Illinois General Assembly - Full Text of SB1239

LRB104 08095 LNS 18141 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB1239

Introduced 1/24/2025, by Sen. Karina Villa

SYNOPSIS AS INTRODUCED:

105 ILCS 5/10-20.40
105 ILCS 5/34-18.34

Amends the School Code. Removes language allowing school districts that collect biometric information from students to adopt specified policies. Instead, prohibits a school district from purchasing or otherwise acquiring biometric systems to use on students. Provides that a school district may not do any of the following with respect to students: (1) obtain, retain, possess, access, request, or use biometric systems or biometric information derived from biometric systems; or (2) enter into an agreement with a third party for the purpose of obtaining, retaining, possessing, accessing, or using, by or on behalf of the school district, biometric systems. Provides that, within 30 days after the effective date of the amendatory Act, if a school district is in possession of student biometric information, then the school district shall destroy the biometric information and provide certified documentation of destruction to the State Board of Education. Provides that, within 30 days after the effective date of the amendatory Act, any school district that has contracted with a third party to obtain, collect, or store student biometric information shall require the third party to destroy all biometric information in its possession and confirm in writing the completion of this destruction to the school district. During the 30-day period in which a school district may still have student biometric information in its possession, prohibits the school district from selling, leasing, or otherwise disclosing the biometric information to another person or entity unless: (1) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or (2) the disclosure is required by court order. Makes other changes.

A BILL FOR

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The School Code is amended by changing Sections 10-20.40 and 34-18.34 as follows:

(105 ILCS 5/10-20.40)

Sec. 10-20.40. Student biometric information.

(a) For the purposes of this Section: ,

"Biometric "biometric information" means any information that is collected through an identification process for individuals based on their unique behavioral or physiological characteristics, including fingerprint, hand geometry, voice, or facial recognition or iris or retinal scans.

"Biometric system" means any combination of hardware, software, firmware, or tools used to obtain, collect, process, store, transmit, display, or otherwise handle biometric information, including, but not limited to, facial or voice recognition software and software to conduct fingerprint, hand geometry, or iris or retinal scans.

"Facial recognition" means any tool using an automated or semiautomated process that assists in uniquely identifying or verifying a person by comparing or analyzing patterns based on the person's face.

(b) A school district is prohibited from purchasing or otherwise acquiring biometric systems, including facial recognition software, to use on students. School districts that collect biometric information from students shall adopt policies that require, at a minimum, all of the following:

(1) Written permission from the individual who has legal custody of the student, as defined in Section 10-20.12b of this Code, or from the student if he or she has reached the age of 18.

(2) The discontinuation of use of a student's biometric information under either of the following conditions:

(A) upon the student's graduation or withdrawal from the school district; or

(B) upon receipt in writing of a request for discontinuation by the individual having legal custody of the student or by the student if he or she has reached the age of 18.

(3) The destruction of all of a student's biometric information within 30 days after the use of the biometric information is discontinued in accordance with item (2) of this subsection (b).

(4) The use of biometric information solely for identification or fraud prevention.

(5) A prohibition on the sale, lease, or other disclosure of biometric information to another person or entity, unless:

(A) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or

(B) the disclosure is required by court order.

(6) The storage, transmittal, and protection of all biometric information from disclosure.

(b-5) A school district may not do any of the following with respect to students:

(1) Obtain, retain, possess, access, request, or use biometric systems or biometric information derived from biometric systems.

(2) Enter into an agreement with a third party for the purpose of obtaining, retaining, possessing, accessing, or using, by or on behalf of the school district, biometric systems, including facial recognition software or biometric information derived from biometric systems.

(b-10) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, if a school district is in possession of student biometric information, then the school district shall destroy the biometric information and provide certified documentation of destruction to the State Board of Education.

(b-15) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, any school district that has contracted with a third party to obtain, collect, or store student biometric information shall require the third party to destroy the biometric information in its possession and confirm in writing the completion of this destruction to the school district.

(b-20) During the 30-day period in which a school district may still have student biometric information in its possession under subsection (b-10), the school district is prohibited from selling, leasing, or otherwise disclosing the biometric information to another person or entity unless:

(1) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or

(2) the disclosure is required by court order.

(c) (Blank). Failure to provide written consent under item (1) of subsection (b) of this Section by the individual who has legal custody of the student or by the student, if he or she has reached the age of 18, must not be the basis for refusal of any services otherwise available to the student.

(d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the effective date of this amendatory Act of the 104th General Assembly use of the biometric information is discontinued in accordance with item (2) of subsection (b) of this Section.

(Source: P.A. 95-232, eff. 8-16-07; 95-793, eff. 1-1-09; 95-876, eff. 8-21-08; 96-328, eff. 8-11-09.)

(105 ILCS 5/34-18.34)

Sec. 34-18.34. Student biometric information.

(a) For the purposes of this Section: ,

"Biometric" "biometric information" means any information that is collected through an identification process for individuals based on their unique behavioral or physiological characteristics, including fingerprint, hand geometry, voice, or facial recognition or iris or retinal scans.

"Biometric system" means any combination of hardware, software, firmware, or tools used to obtain, collect, process, store, transmit, display, or otherwise handle biometric information, including, but not limited to, facial or voice recognition software and software to conduct fingerprint, hand geometry, or iris or retinal scans.

"Facial recognition" means any tool using an automated or semiautomated process that assists in uniquely identifying or verifying a person by comparing or analyzing patterns based on the person's face.

(b) The school district is prohibited from purchasing or otherwise acquiring biometric systems, including facial recognition software, to use on students. If the school district collects biometric information from students, the district shall adopt a policy that requires, at a minimum, all of the following:

(1) Written permission from the individual who has legal custody of the student, as defined in Section 10-20.12b of this Code, or from the student if he or she has reached the age of 18.

(2) The discontinuation of use of a student's biometric information under either of the following conditions:

(A) upon the student's graduation or withdrawal from the school district; or

(B) upon receipt in writing of a request for discontinuation by the individual having legal custody of the student or by the student if he or she has reached the age of 18.

(3) The destruction of all of a student's biometric information within 30 days after the use of the biometric information is discontinued in accordance with item (2) of this subsection (b).

(4) The use of biometric information solely for identification or fraud prevention.

(5) A prohibition on the sale, lease, or other disclosure of biometric information to another person or entity, unless:

(A) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or

(B) the disclosure is required by court order.

(6) The storage, transmittal, and protection of all biometric information from disclosure.

(b-5) The school district may not do any of the following with respect to students:

(1) Obtain, retain, possess, access, request, or use biometric systems or biometric information derived from biometric systems.

(2) Enter into an agreement with a third party for the purpose of obtaining, retaining, possessing, accessing, or using, by or on behalf of the school district, biometric systems, including facial recognition software or biometric information derived from biometric systems.

(b-10) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, if the school district is in possession of student biometric information, then the school district shall destroy the biometric information and provide certified documentation of destruction to the State Board of Education.

(b-15) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, if the school district has contracted with a third party to obtain, collect, or store student biometric information, then the school district shall require the third party to destroy the biometric information in its possession and confirm in writing the completion of this destruction to the school district.

(b-20) During the 30-day period in which the school district may still have student biometric information in its possession under subsection (b-10), the school district is prohibited from selling, leasing, or otherwise disclosing the biometric information to another person or entity unless:

(1) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or

(2) the disclosure is required by court order.

(c) (Blank). Failure to provide written consent under item (1) of subsection (b) of this Section by the individual who has legal custody of the student or by the student, if he or she has reached the age of 18, must not be the basis for refusal of any services otherwise available to the student.

(d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the effective date of this amendatory Act of the 104th General Assembly use of the biometric information is discontinued in accordance with item (2) of subsection (b) of this Section.

(Source: P.A. 95-232, eff. 8-16-07; 95-793, eff. 1-1-09; 95-876, eff. 8-21-08.)