SB1393ham001 99TH GENERAL ASSEMBLY

Rep. Scott Drury

Filed: 11/28/2016

09900SB1393ham001 LRB099 08398 MLM 51831 a

AMENDMENT TO SENATE BILL 1393

AMENDMENT NO. ______. Amend Senate Bill 1393 by replacing everything after the enacting clause with the following:

"Section 1. Short title. This Act may be cited as the Student Data Privacy Act.

Section 5. Legislative intent. It is the intent of the General Assembly to ensure that information generated by and about students in the course of and in connection with their education is safeguarded and that student privacy is honored, respected, and protected. The General Assembly finds the following:

(1) Information generated by and about students in the course of and in connection with their education is a vital resource for teachers and school staff in planning education programs and services, scheduling students into appropriate classes, and completing reports for school districts.

(2) Information generated by and about students in the course of and in connection with their education is critical to educators in helping students successfully graduate from high school and being ready to enter the workforce or postsecondary education.

(3) While information generated by and about students in the course of and in connection with their education is important for educational purposes, it is also critically important to ensure that the information is protected, safeguarded, and kept private and used only by appropriate educational authorities or their permitted designees, and then only to serve the best interests of the student.

To that end, this Act helps ensure that information generated by and about students in the course of and in connection with their education is protected and expectations of privacy are honored.

Section 10. Definitions. As used in this Act:

"Biometric information" has the meaning ascribed to that term in Section 10-20.40 of the School Code.

"Directory information" means any personally identifiable information that the State Board of Education has designated as directory information under Section 375.80 of Title 23 of the Illinois Administrative Code.

"Educational online product" means an Internet website, online service, online application, cloud computing service, or mobile application that is designed and marketed or may reasonably be used for educational purposes.

"Educational purposes" means any activity that is directed by an employee or agent of a school district with authority to give the direction and is intended to assist with the school district's educational curriculum.

"Interactive computer service" means any service, system, or software provider that provides or enables multiple users access to a computer server, including a service or system that provides access to the Internet and systems or services offered by libraries or educational institutions.

"Operator" means the owner or operator, or any agent thereof, of an educational online product or interactive computer service that may reasonably be used for educational purposes or was designed and marketed for educational purposes. For the purposes of this Act, the term "operator" shall not be construed to include any school district, or school district employee or agent acting on behalf of a school district employer, that operates or owns an educational online product that is solely used within the school district for educational purposes.

"Personally identifiable information" means information that, alone or in combination, identifies an individual student with reasonable certainty or that is linked to information that identifies an individual student, including, but not limited to: (1) information in the student's school student record, student permanent record, or student temporary record, as those terms are defined in the Illinois School Student Records Act, or other educational record or electronic mail; (2) the student's first and last name or the name of the student's parent or guardian or other family members; (3) the home address of the student or student's family; (4) the telephone number of the student or student's family; (5) the electronic mail address of the student or student's family; (6) any other information that allows physical or online contact with the student; (7) discipline records; (8) test results; (9) data that is a part of or related to any individualized education program for such student; (10) juvenile dependency records; (11) grades; (12) evaluations; (13) criminal records; (14) medical records; (15) health records; (16) social security number or other personal identifiers; (17) biometric information; (18) disabilities; (19) socioeconomic information; (20) food purchases; (21) political affiliations; (22) religious information; (23) text messages; (24) documents; (25) student identifiers, such as date of birth, place of birth, and mother's maiden name; (26) search activity; (27) photos; (28) voice recordings; (29) geolocation information; (30) directory information; (31) online accounts; (32) other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community who does not have knowledge of the relevant circumstances to identify the student with reasonable certainty; or (33) information requested by a person whom the school district or an employee or agent of the school district reasonably believes knows the identity of the student to whom the information relates.

"Service provider" means a person, subcontractor, agent, independent contractor, or other entity that provides a service to an operator or provides a service that enables users to access content, information, electronic mail, or other services offered over the Internet or a computer network.

"Student data" means any information or record, including personally identifiable information, not otherwise available to the public that was collected or created by or otherwise provided to an operator, in any media or format, for or in connection with an educational purpose. "Student data" includes any aggregated information or records capable of being de-aggregated or reconstructed to the point that any student may be individually identified therefrom.

"Targeted advertising" means presenting an advertisement to a student or group of students in which the advertisement is selected based on a known or assumed trait of the student or group of students or information obtained or inferred over time from that student's or group of students' online behavior; usage of online applications, educational online products, online services, cloud computing services, or mobile applications; or student data. Targeted advertising does not include information provided to a student for an educational purpose.

Section 15. Operator and service provider duties.

(a) An operator or service provider shall not knowingly:

(1) engage in targeted advertising based in whole or in part on any student data;

(2) use data created or collected through the operation of educational online products or interactive services to amass a profile about a student, except in furtherance of specifically defined educational purposes that are set forth in writing as required by subsection (e) of this Section;

(3) sell, rent, or provide student data to a third party, unless the data is part of assets being transferred during the purchase, merger, or other acquisition of an operator by another entity, provided that the successor entity agrees in writing to be subject to and bound by the provisions of this Act as though it were an operator with respect to the acquired student data and information;

(4) exercise or claim any rights, implied or otherwise, to any student data, unless otherwise authorized by this Act;

(5) disclose student data, unless the disclosure is made for the following purposes:

(A) for legitimate research purposes, subject to and as allowed by federal law and in compliance with subsection (a) of Section 6 of the Illinois School Student Records Act, and under the direction of a school district, provided that the student data is not used for advertising or to amass a profile on the student or for any other purposes other than specifically defined educational purposes that are set forth in writing as required by subsection (e) of this Section;

(B) in response to requests by a school district or State agency for personal information for educational purposes;

(C) in response to legally permissible and authorized requests or orders by law enforcement agencies or courts of competent jurisdiction, as long as the operator complies with the requirements of federal and State law in protecting and disclosing that information; or

(D) to a service provider, provided that the operator contractually: (i) prohibits the service provider from using any student data for any purpose prohibited by this Act; (ii) prohibits the service provider from disclosing any student data provided by the operator with subsequent third parties; and (iii) requires the service provider to implement and maintain reasonable security procedures and practices to ensure the confidentiality of the student data; or

(6) subject to the provisions of subsection (e) of this Section, modify or otherwise alter the terms and conditions of any agreement with a school district related to student data without the express written consent of the school district.

(b) An operator or service provider shall:

(1) implement and maintain reasonable security procedures and practices appropriate to the nature of the student data that are designed to protect the information from unauthorized access, destruction, use, modification, or disclosure; and

(2) delete student data within a reasonable period of time, not to exceed 60 days, upon written request by the school district, provided that the school district provides the student or the student's parent or legal guardian with written notice of the request and provides an opportunity to object.

(c) Nothing in this Section shall be construed to prohibit an operator or service provider from:

(1) using or sharing aggregated, de-identified student data that is not capable of being deaggregated or otherwise manipulated to allow for the identification of any individual student to maintain, develop, support, improve, or diagnose educational online products or interactive computer services;

(2) using aggregated, de-identified student data that is not capable of being deaggregated or otherwise manipulated to allow for the identification of any individual student to demonstrate the effectiveness of educational online products or interactive computer services, including marketing; or

(3) providing a response for a non-advertising, educational purpose to a student's request for information or feedback, provided that (i) the response is not determined in whole or in part by payment or other consideration from a third party, (ii) the operator does not receive any payment or other consideration upon a student selecting any information or responding to the request, and (iii) the operator does not keep a record or otherwise collect or retain data regarding a student's online activities over time or that links or otherwise ties the student to the request.

(d) Nothing in this Section shall be construed to:

(1) limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to a court order;

(2) limit the ability of a school district to authorize an operator to use student data for adaptive learning or customized student-learning purposes, provided it is done in a manner consistent with this Act;

(3) limit service providers from providing Internet connectivity to schools or to students and the students' parents or legal guardians;

(4) prohibit an operator from marketing educational products to general audiences, provided that the marketing is not based on any student data and does not constitute targeted advertising;

(5) impose a duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance with this Section on such software or applications, unless the provider is also an operator or affiliated with an operator, in which case the provider is required to comply with this Section with respect to software or applications offered by or otherwise provided by the operator or affiliate;

(6) impose a duty upon a provider of an interactive computer service to review or enforce compliance with this Section by third-party content providers, unless the third-party content providers are affiliated with the interactive computer service, in which case the interactive computer service is required to comply with this Section with respect to software or applications offered or otherwise provided by those content providers; or

(7) prohibit students from downloading, exporting, transferring, saving, or maintaining the student's own student data or documents, provided that an operator does not offer or receive any consideration from a student engaging in such an activity.

(e) Any operator who seeks to receive any student data may do so only by entering into a written agreement with the applicable school district before any records may be released or transferred.

(1) The agreement shall include, but not be limited to, all of the following:

(A) Provisions consistent with the prohibitions or requirements of this Section.

(B) A statement of the educational products or interactive computer services being provided.

(C) A statement that the operator is acting as a school official with a legitimate educational interest, is performing an institutional service or function for which the school district would otherwise use employees, is under the direct control of the school district with respect to the use and maintenance of student data, and is using such student data only for an authorized purpose and will not redisclose it to third parties or affiliates unless otherwise permitted under this Act.

(D) A description of the actions the operator will take, including a description of the training the operator will provide to anyone who will receive or have access to student data, to ensure the security and confidentiality of student data. Compliance with this subdivision (D) does not, in itself, absolve the operator of liability in the event of an unauthorized disclosure of student data.

(E) A provision stating that (i) any dispute arising out of or otherwise connected to student data must be litigated using Illinois law, (ii) the proper venue is in the county in which the school district is located, and (iii) the court in the proper venue shall have jurisdiction over the operator.

(F) A statement that the agreement is the entire agreement between the school district, including school district employees or agents and other users, and the operator.

(2) The agreement shall not include any provisions that require a school district or its employees or agents to:

(A) pay the operator's attorney's fees or costs in connection with any dispute arising out of or otherwise connected to student data, except in the case of willful or wanton conduct by a school district or its employees or agents, in which case indemnification by the school district may be permitted; or

(B) arbitrate any dispute arising out of or otherwise connected to student data.

Section 20. Disclosure of student data by school district. A school district or its employees or agents shall only disclose student data in accordance with the provisions of this Section.

Without prior written authorization from the school district in which an individual employee or agent works, no individual employee or agent of that school district may enter into any agreements with operators or service providers that concern the use of educational online products that utilize student data. If an operator enters into an agreement with any unauthorized individual employee or agent or other user, then the school district must have the authority to unilaterally cancel the agreement and require the operator or service provider to provide all collected student data to the school district or to delete it.

The school district may disclose personally identifiable information or directory information if the student (if the student is an adult) or the student's parent or legal guardian (if the student is a minor) consents to the disclosure in writing. An operator may not solicit any student or parent or legal guardian to disclose student data.

Section 25. Collection of biometric information. No school district may collect biometric information from a student or use any device or mechanism to assess a student's physiological or emotional state, unless the student (if the student is an adult) or the student's parent or legal guardian (if student is a minor) consents in writing.

Section 30. Security breach.

(a) Each school district must establish a policy for notifying students and parents of any security breach or unauthorized disclosure of student data by the school district or by an operator, service provider, or other entity or third party given access to student data or personally identifiable information of a student.

(b) In the event of any security breach or unauthorized disclosure of any student data by an operator, service provider, or other entity or third party given access to student data or personally identifiable information of any student, the operator, service provider, or other entity or third party shall immediately notify any Illinois school district that has provided student data to the operator, service provider, or other entity or third party of the breach or unauthorized disclosure, investigate the causes and consequences of the breach or unauthorized disclosure, and reimburse the school district in full for all reasonable costs and expenses incurred by the school district as a result of the breach, including (i) providing notification to students, parents, and guardians; (ii) providing at least one year's credit monitoring to impacted students; and (iii) paying all legal fees, costs, fines, and damages imposed against the school district as a result of the breach.

(c) In the event of a security breach or unauthorized disclosure of student data by a school district, State agency, or other third party not covered by subsection (b) of this Section and given access to student data or personally identifiable information of any student, the school district, State agency, or other third party shall immediately notify each affected student (if the student is an adult) or the student's parent or legal guardian (if the student is a minor) of the breach or unauthorized disclosure and investigate the causes and consequences of the breach or unauthorized disclosure.

Section 35. Rulemaking; notice.

(a) The State Board of Education shall adopt rules in accordance with this Act and applicable federal and State laws and rules to protect the right of privacy of any student and his or her family regarding personally identifiable records, files, and data directly related to the student by January 1, 2018. The rules shall provide for:

(1) means by which any student (if the student is an adult) or the student's parent or guardian (if the student is a minor) may inspect and review any records or files directly related to the student;

(2) restricting the accessibility and availability of any personally identifiable information in records or files of any student and preventing disclosure thereof unless made upon written consent of such student (if the student is an adult) or the student's parent or guardian (if the student is a minor); and

(3) which employees or agents may bind the school district to the terms of any written agreements, not including electronic, click-through, or click-wrap agreements, which agreements may not be entered into with a school district.

(b) The State Board of Education must create a model notice that school districts shall annually provide to parents, legal guardians, and students that student data may be disclosed in accordance with this Act. The notice shall be signed by the student (if the student is an adult) or by the student's parent or legal guardian (if the student is a minor) and maintained on file with the school district. The notice must provide what types of student data are collected and shared with operators or service providers and the purpose for collection or use.

Section 40. Enforcement.

(a) Any person aggrieved by any violation of this Act may institute an action for injunctive relief in the circuit court of the county in which the violation has occurred or the circuit court of any of the counties in which the school district is located.

(b) Any person injured by a willful or negligent violation of this Act may institute an action for damages in the circuit court of the county in which the violation has occurred or the circuit court of any of the counties in which the school district is located.

(c) In the case of any successful action under subsection (a) or (b) of this Section, any person or entity found to have willfully or negligently violated any provision of this Act is liable to the plaintiff for the plaintiff's damages, the costs of the action, and reasonable attorney's fees, as determined by the court.

(d) Actions for injunctive relief to secure compliance with this Act may be brought by the State Board of Education, by the State's Attorney of the county in which the alleged violation has occurred, or by the State's Attorney of any of the counties in which the school district is located, in each case in the circuit court of such county.

(e) Willful failure to comply with any Section of this Act is a petty offense.

Section 95. The Children's Privacy Protection and Parental Empowerment Act is amended by changing Section 5 as follows:

(325 ILCS 17/5)

Sec. 5. Definitions. As used in this Act:

"Child" means a person under the age of 18 16. "Child" does not include a minor emancipated by operation of law.

"Parent" means a parent, step-parent, or legal guardian.

"Personal information" means any of the following:

(1) A person's name.

(2) A person's address.

(3) A person's telephone number.

(4) A person's driver's license number or State of Illinois identification card as assigned by the Illinois Secretary of State or by a similar agency of another state.

(5) A person's social security number.

(6) Any other information that can be used to locate or contact a specific individual.

"Personal information" does not include any of the following:

(1) Public records as defined by Section 2 of the Freedom of Information Act.

(2) Court records.

(3) Information found in publicly available sources, including newspapers, magazines, and telephone directories.

(4) Any other information that is not known to concern a child.

(Source: P.A. 93-462, eff. 1-1-04.)".