SB2089 101ST GENERAL ASSEMBLY

LRB101 09671 AXK 54770 b

101ST GENERAL ASSEMBLY
State of Illinois
2019 and 2020
SB2089

Introduced 2/15/2019, by Sen. Omar Aquino

SYNOPSIS AS INTRODUCED:

New Act
105 ILCS 10/2	from Ch. 122, par. 50-2
105 ILCS 10/6	from Ch. 122, par. 50-6
105 ILCS 85/Act rep.
815 ILCS 505/2Z	from Ch. 121 1/2, par. 262Z

Creates the Student Online Personal Protection Act of 2019. Provides for legislative intent and definitions. Provides for operator prohibitions, operator duties, school authority prohibitions, school authority duties, State Board of Education duties, and parent rights. Creates the Student Data Protection Oversight Committee and provides for the Committee's membership and support. Requires the Committee to submit an annual report to the General Assembly and the State Board of Education with recommendations, if any, for policy revisions and legislative amendments that would carry out the intent of the Act. Amends the Illinois School Student Records Act. Adds a definition of record. Requires written consent of a student's parent to publish student directories that list student names, addresses, and other identifying information and similar publications. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Repeals the Student Online Personal Protection Act. Effective immediately.

FISCAL NOTE ACT MAY APPLY

STATE MANDATES ACT MAY REQUIRE REIMBURSEMENT

A BILL FOR

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Student Online Personal Protection Act of 2019.

Section 5. Legislative intent. Schools today are increasingly using a wide range of technologies to help students learn, but concerns have been raised about whether sufficient safeguards exist to protect the privacy and security of data about students and their families. This Act is intended to ensure that students' and families' data will be protected, safeguarded, and kept private and disclosed only to appropriate educational authorities or to properly authorized designees under their control to serve the best interests of the student and that no student shall be required to disclose data or be required to consent to a school authority sharing covered information with an operator in order to receive a free, high-quality public education.

Section 10. Definitions. In this Act:

"Biometric information" has the meaning given to that term under Section 10-20.40 of the School Code.

"Breach" means the unauthorized disclosure of data or unauthorized provision of physical or electronic means of gaining access to data that compromises the security, confidentiality, or integrity of covered information or a school student record.

"Covered information" means any information or records regarding a student or generated by a student collected by or provided to an operator, school authority, or the State Board of Education for or in connection with a school purpose, including personally identifiable information and information that is linked to personally identifiable information. "Covered information" does not include aggregated information or records to the extent no student may be individually identified from the information or records in any manner or other information or records that do not include personally identifiable information or other data by which a student may be identified in any manner. "Covered information" does include aggregated information or records that are capable of being de-aggregated or reconstructed to the point that any student may be individually identified from the information or records.

"Criminal records" means any criminal record or criminal history, including, but not limited to, juvenile delinquency records.

"Destroy" means to remove covered information so that it is permanently irretrievable in the normal course of business.

"Educational benefit" means an educational or instructional program, service, curriculum, course, material, aid, or intervention provided by a school authority.

"Electronic network activity information" means any information collected via the use of a technological device, including keystroke log, browsing history, search history, information regarding the user's interaction with a website, application, or advertisement and any persistent identifiers used to recognize a user over time and across different websites or online services. Persistent identifiers may include, but are not limited to, a user number held in a cookie, an Internet Protocol address, a processor or device serial number, or unique device identifier.

"Geolocation information" means information that (i) is not the contents of a communication, (ii) is generated by or derived from, in whole or in part, the operation of a technological device, and (iii) is sufficient to determine or infer the precise location of that device.

"Health information" means information or records about the past, present, or future physical or mental health condition or disability of a student or the provision of health care or medical treatment of a student.

"Highly sensitive student information" means covered information that includes, but is not limited to, all of the following types of information:

(1) Criminal records.

(2) Disciplinary records.

(3) Health information.

(4) Immigration and citizenship status.

(5) Information protected under the federal Protection of Pupil Rights Amendment of 1978.

(6) Personally identifiable information.

(7) Geolocation information.

(8) Electronic network activity information.

(9) Photograph, video, or audio files in which the file contains a student's image or voice.

"Longitudinal data system" has the meaning given to that term under the P-20 Longitudinal Education Data System Act.

"Operator" means any entity that, for a fee or free of charge:

(1) provides a product or service to a school authority that collects, maintains, utilizes, or discloses covered information;

(2) designs or markets a product or service for use by a school authority or, with the school authority's or its officials' involvement, by the student that collects, maintains, utilizes, or discloses covered information; or

(3) knows or reasonably should know that a product or service that collects, retains, or uses covered information will be used for a school purpose.

"Parent" has the meaning given to that term in the Illinois School Student Records Act.

"Personally identifiable information" means any data concerning a student by which a student may be individually or personally identified and includes, but is not limited to, any of the following:

(1) The student's name.

(2) The name of the student's parent or other family members.

(3) The address of the student or the student's family.

(4) A personal identifier, such as the student's social security number, student number, or biometric information.

(5) Other indirect identifiers, such as the student's date of birth, place of birth, or mother's maiden name.

(6) Other information that, alone or in combination, is linked or linkable to a specific student and that would allow a reasonable person in the school community who does not have personal knowledge of the relevant circumstances to identify the student with reasonable certainty.

(7) Information requested by a person whom a school reasonably believes knows the identity of the student to whom the school student record relates.

"Profile" means a file or other mechanism used to collect and retain, and that uses, covered information or other information by which to identify or otherwise keep track of an individual student or group of students.

"Publicly available" means information that is lawfully made available from federal, State, or local government records. "Publicly available" does not mean biometric information collected by an operator about a student without the parent's knowledge. "Publicly available" does not include information that is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained and aggregate information or information that is de-identified in a manner that precludes the possibility of re-identification.

"Record" has the meaning given to that term under the Illinois School Student Records Act.

"School" means (i) any preschool, day care center, nursery, kindergarten, elementary or secondary educational institution, vocational school, or special educational facility or any other elementary or secondary educational agency or institution or (ii) any person, agency, or institution that maintains school student records from more than one school. "School" includes a private or nonpublic school.

"School authority" means any school board, school district, board of directors, or other governing body of a school established under the School Code or through any other means.

"School purpose" means any activity that is directed by or takes place at the direction of a school authority or its employees or designees. "School purpose" does not include advertising that is not otherwise specifically authorized in this Act is not a school purpose.

"School student record" has the meaning given to that term under the Illinois School Student Records Act.

"State Board" means the State Board of Education.

"Student" has the meaning given to that term under the Illinois School Student Records Act.

"Targeted advertising" means advertising to an individual student or group of students in which the advertisements are selected based on a known or assumed trait of the student or group of students or information obtained or inferred from the student's or group of students' online behavior within an operator's product or service or the student's or group of students' use of an operator's products or services, whether over time or at the time of access. "Targeted advertising" does not include providing a response to a request for information or feedback or a recommendation from a student, provided the response or recommendation is not determined in whole or in part by payment or other consideration from a third party.

"Technological device" means any computer, cellular phone, smart phone, digital camera, video camera, audio recording device, radio frequency identification tag reader, or other electronic device that can be used for creating, storing, or transmitting information in the form of electronic data.

Section 15. Operator prohibitions. An operator may not do any of the following:

(1) Sell, lease, or rent covered information.

(2) Disclose covered information to any person, entity, or third party other than the school authority or State Board.

(3) Unless it is already publicly available, use, disclose, or share covered information, including de-identified or aggregated student information, for any commercial purpose that is not a school purpose, including, without limitation:

(A) to develop, maintain, support, improve, evaluate, or diagnose the operator's software or website;

(B) for adaptive learning purposes or customized student learning;

(C) to provide recommendation engines to recommend content or services;

(D) to demonstrate or market the effectiveness of the operator's website, online service, or mobile application; or

(E) for targeted advertising.

(4) Disclose or otherwise allow any third party to have access to covered information, unless such disclosure is:

(A) made only in furtherance of a school purpose with the school authority's prior consent and the recipient of the covered information is legally required to comply with this Act;

(B) to the extent permitted by federal law, to law enforcement to protect the safety of users or others or the security or integrity of the operator's service;

(C) required by court order or State or federal law;

(D) to ensure legal or regulatory compliance; or

(E) to a subcontractor, agent, independent contractor or other entity hired by the operator for the purpose of enabling the operator to meet its contractual obligations to the school authority if that entity first acknowledges in writing that it has read and understands the requirements of this Act and agrees in writing to be bound by its provisions and the terms of any agreement entered into between the operator and the school authority and a copy of that written acknowledgment and agreement is provided to the school authority.

Section 20. Operator duties. An operator must do the following:

(1) For any operator who seeks to receive from a school authority or the State Board in any manner any covered information, enter into a written agreement with the school authority before any covered information may be transferred, which agreement must contain all of the following:

(A) Provisions consistent with each prohibition or requirement set forth in this Act.

(B) A listing of the categories or types of covered information to be provided to the operator.

(C) A statement of the product or service being provided to the school authority by the operator.

(D) A statement that the operator is acting as a school official with a legitimate educational interest, is performing an institutional service or function for which the school authority would otherwise use employees, under the direct control of the school authority, with respect to the use and maintenance of covered information, and is using the covered information for only an authorized purpose and will not re-disclose it to third parties or affiliates, unless otherwise permitted under this Act, without permission from the school authority or pursuant to court order.

(E) A description of the actions the operator will take, including a description of the training the operator will provide to anyone who receives or has access to covered information, to ensure the security and confidentiality of covered information. Compliance with this subparagraph shall not, in itself, absolve the operator of liability in the event of an unauthorized disclosure of covered information.

(F) A statement that the operator will destroy or transfer to the school authority all covered information if the information is no longer needed for the purposes of the contract and to specify the time period in which the information must be destroyed or returned.

(G) A statement that the school authority will publish the contract on the school authority's website.

(H) A statement that the agreement is the entire agreement with the school authority, including school authority employees and other end users, and the operator.

(2) For any operator with covered information in its possession, implement and maintain security procedures and practices designed to protect covered information from unauthorized access, destruction, use, modification or disclosure that, based on the sensitivity of the data and the risk from unauthorized access (i) uses technologies and methodologies that are consistent with the guidance issued pursuant to the federal American Recovery and Reinvestment Act of 2009, (ii) maintains technical safeguards as it relates to the possession of covered information in a manner consistent with the provisions of 45 CFR 164.312, and (iii) otherwise meets or exceeds industry standards.

(3) Destroy, within a reasonable time period, a student's covered information if the school authority requests destruction of covered information under the control of the operator, unless the student's parent consents in writing to the maintenance of the covered information. A school authority shall make such a request to the operator on behalf of a student's parent if the parent requests that the student's covered information be destroyed, if the destruction is not in violation of the Illinois School Student Records Act.

(4) In the case of any breach, within the most expedient time possible and without unreasonable delay, but no later than 72 hours after the determination that a breach has occurred, notify the school authority of the breach of the school authority's student's covered information.

(5) Permit a school authority or its designee to audit and inspect, on an annual basis or after any breach, the operator's practices with respect to any covered information received by the operator from the school authority or any student profiles, provided that this requirement shall be satisfied if the operator provides the school authority with an independent, third-party audit acceptable to the school authority that has been conducted within the previous 12 months or, in the case of a breach, within 3 months after the breach.

(6) In the event of a breach resulting, in whole or in part, from the operator's conduct, in addition to any other remedies available to the school authority under law or equity, reimburse the school authority in full for all reasonable costs and expenses incurred by the school authority as a result of the operator's conduct in investigating and remediating the breach, including, but not limited to:

(A) providing notification to the parents of those students whose covered information was compromised and to regulatory agencies or other entities as required by law or contract;

(B) providing one year of credit monitoring to those students whose covered information was exposed in such a manner during the breach that a reasonable person would believe that it could impact his or her credit or financial security;

(C) legal fees, audit costs, fines, and any other fees or damages imposed against the school authority as a result of the security breach; and

(D) providing any other notifications or fulfilling any other requirements adopted by the State Board or of any other State or federal laws.

Section 25. School authority prohibitions. A school authority may not do any of the following:

(1) Access, search, read, inspect, copy, monitor, log or otherwise use information transmitted via a technological device unless it is owned by a school authority and the information is used for a school purpose. Information obtained or collected in violation of this paragraph must be promptly destroyed and may not be used by a school authority in any legal proceeding, disciplinary action, or administrative hearing or for any other purpose.

(2) Require that any student must, as part of any applicable program, disclose highly sensitive student information to an operator without prior written consent of the student's parent, which must include an explanation that is clear and understandable by a layperson of the data elements of highly sensitive student information to be shared and for what purpose and to whom it will be disclosed.

(3) Withhold an educational benefit from or take a punitive measure against a student or a student's parent based in whole or in part upon the student's or parent's (i) refusal to allow disclosure or sharing of covered information to an operator, (ii) revocation of consent for disclosure or sharing of covered information to an operator, or (iii) request for destruction of covered information maintained by an operator.

(4) Sell, rent, lease, or trade covered information.

(5) Share, transfer, disclose, or provide access to a student's covered information to an entity or individual, other than the student's parent or the State Board, without a contract, unless such disclosure or transfer is:

(A) to the extent permitted by federal law, to law enforcement to protect the safety of users or others or the security or integrity of the operator's service;

(B) required by court order or State or federal law; or

(C) to ensure legal or regulatory compliance.

Section 30. School authority duties.

(a) Each school authority shall post and maintain on its website all of the following information:

(1) An explanation that is clear and understandable by a layperson of the data elements of covered information that the school authority collects, maintains, or discloses to any person, entity, third party, or governmental agency. The information must explain how the school authority uses, to whom it discloses, and for what purpose it discloses the covered information.

(2) A list of operators that the school authority contracts with, a copy of each contract, and a business address and telephone number for each operator.

(3) For each operator, a list of any subcontractors to whom covered information may be disclosed under Section 15.

(4) A written description of the procedures that a parent may use to carry out the rights enumerated under Section 40.

(5) An explanation that if a school authority does not comply with the requirements of this subsection, a parent may submit a complaint with the State Board in accordance with the complaint policy adopted under Section 35.

(b) Each school authority must adopt a policy regarding school employees who are authorized to enter into contracts with operators. A school authority must post on its website each contract, along with the information under subsection (a) before the contract is implemented and before any covered information is disclosed to an operator. Any agreement or contract entered into in violation of this Act shall be void and unenforceable as against public policy. This subsection may not be construed to limit individual school employees outside of the scope of their employment from entering into agreements with operators on their own behalf and for a non-school purpose, provided that no covered information is provided to the operators.

(c) Upon receipt of notice of a breach under Section 20 or determination of a breach of covered information maintained by the school authority, a school authority shall electronically notify, no later than 72 hours after receipt of the notice or determination that a breach has occurred, the parent of any student whose covered information is involved in the breach. The school authority must also post the notice on the school authority's website. The notification must include, but is not limited to, all of the following:

(1) The date, estimated date, or estimated date range of the breach.

(2) A description of the covered information that was compromised or reasonably believed to have been compromised in the breach.

(3) Information that the parent may use to contact the operator and school authority to inquire about the breach.

(4) The toll-free numbers, addresses, and websites for consumer reporting agencies.

(5) The toll-free number, address, and website for the Federal Trade Commission.

(6) A statement that the parent may obtain information from the Federal Trade Commission and credit reporting agencies about fraud alerts and security freezes.

(d) Each school authority must implement and maintain security procedures and practices designed to protect covered information from unauthorized access, destruction, use, modification, or disclosure that, based on the sensitivity of the covered information and the risk from unauthorized access, (i) use technologies and methodologies that are consistent with the guidance issued pursuant to the federal American Recovery and Reinvestment Act of 2009, (ii) maintain technical safeguards as they relate to the possession of student records in a manner consistent with the provisions of 45 CFR 164.312, and (iii) otherwise meet or exceed industry standards.

(e) Each school authority shall designate an appropriate staff person as a privacy officer, who may also be official records custodian as designated under the Illinois School Student Records Act, to carry out the duties and responsibilities assigned to school authorities and to ensure compliance with the requirements under Sections 25 and 30.

Section 35. State Board duties.

(a) The State Board may not sell, rent, lease, or trade covered information.

(b) The State Board may not share, transfer, disclose, or provide covered information to an entity or individual without a contract or agreement, with an exception for disclosures required by federal law to federal agencies.

(c) The State Board must publish and maintain on its website a list of all of the entities or individuals, including, but not limited to, operators, individual researchers, research organizations, institutions of higher education, and government agencies, that the State Board contracts with or has agreements with and that hold covered information and a copy of each contract or agreement. The list must include all of the following information:

(1) The name of the entity or individual. In naming an individual, the list must include the entity that sponsors the individual or with which the individual is affiliated, if any. If the individual is conducting research at an institution of higher education, the list may include the name of that institution and a contact person in the department that is associated with the research in lieu of the name of the researcher. If the entity is an operator, the list must include a business address and telephone number for the operator.

(2) The purpose and scope of the contract or agreement.

(3) The duration of the contract or agreement.

(4) The types of covered information that the entity or individual holds under the contract or agreement.

(5) The use of the covered information under the contract.

(6) The length of time for which the entity or individual may hold the covered information.

(7) A list of any subcontractors to whom covered information may be disclosed under Section 15.

(d) The State Board shall create, publish, and make publicly available an inventory, along with a dictionary or index of data elements and their definitions, of covered information collected or maintained by the State Board, including, but not limited to, both of the following:

(1) Covered information that school authorities are required to report to the State Board by State or federal law.

(2) Covered information in the State longitudinal data system or any data warehouse used by the State Board to populate the longitudinal data system. The inventory shall make clear for what purposes the State Board uses the covered information.

(e) Within 180 days after the effective date of this Act, the State Board shall develop, publish, and make publicly available for the benefit of school authorities model student data privacy policies and procedures that comply with relevant State and federal law, including, but not limited to, all of the following:

(1) A model notice that school authorities must use to provide notice to parents and students about operators. The notice must be titled "Student Data Shared With Operators" and state, in general terms, the types of student data that are collected by the school authority and shared with operators under this Act and the purposes of collecting and using the student data. Upon the creation of the notice under this paragraph, a school authority shall, at the beginning of each school year, provide the notice to parents by the same means generally used to send notices to them.

(2) A model consent form that school authorities may use to obtain written consent from a parent to allow disclosure of highly sensitive information to an operator, as required under Section 25. The consent form must be titled "Consent for Highly Sensitive Data Sharing with Operators" and must include an explanation that is clear and understandable by a layperson of the data elements of highly sensitive student information to be shared and for what purpose and to whom it will be disclosed.

(f) The State Board must adopt, implement, and administer a policy for hearing complaints from a parent regarding a school authority's compliance with Sections 25 and 30. At a minimum, the policy must provide a parent the opportunity to submit information and receive a hearing from the State Board and must require the State Board to take action on the parent's complaint no later than 60 days after the hearing.

Section 40. Parent rights.

(a) A student's covered information is the sole property of the student's parent.

(b) A student's covered information shall be collected only for specified, explicit, and legitimate school purposes and not further processed in a manner that is incompatible with those purposes.

(c) A student's covered information shall only be adequate, relevant, and limited to what is necessary in relation to the school purpose for which it is processed.

(d) The parent of a student enrolled in a school has the right to all of the following:

(1) Inspect and review the student's student data, regardless of whether it is maintained by the school, the school authority, the State Board, or an operator.

(2) Request from a school authority a paper or electronic copy of the student's covered information, including covered information maintained by an operator or the State Board. If a parent requests an electronic copy of the student's covered information under this paragraph, the school authority must provide an electronic copy of that information unless the school authority does not maintain the information in an electronic format and reproducing the information in an electronic format would be unduly burdensome to the school authority. If a parent requests a paper copy of the student's covered information, the school authority may charge the parent the reasonable cost for copying the information in an amount not to exceed the amount fixed in a schedule adopted by the State Board, except that no parent may be denied a copy of the information due to the parent's inability to bear the cost of the copying.

(3) Request corrections of factual inaccuracies contained in the student's covered information. After receiving a request for corrections that documents a factual inaccuracy, a school authority must complete either of the following:

(A) Confirm the correction with the parent within 90 days after receiving the parent's request if the school authority or State Board maintains the covered information that contains the factual inaccuracy.

(B) Notify the operator who must confirm the correction with the parent within 90 days after receiving the parent's request if the covered information that contains the factual inaccuracy is maintained by an operator.

(e) Nothing in this Act shall be construed to limit the rights granted to parents and students under the Illinois School Student Records Act.

Section 45. Right of action.

(a) Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. A prevailing party may recover for each violation any of the following:

(1) Against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever one is greater.

(2) Against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever one is greater.

(3) Reasonable attorney's fees and costs, including expert witness fees and other litigation expenses.

(4) Other relief, including an injunction, as the State or federal court deems appropriate.

(b) An individual who knowingly or intentionally permits the unauthorized collecting, sharing, or using of covered information under this Act is guilty of a class A misdemeanor.

Section 50. Oversight.

(a) There is created a Student Data Protection Oversight Committee that consists of all of the following members, appointed by the State Board of Education:

(1) A high school student enrolled in a public school in this State.

(2) A parent of a student in a school district organized under Article 34 of the School Code.

(3) A parent of a student in a school district located in Lake, Kane, Will, DuPage, McHenry, or Cook County, but not in a school district organized under Article 34 of the School Code.

(4) A parent of a student enrolled in a small, rural school district.

(5) An expert in information technology systems.

(6) An expert in digital privacy law.

(7) A representative of a computer and information technology trade group.

(8) A representative of a civil rights advocacy organization.

(9) A representative of a different civil rights or a privacy rights advocacy organization.

(10) A representative of an association representing principals in a city having a population exceeding 500,000.

(11) A representative of a statewide association representing school administrators.

(12) A representative of a statewide professional teachers' organization.

(13) A representative of a different statewide professional teachers' organization.

(14) A representative of a professional teachers' organization in a city having a population exceeding 500,000.

(15) A representative of a statewide association representing school boards.

(16) A representative of a school district organized under Article 34 of the School Code.

(17) The Attorney General or his or her designee.

(18) The State Superintendent of Education or his or her designee.

The State Board, in consultation with the Committee, may appoint no more than 2 additional individuals to the Committee who shall serve in an advisory role and may not have voting or other decision-making rights.

(b) The Committee shall initially meet at the call of the Governor, at which meeting it shall designate a chairperson. The Committee shall meet thereafter at the call of the chairperson, but no less than 4 times within one year after the effective date of this Act and at least once per year thereafter to review existing laws and federal regulations on covered information in light of technological and legal developments. The Committee shall serve without compensation but may be reimbursed for reasonable and necessary expenses incurred in performing their duties from funds appropriated to the State Board for that purpose. The State Board must provide administrative and other support to the Committee. The Committee shall submit an annual report to the General Assembly and the State Board no later than December 15, 2019 and each December 15 thereafter with recommendations, if any, for policy revisions and legislative amendments that would carry out the intent of this Act. The Committee is subject to the Open Meetings Act.

Section 100. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 105. The Illinois School Student Records Act is amended by changing Sections 2 and 6 as follows:

(105 ILCS 10/2) (from Ch. 122, par. 50-2)

Sec. 2. As used in this Act,

(a) "Student" means any person enrolled or previously enrolled in a school.

(b) "School" means any public preschool, day care center, kindergarten, nursery, elementary or secondary educational institution, vocational school, special educational facility or any other elementary or secondary educational agency or institution and any person, agency or institution which maintains school student records from more than one school, but does not include a private or non-public school.

(c) "State Board" means the State Board of Education.

(d) "School Student Record" means any writing or other recorded information concerning a student and by which a student may be individually identified or personally identified that is , maintained by a school or at its direction or by an employee of a school, regardless of how or where the information is stored. The following shall not be deemed school student records under this Act: writings or other recorded information maintained by an employee of a school or other person at the direction of a school for his or her exclusive use; provided that all such writings and other recorded information are destroyed not later than the student's graduation or permanent withdrawal from the school; and provided further that no such records or recorded information may be released or disclosed to any person except a person designated by the school as a substitute unless they are first incorporated in a school student record and made subject to all of the provisions of this Act. School student records shall not include information maintained by law enforcement professionals working in the school.

(e) "Student Permanent Record" means the minimum personal information necessary to a school in the education of the student and contained in a school student record. Such information may include the student's name, birth date, address, grades and grade level, parents' names and addresses, attendance records, and such other entries as the State Board may require or authorize.

(f) "Student Temporary Record" means all information contained in a school student record but not contained in the student permanent record. Such information may include family background information, intelligence test scores, aptitude test scores, psychological and personality test results, teacher evaluations, and other information of clear relevance to the education of the student, all subject to regulations of the State Board. The information shall include information provided under Section 8.6 of the Abused and Neglected Child Reporting Act. In addition, the student temporary record shall include information regarding serious disciplinary infractions that resulted in expulsion, suspension, or the imposition of punishment or sanction. For purposes of this provision, serious disciplinary infractions means: infractions involving drugs, weapons, or bodily harm to another.

(g) "Parent" means a person who is the natural parent of the student or other person who has the primary responsibility for the care and upbringing of the student. All rights and privileges accorded to a parent under this Act shall become exclusively those of the student upon his 18th birthday, graduation from secondary school, marriage or entry into military service, whichever occurs first. Such rights and privileges may also be exercised by the student at any time with respect to the student's permanent school record.

(h) "Record" means any information maintained in any way, including, but not limited to, electronically-generated data, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.

(Source: P.A. 92-295, eff. 1-1-02.)

(105 ILCS 10/6) (from Ch. 122, par. 50-6)

Sec. 6. (a) No school student records or information contained therein may be released, transferred, disclosed or otherwise disseminated, except as follows:

(1) to a parent or student or person specifically designated as a representative by a parent, as provided in paragraph (a) of Section 5;

(2) to an employee or official of the school or school district or State Board with current demonstrable educational or administrative interest in the student, in furtherance of such interest;

(3) to the official records custodian of another school within Illinois or an official with similar responsibilities of a school outside Illinois, in which the student has enrolled, or intends to enroll, upon the request of such official or student;

(4) to any person for the purpose of research, statistical reporting, or planning, provided that such research, statistical reporting, or planning is permissible under and undertaken in accordance with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g);

(5) pursuant to a court order, provided that the parent shall be given prompt written notice upon receipt of such order of the terms of the order, the nature and substance of the information proposed to be released in compliance with such order and an opportunity to inspect and copy the school student records and to challenge their contents pursuant to Section 7;

(6) to any person as specifically required by State or federal law;

(6.5) to juvenile authorities when necessary for the discharge of their official duties who request information prior to adjudication of the student and who certify in writing that the information will not be disclosed to any other party except as provided under law or order of court. For purposes of this Section "juvenile authorities" means: (i) a judge of the circuit court and members of the staff of the court designated by the judge; (ii) parties to the proceedings under the Juvenile Court Act of 1987 and their attorneys; (iii) probation officers and court appointed advocates for the juvenile authorized by the judge hearing the case; (iv) any individual, public or private agency having custody of the child pursuant to court order; (v) any individual, public or private agency providing education, medical or mental health service to the child when the requested information is needed to determine the appropriate service or treatment for the minor; (vi) any potential placement provider when such release is authorized by the court for the limited purpose of determining the appropriateness of the potential placement; (vii) law enforcement officers and prosecutors; (viii) adult and juvenile prisoner review boards; (ix) authorized military personnel; (x) individuals authorized by court;

(7) subject to regulations of the State Board, in connection with an emergency, to appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons;

(8) to any person, with the prior specific dated written consent of the parent designating the person to whom the records may be released, provided that at the time any such consent is requested or obtained, the parent shall be advised in writing that he has the right to inspect and copy such records in accordance with Section 5, to challenge their contents in accordance with Section 7 and to limit any such consent to designated records or designated portions of the information contained therein;

(9) to a governmental agency, or social service agency contracted by a governmental agency, in furtherance of an investigation of a student's school attendance pursuant to the compulsory student attendance laws of this State, provided that the records are released to the employee or agent designated by the agency;

(10) to those SHOCAP committee members who fall within the meaning of "state and local officials and authorities", as those terms are used within the meaning of the federal Family Educational Rights and Privacy Act, for the purposes of identifying serious habitual juvenile offenders and matching those offenders with community resources pursuant to Section 5-145 of the Juvenile Court Act of 1987, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the Family Educational Rights and Privacy Act;

(11) to the Department of Healthcare and Family Services in furtherance of the requirements of Section 2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or Section 10 of the School Breakfast and Lunch Program Act; or

(12) to the State Board or another State government agency or between or among State government agencies in order to evaluate or audit federal and State programs or perform research and planning, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g).

(b) No information may be released pursuant to subparagraph (3) or (6) of paragraph (a) of this Section 6 unless the parent receives prior written notice of the nature and substance of the information proposed to be released, and an opportunity to inspect and copy such records in accordance with Section 5 and to challenge their contents in accordance with Section 7. Provided, however, that such notice shall be sufficient if published in a local newspaper of general circulation or other publication directed generally to the parents involved where the proposed release of information is pursuant to subparagraph (6) of paragraph (a) of this Section 6 and relates to more than 25 students.

(c) A record of any release of information pursuant to this Section must be made and kept as a part of the school student record and subject to the access granted by Section 5. Such record of release shall be maintained for the life of the school student records and shall be available only to the parent and the official records custodian. Each record of release shall also include:

(1) the nature and substance of the information released;

(2) the name and signature of the official records custodian releasing such information;

(3) the name of the person requesting such information, the capacity in which such a request has been made, and the purpose of such request;

(4) the date of the release; and

(5) a copy of any consent to such release.

(d) Except for the student and his parents, no person to whom information is released pursuant to this Section and no person specifically designated as a representative by a parent may permit any other person to have access to such information without a prior consent of the parent obtained in accordance with the requirements of subparagraph (8) of paragraph (a) of this Section.

(e) Nothing contained in this Act shall prohibit, with the written consent of a student's parent, the publication of student directories which list student names, addresses and other identifying information and similar publications which comply with regulations issued by the State Board.

(Source: P.A. 99-78, eff. 7-20-15.)

(105 ILCS 85/Act rep.)

Section 110. The Student Online Personal Protection Act is repealed.

Section 115. The Consumer Fraud and Deceptive Business Practices Act is amended by changing Section 2Z as follows:

(815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)

Sec. 2Z. Violations of other Acts. Any person who knowingly violates the Automotive Repair Act, the Automotive Collision Repair Act, the Home Repair and Remodeling Act, the Dance Studio Act, the Physical Fitness Services Act, the Hearing Instrument Consumer Protection Act, the Illinois Union Label Act, the Installment Sales Contract Act, the Job Referral and Job Listing Services Consumer Protection Act, the Travel Promotion Consumer Protection Act, the Credit Services Organizations Act, the Automatic Telephone Dialers Act, the Pay-Per-Call Services Consumer Protection Act, the Telephone Solicitations Act, the Illinois Funeral or Burial Funds Act, the Cemetery Oversight Act, the Cemetery Care Act, the Safe and Hygienic Bed Act, the Illinois Pre-Need Cemetery Sales Act, the High Risk Home Loan Act, the Payday Loan Reform Act, the Mortgage Rescue Fraud Act, subsection (a) or (b) of Section 3-10 of the Cigarette Tax Act, subsection (a) or (b) of Section 3-10 of the Cigarette Use Tax Act, the Electronic Mail Act, the Internet Caller Identification Act, paragraph (6) of subsection (k) of Section 6-305 of the Illinois Vehicle Code, Section 11-1431, 18d-115, 18d-120, 18d-125, 18d-135, 18d-150, or 18d-153 of the Illinois Vehicle Code, Article 3 of the Residential Real Property Disclosure Act, the Automatic Contract Renewal Act, the Reverse Mortgage Act, Section 25 of the Youth Mental Health Protection Act, the Personal Information Protection Act, or the Student Online Personal Protection Act of 2019 commits an unlawful practice within the meaning of this Act.

(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642, eff. 7-28-16; 100-315, eff. 8-24-17; 100-416, eff. 1-1-18; 100-863, eff. 8-14-18.)

Section 999. Effective date. This Act takes effect upon becoming law.