an employee of a school, regardless of how or where the information is stored.

"Personally identifiable information" means:

(1) the educator's name;

(2) the names of the educator's immediate family members;

(3) the address of the educator or educator's immediate family members;

(4) a personal identifier, such as the educator's social security number, student number, or biometric record;

(5) other indirect identifiers, such as the educator's date of birth, place of birth, and mother's maiden name;

(6) other information that, alone or in combination, is linked or linkable to a specific educator that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the educator with reasonable certainty; or

(7) information requested by a person who the educational agency or institution reasonably believes knows the identity of the educator to whom the record relates.

"Record" means any information recorded or generated in any way, including, but not limited to, electronically-generated data, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.

"School" shall have the meaning set forth in the Illinois School Student Records Act.

"School board" shall have the meaning set forth in the Illinois School Student Records Act.

"State Board" shall have the meaning set forth in the Illinois School Student Records Act.

"Targeted advertising" means any form of advertising aimed directly at a specific individual or group of individuals based on a known or assumed trait, or traits, including, but not limited to, age, gender, race, address, observed behavior, or classroom performance.

"Vendor" means any entity and its officers, employees, agents, independent contractors, and subcontractors that provides or offers to provide a product or service to a school board, which product or service is marketed or designed for school purposes or which the entity knows or reasonably should know will be used for school purposes.

(c) Any vendor who receives any educator data from a school board or the State Board in any manner is prohibited from:

(1) advertising or marketing, including targeted advertising, based on:

(A) any information, including personally identifiable information, contained in the educator records;

(B) any information generated by or about educators in connection with their use of the vendor's product or service; or

(C) any records created by the vendor as a result of educators' use of the vendor's product or service;

(2) creating, generating, or otherwise amassing a profile about any educator for any purpose other than to provide the school board with information about educator performance or achievement;

(3) selling or otherwise disclosing the following to anyone other than the school board, unless such sale or disclosure is required by court order or is expressly authorized by this Section:

(A) any information, including personally identifiable information, contained in the educator records;

(B) any information generated by or about educators in connection with their use of the vendor's product or service; or

(C) any records created by the vendor as a result of educators' use of the vendor's product or service;

(4) exercising or claiming any rights, implied or otherwise, to:

(A) any information, including personally identifiable information, contained in the educator records;

(B) any information generated by or about educators in connection with their use of the vendor's product or service; or

(C) any records created by the vendor as a result of educators' use of the vendor's product or service;

(5) storing or processing outside the United States:

(A) any information, including personally identifiable information, contained in the educator records;

(B) any information generated by or about educators in connection with their use of the vendor's product or service; or

(C) any records created by the vendor as a result of educators' use of the vendor's product or service;

(6) transferring the following to any third-party (including subcontractors), affiliate, or government agency other than the State Board, unless required by court order or expressly authorized by the school board in compliance with this Section:

(A) any information, including personally identifiable information, contained in the educator records;

(B) any information generated by or about educators in connection with their use of the vendor's product or service; or

(C) any records created by the vendor as a result of educators' use of the vendor's product or service;

(7) permitting access by anyone to the following, unless such access is required for the vendor to provide its product or service to the school board:

(A) any information, including personally identifiable information, contained in the educator records;

(B) any information generated by or about educators in connection with their use of the vendor's product or service; or

(C) any records created by the vendor as a result of educators' use of the vendor's product or service;

(8) requiring a school board or its employees, agents, volunteers, or educators to indemnify a vendor or pay the vendor's attorneys' fees or costs in connection with any dispute arising out of, or otherwise connected to, educator data;

(9) requiring a school board or its employees, agents, volunteers, or educators to arbitrate any dispute arising out of, or otherwise connected to, educator data;

(10) entering into any contract or other agreement with a school board that authorizes in any manner activities prohibited by this Section; and

(11) modifying or otherwise altering the terms and conditions of any contract or other agreement with a school board related to educator data without the express consent of the school board.

(d) Any vendor who receives any educator data from a school board or the State Board in any manner shall:

(1) store and process such records and information in accordance with commercial best practices, which shall include, but not be limited to, data-security practices set forth by the United States Department of Education Privacy Technical Assistance Center and any rules adopted by the State Board;

(2) implement and maintain appropriate administrative, physical, and technical safeguards, to secure such records and information from unauthorized access, destruction, use, modification, or disclosure, which safeguards shall be consistent with any rules adopted by the State Board and any guidance provided by the United States Department of Education Privacy and Technical Assistance Center;

(3) immediately notify the school board of any security breach resulting in unauthorized access to any educator data, regardless of whether it is the school board's educator data;

(4) delete the personally identifiable information of a specific educator:

(A) at the request of the educator's school or school board; or

(B) at the request of an educator, provided the school board consents to the request;

(5) designate an officer or employee as a responsible person who shall be trained in a manner so as to ensure compliance with this Section and ensure the security and confidentiality of student data;

(6) within 30 days of the completion or termination of the terms of any contract with a school board related to educator data, delete or return to the school board all educator data and information and records generated therefrom and, in the event of deletion, provide a written certification that such deletion has occurred. In the event the vendor chooses to delete the data, records, and information described in this subdivision (6), it shall provide the school board with a written certification that the data, records, and information have been deleted, which certification shall be provided to the school board within 30 days of the termination of the contract;

(7) permit educators to access and correct any information contained in the educator records provided to the vendor by the school board;

(8) permit a school board to audit and inspect the vendor's practices with respect to any educator data received by the vendor from the school board or any information or records generated therefrom;

(9) permit the school board access to any educator data provided by the school board and any information and records generated therefrom in order for the school board to respond to a request under the Freedom of Information Act or pursuant to a court order;

(10) be permitted to diagnose and correct problems with the vendor's product or service, provided that to diagnose or correct a problem does not require the vendor to engage in any activities prohibited by this Section; and

(11) agree that any dispute arising out of, or otherwise connected to, student data shall be litigated using Illinois law and that the proper venue is the circuit court of the county in which the school board is located.

(e) Any vendor who seeks to receive from a school board or the State Board in any manner any educator data is required to enter into a written contract with the school board before any records can be transferred, which contract shall contain the following:

(1) provisions consistent with each requirement set forth in subsections (c) and (d) of this Section;

(2) a listing of the precise educator data to be provided to the vendor;

(3) a statement of the product or service being provided to the school board by the vendor;

(4) a statement that the vendor is a school official with a legitimate educational interest, performing an institutional service or function for which the school board would otherwise use employees, under the direct control of the school board with respect to the use and maintenance of educator data, and is using such educator data only for an authorized purpose and will not re-disclose it to third parties or affiliates without permission from the school board or pursuant to court order;

(5) a statement that the educator data continues to be the property of and under the control of the school board, and the vendor has a limited, nonexclusive license solely for the purpose of performing its obligations under the contract;

(6) a description of the actions the vendor will take, including the designation and training of responsible employees, to ensure the security and confidentiality of educator data; compliance with this requirement shall not, in itself, absolve the vendor of liability in the event of an unauthorized disclosure of educator data; and

(7) a statement that the contract is the entire agreement between the school board (including school board employees and other end users) and the vendor.

(f) Each school board shall adopt a policy regarding which school employees have the power to bind the school board to the terms of any agreements, whether electronic, click-through, click-wrap, verbal, or in writing. If a vendor enters into an agreement with an employee or other end users who are not authorized through the school board's policy to enter into such an agreement, then the agreement shall be voidable by the school board.

(g) Each school board entering into a contract or agreement as allowed by this Section shall maintain an original copy of its term and conditions at the school board's primary place of business, including a copy of the terms and conditions set forth in any agreement described in subsection (f) of this Section.

(h) In the event of a security breach resulting, in whole or in part, from the vendor's conduct, in addition to any other remedies available to the school board under law or equity, the vendor shall reimburse the school board in full for all costs and expenses incurred by the school board in investigating and remediating the breach, including, but not limited to:

(1) providing notification to the educators whose personally identifiable information was compromised and to regulatory agencies or other entities as required by law or contract;

(2) providing one year's credit monitoring to those educators whose educator data was exposed in such a manner during the breach that a reasonable person would have cause to believe that it could impact his or her credit or financial security; and

(3) payment of legal fees, audit costs, fines, and other fees or damages imposed against the school board as a result of the security breach.

(i) The State Board shall develop, publish, and make publicly available model educator data privacy policies and procedures that comply with relevant state and federal law.

(j) In addition to any other penalties, any contract governed by this Section that fails to comply with the requirements of this Section shall be rendered void if, upon notice and a reasonable opportunity to cure, the noncompliant party fails to cure any defect. Written notice of noncompliance may be provided by either party to the contract. Any vendor subject to a contract voided under this subdivision is required, within 60 days, to return all student data and any information or records generated therefrom in its possession to the school board. Any vendor that fails to cure any defect in the contract shall not be entitled to any payment required under the contract and shall return to the school board all payments previously made by the school board.

Section 10. The Illinois School Student Records Act is amended by changing Sections 2, 6, and 9 as follows:

(105 ILCS 10/2) (from Ch. 122, par. 50-2)

Sec. 2. In this Act:

"Biometric record" means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting.

"Eligible student" means a student who has reached 18 years of age.

"Parent" means a person who is the natural parent of the student or other person who has the primary responsibility for the care and upbringing of the student. All rights and privileges accorded to a parent under this Act shall become exclusively those of the student upon the student's 18th birthday, graduation from secondary school, marriage, or entry into military service, whichever occurs first. Such rights and privileges may also be exercised by the student at any time with respect to the student's permanent school record.

"Personally identifiable information" means:

(1) the student's name;

(2) the name of the student's parent or other family members;

(3) the address of the student or student's family;

(4) a personal identifier, such as the student's social security number, student number, or biometric record;

(5) other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name;

(6) other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or

(7) information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

"Record" means any information recorded or generated in any way, including, but not limited to, electronically-generated data, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.

"School" means any public preschool, day care center, kindergarten, nursery, elementary or secondary educational institution, vocational school, special education facility or any other elementary or secondary educational agency or institution and any person, agency or institution which maintains school student records from more than one school, but does not include a private or non-public school.

"School board" means any school board, board of directors, or any other governing body established under the School Code.

"School student record" means any writing or other recorded information concerning a student by which a student may be individually or personally identified that is maintained by a school or at its direction or by an employee of a school, regardless of how or where the information is stored. The following shall not be deemed school student records under this Act: writings or other recorded information maintained by an employee of a school or other person at the direction of a school for his or her exclusive use; provided that all such writings and other recorded information are destroyed not later than the student's graduation or permanent withdrawal from the school; and provided further that no such records or recorded information may be released or disclosed to any person except a person designated by the school as a substitute unless they are first incorporated in a school student record and made subject to all of the provisions of this Act. School student records shall not include information maintained by law enforcement professionals working in the school.

"State Board" means the State Board of Education.

"Student" means any person enrolled or previously enrolled in a school.

"Student permanent record" means the minimum personal information necessary to a school in the education of the student and contained in a school student record. Such information may include the student's name, birth date, address, grades and grade level, parents' names and addresses, attendance records, and such other entries as the State Board may require or authorize.

"Student temporary record" means all information contained in a school student record but not contained in the student permanent record. Such information may include family background information, intelligence test scores, aptitude test scores, psychological and personality test results, teacher evaluations, and other information of clear relevance to the education of the student, all subject to rules of the State Board. The information shall include information provided under Section 8.6 of the Abused and Neglected Child Reporting Act. In addition, the student temporary record shall include information regarding disciplinary infractions involving drugs, weapons, or bodily harm to another that resulted in expulsion, suspension, or the imposition of punishment or sanction. As used in this Act,

(a) "Student" means any person enrolled or previously enrolled in a school.

(b) "School" means any public preschool, day care center, kindergarten, nursery, elementary or secondary educational institution, vocational school, special educational facility or any other elementary or secondary educational agency or institution and any person, agency or institution which maintains school student records from more than one school, but does not include a private or non-public school.

(c) "State Board" means the State Board of Education.

(d) "School Student Record" means any writing or other recorded information concerning a student and by which a student may be individually identified, maintained by a school or at its direction or by an employee of a school, regardless of how or where the information is stored. The following shall not be deemed school student records under this Act: writings or other recorded information maintained by an employee of a school or other person at the direction of a school for his or her exclusive use; provided that all such writings and other recorded information are destroyed not later than the student's graduation or permanent withdrawal from the school; and provided further that no such records or recorded information may be released or disclosed to any person except a person designated by the school as a substitute unless they are first incorporated in a school student record and made subject to all of the provisions of this Act. School student records shall not include information maintained by law enforcement professionals working in the school.

(e) "Student Permanent Record" means the minimum personal information necessary to a school in the education of the student and contained in a school student record. Such information may include the student's name, birth date, address, grades and grade level, parents' names and addresses, attendance records, and such other entries as the State Board may require or authorize.

(f) "Student Temporary Record" means all information contained in a school student record but not contained in the student permanent record. Such information may include family background information, intelligence test scores, aptitude test scores, psychological and personality test results, teacher evaluations, and other information of clear relevance to the education of the student, all subject to regulations of the State Board. The information shall include information provided under Section 8.6 of the Abused and Neglected Child Reporting Act. In addition, the student temporary record shall include information regarding serious disciplinary infractions that resulted in expulsion, suspension, or the imposition of punishment or sanction. For purposes of this provision, serious disciplinary infractions means: infractions involving drugs, weapons, or bodily harm to another.

(g) "Parent" means a person who is the natural parent of the student or other person who has the primary responsibility for the care and upbringing of the student. All rights and privileges accorded to a parent under this Act shall become exclusively those of the student upon his 18th birthday, graduation from secondary school, marriage or entry into military service, whichever occurs first. Such rights and privileges may also be exercised by the student at any time with respect to the student's permanent school record.

(Source: P.A. 92-295, eff. 1-1-02.)

(105 ILCS 10/6) (from Ch. 122, par. 50-6)

Sec. 6. (a) No school student records or information contained therein may be released, transferred, disclosed or otherwise disseminated, except as follows:

(1) to To a parent or student or person specifically designated as a representative by a parent, as provided in paragraph (a) of Section 5;

(2) to To an employee or official of the school or school district or State Board with current demonstrable educational or administrative interest in the student, in furtherance of such interest;

(3) to To the official records custodian of another school within Illinois or an official with similar responsibilities of a school outside Illinois, in which the student has enrolled, or intends to enroll, upon the request of such official or student;

(4) to To any person for the purpose of research, statistical reporting, or planning, provided that such research, statistical reporting, or planning is permissible under and undertaken in accordance with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g);

(5) pursuant Pursuant to a court order, provided that the parent shall be given prompt written notice upon receipt of such order of the terms of the order, the nature and substance of the information proposed to be released in compliance with such order and an opportunity to inspect and copy the school student records and to challenge their contents pursuant to Section 7;

(6) to To any person as specifically required by State or federal law;

(6.5) to To juvenile authorities when necessary for the discharge of their official duties who request information prior to adjudication of the student and who certify in writing that the information will not be disclosed to any other party except as provided under law or order of court. For purposes of this Section "juvenile authorities" means: (i) a judge of the circuit court and members of the staff of the court designated by the judge; (ii) parties to the proceedings under the Juvenile Court Act of 1987 and their attorneys; (iii) probation officers and court appointed advocates for the juvenile authorized by the judge hearing the case; (iv) any individual, public or private agency having custody of the child pursuant to court order; (v) any individual, public or private agency providing education, medical or mental health service to the child when the requested information is needed to determine the appropriate service or treatment for the minor; (vi) any potential placement provider when such release is authorized by the court for the limited purpose of determining the appropriateness of the potential placement; (vii) law enforcement officers and prosecutors; (viii) adult and juvenile prisoner review boards; (ix) authorized military personnel; (x) individuals authorized by court;

(7) subject Subject to regulations of the State Board, in connection with an emergency, to appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons;

(8) to To any person, with the prior specific dated written consent of the parent designating the person to whom the records may be released, provided that at the time any such consent is requested or obtained, the parent shall be advised in writing that he has the right to inspect and copy such records in accordance with Section 5, to challenge their contents in accordance with Section 7 and to limit any such consent to designated records or designated portions of the information contained therein;

(9) to To a governmental agency, or social service agency contracted by a governmental agency, in furtherance of an investigation of a student's school attendance pursuant to the compulsory student attendance laws of this State, provided that the records are released to the employee or agent designated by the agency;

(10) to To those SHOCAP committee members who fall within the meaning of "state and local officials and authorities", as those terms are used within the meaning of the federal Family Educational Rights and Privacy Act, for the purposes of identifying serious habitual juvenile offenders and matching those offenders with community resources pursuant to Section 5-145 of the Juvenile Court Act of 1987, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the Family Educational Rights and Privacy Act;

(11) to To the Department of Healthcare and Family Services in furtherance of the requirements of Section 2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or Section 10 of the School Breakfast and Lunch Program Act; or

(12) to To the State Board or another State government agency or between or among State government agencies in order to evaluate or audit federal and State programs or perform research and planning, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g).

(a-5) Pursuant to subparagraph (4) of paragraph (a) of this Section, a school board or the State Board may provide records of a student to researchers at an accredited post-secondary educational institution or an organization conducting research if any such research is conducted in accordance with the federal Family Educational Rights and Privacy Act and does not take place until the following requirements are complied with:

(1) Prior to the beginning of each school year, the school board shall provide notice to parents, guardians or eligible students regarding planned studies. For those school boards that maintain an Internet website, the school board shall post on its Internet website a current list of all research studies using records obtained from the school board without obtaining consent from parents, guardians or eligible students currently being conducted or scheduled to be conducted. In April and December of each year, the school board shall update the Internet website to include new research studies that are approved or conducted. For those school boards that do not maintain an Internet website, each school board shall provide parents, guardians and eligible students with a current list of all research studies being conducted or scheduled to be conducted in the same notice described above and shall provide supplemental notices every April and December provided new research studies have been approved or are being conducted.

(A) The school board shall send the notice described in this subparagraph (1) by the same means generally used to send notices to parents, guardians or eligible students.

(B) The notice described in this subparagraph (1) shall describe generally the purposes of conducting educational research, contain a short description of all current and scheduled research studies and set forth the address of the Internet website containing a current list of all research studies being conducted and scheduled to be conducted, which web address shall also be set forth in the school board's student handbook. The notice shall also advise parents, guardians and eligible students that the State Board conducts research studies and shall provide the Internet website address for that part of the State Board's website that contains a list of the current and scheduled studies to be conducted.

(C) For those school boards that maintain an Internet website, the webpage that contains the list of all current and scheduled research studies shall also set forth, in general terms, the nature of each listed research study, the categories of students whose records will be used in each listed research study and the names of all organizations involved in each listed research study. For those school boards that do not maintain an Internet website, the school boards shall provide the information described in this subdivision (C) in the notice described in this subparagraph (1).

(2) A written data use agreement that complies with the Family Educational Rights and Privacy Act and its accompanying regulations and, at a minimum, contains the provisions set forth below is entered into by and between the party gaining access to the records of the school board or State Board and the entity with the legal authority to permit the use of the data:

(A) The accredited post-secondary educational institution or the organization conducting research shall abide by all requirements of this subparagraph (2).

(B) A statement of the purpose, scope and duration of the research study or studies, as well as a description of the records to be used as part of the study and the person or persons to whom the records will be disclosed, provided that the list of persons to whom the records may be disclosed may be amended from time to time with the agreement of all parties to the data use agreement.

(C) The accredited post-secondary educational institution or the organization conducting research shall use school student records only to meet the purpose or purposes of the study as set forth in subdivision (B) of this subparagraph (2).

(D) The accredited post-secondary educational institution or the organization conducting research may only use records containing personally identifiable information of a student or by which a student may otherwise be individually or personally identified for two reasons: (i) to link data files; or (ii) to identify eligible students for research studies for which written parental, guardian or eligible student consent will be obtained for participation and the person or persons to whom such information will be disclosed is set forth in the data use agreement.

(E) The accredited post-secondary educational institution or the organization conducting research shall destroy all records containing personally identifiable information of a student or that otherwise individually or personally identifies a student when the information is no longer needed, but in no event later than 36 months after the research study has been completed.

(F) The accredited post-secondary educational institution or the organization conducting research shall certify in writing that it has the capacity to and shall restrict access to school student records to the person or persons set forth in subdivision (B) of this subparagraph (2).

(G) The accredited post-secondary educational institution or the organization conducting research shall certify in writing that it shall maintain the security of all records received pursuant to this paragraph (a-5) in compliance with rules that shall be adopted by the State Board, which rules shall be consistent, and regularly updated to comply, with commonly accepted data-security practices, including, but not limited to, those set forth by the United States Department of Education Privacy Technical Assistance Center.

(H) In compliance with the rules adopted pursuant to subdivision (G) of this subparagraph (2) and any other rules that may be necessary and adopted by the State Board, the accredited post-secondary educational institution or the organization conducting research shall develop, implement, maintain, and use appropriate administrative, technical and physical security measures to preserve the confidentiality and integrity of all school student records.

(3) Accredited post-secondary educational institutions and organizations conducting research may only use records containing personally identifiable information or a student or by which a student may otherwise be personally or individually identified for two reasons: (i) to link data files or (ii) to identify eligible students for research studies for which written parental, guardian or eligible student consent will be obtained for participation and the person or persons to whom such information will be disclosed is set forth in the data use agreement.

(4) The accredited post-secondary institution or the organization conducting research agrees that it shall use personally identifiable information from school student records only to meet the purpose or purposes of the research study or studies as stated in the data use agreement described in subparagraph (2) of this paragraph (a-5).

(5) Any information by which a student may be individually or personally identified shall be released, transferred, disclosed or otherwise disseminated only as contemplated by the written data use agreement of paragraph (a-5).

(6) All school student records shall have personally identifiable information removed prior to analysis by the accredited post-secondary educational institution or the organization conducting research.

(7) The accredited post-secondary institution or organization conducting research shall implement and adhere to policies and procedures that restrict access to records which have personally identifiable information.

(A) The accredited post-secondary institution or organization conducting research shall designate an individual to act as the custodian of the records with personally identifiable information who is responsible for restricting access to those records and provide the name of that individual to the entity with the legal authority to permit the use of the records.

(B) Any personally identifiable information used to link data sets shall be securely stored in a location separate and apart from the location of the de-identified school student records, in a secure data file.

Nothing in this subparagraph (a-5) shall prohibit the State Board or any school board from providing personally identifiable information about individual students to an accredited post-secondary educational institution or an organization conducting research pursuant to a specific, written agreement with a school board or State Board and in accordance with the federal Family Educational Rights and Privacy Act, where necessary for the school board or State Board to comply with state or federal statutory mandates.

(b) No information may be released pursuant to subparagraph subparagraphs (3) or (6) of paragraph (a) of this Section 6 unless the parent receives prior written notice of the nature and substance of the information proposed to be released, and an opportunity to inspect and copy such records in accordance with Section 5 and to challenge their contents in accordance with Section 7. Provided, however, that such notice shall be sufficient if published in a local newspaper of general circulation or other publication directed generally to the parents involved where the proposed release of information is pursuant to subparagraph (6) 6 of paragraph (a) of in this Section 6 and relates to more than 25 students.

(c) A record of any release of information pursuant to this Section must be made and kept as a part of the school student record and subject to the access granted by Section 5. Such record of release shall be maintained for the life of the school student records and shall be available only to the parent and the official records custodian. Each record of release shall also include:

(1) the The nature and substance of the information released;

(2) the The name and signature of the official records custodian releasing such information;

(3) the The name of the person requesting such information, the capacity in which such a request has been made, and the purpose of such request;

(4) the The date of the release; and

(5) a A copy of any consent to such release.

(d) Except for the student and his parents, no person to whom information is released pursuant to this Section and no person specifically designated as a representative by a parent may permit any other person to have access to such information without a prior consent of the parent obtained in accordance with the requirements of subparagraph (8) of paragraph (a) of this Section.

(e) Nothing contained in this Act shall prohibit the publication of student directories which list student names, addresses and other identifying information and similar publications which comply with regulations issued by the State Board.

(Source: P.A. 95-331, eff. 8-21-07; 95-793, eff. 1-1-09; 96-107, eff. 7-30-09; 96-1000, eff. 7-2-10; revised 11-26-14.)

(105 ILCS 10/9) (from Ch. 122, par. 50-9)

Sec. 9. (a) Any person aggrieved by any violation of this Act may institute an action for injunctive relief in the Circuit Court of the County in which the violation has occurred or the Circuit Court of the County in which the school is located.

(b) Any person injured by a wilful or negligent violation of this Act may institute an action for damages in the Circuit Court of the County in which the violation has occurred or the Circuit Court of the County in which the school is located.

(c) In the case of any successful action under paragraph (a) or (b) of this Section, any person or school found to have wilfully or negligently violated any provision of this Act is liable to the plaintiff for the plaintiff's damages, the costs of the action and reasonable attorneys' fees, as determined by the Court.

(d) Actions for injunctive relief to secure compliance with this Act may be brought by the State Board, by the State's Attorney of the County in which the alleged violation has occurred or the State's Attorney of the County in which the school is located, in each case in the Circuit Court of such County.

(e) Wilful failure to comply with any Section of this Act is a petty offense; except that any person who wilfully and maliciously falsifies any school student record, student permanent record or student temporary record shall be guilty of a Class A misdemeanor.

(f) Absent proof of malice, no cause of action or claim for relief, civil or criminal, may be maintained against any school, or employee or official of a school or person acting at the direction of a school for any statement made or judgment expressed in any entry to a school student record of a type which does not violate this Act or the regulations issued by the State Board pursuant to this Act; provided that this paragraph (f) does not limit or deny any defense available under existing law.

(g) In addition to any other penalties and remedies provided by this Section 9 of this Act, any accredited post-secondary educational institution or organization conducting research that violates the requirements of subparagraph (a-5) of Section 6 of this Act shall immediately cease conducting any research that utilizes school student records and shall be prohibited from conducting additional research studies based on such records and information for a period of 6 months from the date of the discovery of the violation.

(h) In addition to any other penalties and remedies provided by this Section 9 of this Act, any school board that violates the requirements of subparagraph (a-5) of Section 6 of this Act shall be prohibited from entering into a data use agreement with any accredited post-secondary educational institution or organization conducting research for a period of 12 months from the date of the discovery of the violation, and all existing data use agreements shall be voided.

(Source: P.A. 84-712.)

Section 15. The Children's Privacy Protection and Parental Empowerment Act is amended by changing Section 5 as follows:

(325 ILCS 17/5)

Sec. 5. Definitions. As used in this Act:

"Child" means a person under the age of 18 16. "Child" does not include a minor emancipated by operation of law.

"Parent" means a parent, step-parent, or legal guardian.

"Personal information" means any of the following:

(1) A person's name.

(2) A person's address.

(3) A person's telephone number.

(4) A person's driver's license number or State of Illinois identification card as assigned by the Illinois Secretary of State or by a similar agency of another state.

(5) A person's social security number.

(6) Any other information that can be used to locate or contact a specific individual.

"Personal information" does not include any of the following:

(1) Public records as defined by Section 2 of the Freedom of Information Act.

(2) Court records.

(3) Information found in publicly available sources, including newspapers, magazines, and telephone directories.

(4) Any other information that is not known to concern a child.

(Source: P.A. 93-462, eff. 1-1-04.)