(105 ILCS 85/28)
    Sec. 28. State Board duties.
    (a) The State Board may not sell, rent, lease, or trade covered information.
    (b) Except for an employee of the State Board or a State Board official acting within his or her official capacity, the State Board may not share, transfer, disclose, or provide covered information to an entity or individual without a contract or written agreement, except for disclosures required by State or federal law.
    (c) At least once annually, the State Board must publish and maintain on its website a list of all of the entities or individuals, including, but not limited to, operators, individual researchers, research organizations, institutions of higher education, or government agencies, that the State Board contracts with or has written agreements with and that hold covered information and a copy of each contract or written agreement. The list must include all of the following information:
        (1) The name of the entity or individual. In naming
    
an individual, the list must include the entity that sponsors the individual or with which the individual is affiliated, if any. If the individual is conducting research at an institution of higher education, the list may include the name of that institution and a contact person in the department that is associated with the research in lieu of the name of the researcher. If the entity is an operator, the list must include its business address.
        (2) The purpose and scope of the contract or
    
agreement.
        (3) The duration of the contract or agreement.
        (4) The types of covered information that the entity
    
or individual holds under the contract or agreement.
        (5) The use of the covered information under the
    
contract or agreement.
        (6) The length of time for which the entity or
    
individual may hold the covered information.
        (7) A list of any subcontractors to whom covered
    
information may be disclosed under Section 15 or a link to a page on the operator's website that clearly lists that information.
    If mutually agreed upon by the State Board and the operator, provisions of a contract or written agreement, other than those pertaining to paragraphs (1) through (7), may be redacted on the State Board's website.
    (d) The State Board shall create, publish, and make publicly available an inventory, along with a dictionary or index of data elements and their definitions, of covered information collected or maintained by the State Board, including, but not limited to, both of the following:
        (1) Covered information that schools are required to
    
report to the State Board by State or federal law.
        (2) Covered information in the State longitudinal
    
data system or any data warehouse used by the State Board to populate the longitudinal data system.
    The inventory shall make clear for what purposes the State Board uses the covered information.
    (e) The State Board shall develop, publish, and make publicly available, for the benefit of schools, model student data privacy policies and procedures that comply with relevant State and federal law, including, but not limited to, a model notice that schools must use to provide notice to parents and students about operators. The notice must state, in general terms, the types of student data that are collected by the schools and shared with operators under this Act and the purposes of collecting and using the student data. After creation of the notice under this subsection, a school shall, at the beginning of each school year, provide the notice to parents by the same means generally used to send notices to them. This subsection does not apply to nonpublic schools.
(Source: P.A. 101-516, eff. 7-1-21.)