SB3092 98TH GENERAL ASSEMBLY

LRB098 15075 NHT 50039 b

98TH GENERAL ASSEMBLY
State of Illinois
2013 and 2014
SB3092

Introduced 2/7/2014, by Sen. William Delgado

SYNOPSIS AS INTRODUCED:

105 ILCS 13/32 new

Amends the P-20 Longitudinal Education Data System Act. Provides that if an audit or evaluation or a compliance or enforcement activity in connection with legal requirements that relate to State-supported or school district-supported educational programs requires or is used as the basis for granting access to personally identifiable information, the State Board of Education or a public school shall designate parties only under its direct control to act as authorized representatives to conduct the audit, evaluation, or activity. Limits the disclosure of personally identifiable information by the State Board or a public school with respect to (i) a contractor, consultant, or other party to whom the State Board or school has outsourced services or functions; (ii) a party conducting certain studies for or on behalf of the State Board or school; (iii) any party for a commercial use; or (iv) the provision of services other than contracting, studies, and audits or evaluations. Limits the maintenance of personally identifiable information and provides for disclosure and notification. Limits appending education records with personally identifiable information obtained from other federal or State agencies through data matches. Provides for civil penalties. Effective immediately.

FISCAL NOTE ACT MAY APPLY

STATE MANDATES ACT MAY REQUIRE REIMBURSEMENT

A BILL FOR

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The P-20 Longitudinal Education Data System Act is amended by adding Section 32 as follows:

(105 ILCS 13/32 new)

Sec. 32. Personally identifiable information limitations.

(a) In this Section:

"Education records" has the meaning ascribed to that term in 34 CFR 99.3.

"Personally identifiable information" means (i) any personally identifiable information under the federal Family Educational Rights and Privacy Act of 1974 and (ii) the personally identifiable information of teachers, other educators, and school administrators, other than publicly available, school-related information such as the name, school location, and grade levels or subjects taught.

(b) If an audit or evaluation or a compliance or enforcement activity in connection with legal requirements that relate to State-supported or school district-supported educational programs requires or is used as the basis for granting access to personally identifiable information, the State Board or a school shall designate parties only under their direct control to act as authorized representatives to conduct the audit, evaluation, or activity.

(c) The State Board or schools may not disclose any personally identifiable information, including personally identifiable information from education records of students, without the written consent of eligible students, parents, or guardians to a contractor, consultant, or other party to whom the State Board or school has outsourced services or functions, unless that outside party:

(1) performs an institutional service or function for which the State Board or the school would otherwise use employees;

(2) is under the direct control of the State Board or the school with respect to the use and maintenance of education records;

(3) limits internal access to education records to those individuals who are determined to have legitimate educational interests;

(4) does not use the education records for any purposes other than those explicitly authorized in its contract;

(5) does not disclose any personally identifiable information to any other party (i) without the prior written consent of the eligible student, parent, or guardian or (ii) unless required by statute or court order and the party provides a notice of the disclosure to the State Board or school board that provided the information no later than the time the information is disclosed, unless providing notice of the disclosure is expressly prohibited by the statute or court order;

(6) maintains reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of personally identifiable information in its custody;

(7) uses encryption technologies to protect data while in motion or in its custody from unauthorized disclosure using a technology or methodology specified by the U.S. Secretary of Health and Human Services under Section 13402(h)(2) of Public Law 111-5;

(8) has sufficient administrative and technical procedures to monitor continuously the security of personally identifiable information in its custody;

(9) conducts a security audit annually and provides the results of that audit to the State Board or the school that provided personally identifiable information;

(10) provides the State Board or school with a breach remediation plan acceptable to the State Board or school prior to initial receipts of the personally identifiable information;

(11) reports all suspected security breaches to the State Board or the school that provided personally identifiable information and education records as soon as possible, but no later than 48 hours after a suspected breach was known or would have been known by exercising reasonable diligence;

(12) reports all actual security breaches to the State Board or the school that provided personally identifiable information and education records as soon as possible, but no later than 24 hours after an actual breach was known or would have been known by exercising reasonable diligence;

(13) agrees, in the event of a security breach or an unauthorized disclosure of personally identifiable information, to pay all costs and liabilities incurred by the State Board or school related to the security breach or unauthorized disclosure, including without limitation the costs of responding to inquiries about the security breach or unauthorized disclosure, of notifying the subjects of personally identifiable information about the breach, of mitigating the effects of the breach for the subjects of personally identifiable information, and of investigating the cause or consequences of the security breach or unauthorized disclosure; and

(14) destroys or returns to the State Board or school all personally identifiable information in its custody upon request and at the termination of the contract.

(d) The State Board or schools may disclose personally identifiable information from an education record of a student without the consent of the eligible student, parent, or guardian to a party conducting studies for or on behalf of the State Board or school to (i) develop, validate, or administer predictive tests, (ii) administer student aid programs, or (3) improve instruction, provided that the outside party conducting the study meets all of the requirements for contractors set forth in subsection (c) of this Section.

(e) The State Board or schools may not disclose any personally identifiable information, including personally identifiable information from education records of students, without the written consent of eligible students, parents, or guardians to any party for a commercial use, including without limitation marketing products or services, compiling lists for sale or rental, developing products or services, or creating individual, household, or group profiles, nor may such disclosure be made for the provision of services other than contracting, studies, and audits or evaluations as authorized and limited by subsections (c) and (d) of this Section. Any consent from an eligible student, parent, or guardian must be signed and dated, must not have been signed more than 6 months prior to the disclosure, must identify the recipient and the purpose of the disclosure, and must state that the information will be used only for that purpose and will not be used or disclosed for any other purpose.

(f) The State Board or schools may not, directly or through contracts with outside parties, maintain personally identifiable information, including personally identifiable information from education records of students, without the written consent of eligible students, parents, or guardians, unless the maintenance of the information is:

(1) explicitly mandated in federal or State statute;

(2) administratively required for the proper performance of their duties under the law and is relevant to and necessary for the delivery of services; or

(3) designed to support a study of students or former students, provided that no personally identifiable information is retained on former students for longer than 5 years after the date of the student's last enrollment in a school.

(g) The State Board and schools shall publicly and conspicuously disclose on their Internet websites and through annual electronic notification to the chairperson of the House of Representatives Elementary & Secondary Education Committee and the chairperson of the Senate Education Committee the existence and character of any personally identifiable information that they, directly or through contracts with outside parties, maintain. The disclosure and notification shall include:

(1) the name and location of the data repository where the information is maintained;

(2) the legal authority that authorizes the establishment and existence of the data repository;

(3) the principal purpose or purposes for which the information is intended to be used;

(4) the categories of individuals on whom records are maintained in the data repository;

(5) the categories of records maintained in the data repository;

(6) each expected disclosure of the records contained in the data repository, including the categories of recipients and the purpose of each disclosure;

(7) the policies and practices of the State Board or school regarding storage, retrievability, access controls, retention, and disposal of the records;

(8) the title and business address of the State Board or school official who is responsible for the data repository and the name and business address of any contractor or other outside party maintaining the data repository for or on behalf of the State Board or school;

(9) the procedures whereby eligible students, parents, or guardians can be notified at their request if the data repository contains a record pertaining to the student, parent, or guardian;

(10) the procedures whereby eligible students, parents, or guardians can be notified at their request on how to gain access to any record pertaining to the student, parent, or guardian contained in the data repository and how they can contest its content; and

(11) the categories of sources of records in the data repository.

(h) The State Board and schools may not append education records with personally identifiable information obtained from other federal or State agencies through data matches without the written consent of eligible students, parents, or guardians unless the data matches are:

(1) explicitly mandated in federal or State statute; or

(2) administratively required for the proper performance of their duties under the law and are relevant to and necessary for the delivery of services.

(i) Each violation of this Section by an organization or entity that is not the State Board or a school is subject to a civil penalty of up to $1,000 for a first violation, up to $5,000 for a second violation, and up to $10,000 for a third or subsequent violation. Each violation involving a different individual's personally identifiable information shall be considered a separate violation for purposes of civil penalties.

(j) The Attorney General shall have the authority to enforce compliance with this Section by investigation and subsequent commencement of a civil action to seek civil penalties for violations of this Section and to seek appropriate injunctive relief, including without limitation a prohibition on obtaining personally identifiable information for an appropriate time period. In carrying out an investigation and in maintaining a civil action, the Attorney General or any deputy or assistant Attorney General is authorized to subpoena witnesses, compel their attendance, examine them under oath, and require that any books, records, documents, papers, or electronic records relevant or material to the inquiry be turned over for inspection, examination, or audit, pursuant to the Civil Practice Law and rules. Subpoenas issued pursuant to this subsection (j) may be enforced pursuant to the Civil Practice Law and rules.

(k) Nothing contained in this Section shall be construed as creating a private right of action against the State Board or a school.

(l) Nothing in this Section shall limit the administrative use of personally identifiable information by a person acting exclusively in the person's capacity as an employee of a school, this State, a court, or the federal government that is otherwise required by law.

Section 99. Effective date. This Act takes effect upon becoming law.