SB0415eng 104TH GENERAL ASSEMBLY

SB0415 Engrossed LRB104 06653 LNS 16689 b

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The School Code is amended by changing Sections 10-20.40 and 34-18.34 as follows:

(105 ILCS 5/10-20.40)

Sec. 10-20.40. Student biometric information.

(a) For the purposes of this Section: ,

"Biometric "biometric information" means any information that is collected through an identification process for individuals based on their unique behavioral or physiological characteristics, including fingerprint, hand geometry, voice, or facial recognition or iris or retinal scans.

"Biometric system" means any combination of hardware, software, firmware, or tools used to obtain, collect, process, store, transmit, display, or otherwise handle biometric information, including, but not limited to, facial recognition or voice recognition software and software to conduct fingerprint, hand geometry, or iris or retinal scans.

"Facial recognition" means any tool using an automated or semiautomated process that assists in uniquely identifying or verifying a person by comparing or analyzing patterns based on the person's face.

(a-5) Except for legitimate instructional purposes, as determined by a school district, a school district is prohibited from purchasing or otherwise acquiring biometric systems to use on students. This subsection does not apply to a school district that purchases or acquires a biometric system but disables the biometric capabilities of that system so it cannot be used on students or has no reasonable knowledge that the software the school district purchased or otherwise acquired has biometric capabilities.

(a-10) By the 2027-2028 school year, a school district shall ensure that the biometric systems it uses are used only for legitimate instructional purposes, as determined by the school district. Within the context of the legitimate instructional purposes, the use of biometric information shall be solely for identification or fraud prevention. Biometric systems incorporated into school-issued electronic devices for identification or fraud prevention constitute a legitimate instructional purpose under this Section.

The provisions of subsection (a-5) and this subsection (a-10) regarding the use of biometric information for purposes other than legitimate instructional purposes shall not affect any existing contractual obligation under a contract entered into before January 1, 2027 between a school district and any entity for the purpose of obtaining, collecting, processing, storing, transmitting, displaying, or otherwise handling biometric information, as long as the contract is not extended or rolled over if the contract may be extended or rolled over. A school district that has entered into a contract with an entity for the purpose of obtaining, collecting, processing, storing, transmitting, displaying, or otherwise handling biometric information before January 1, 2027 shall provide a written notice, by the 2027-2028 school year, to the individual having legal custody of the student or to the student if he or she has reached the age of 18 of the existing option to discontinue the use of the student's biometric information under subparagraph (B) of paragraph (2) of subsection (b). Any provision of a contract between an entity and a school district for the purpose of obtaining, collecting, processing, storing, transmitting, displaying, or otherwise handling biometric information entered into on or after January 1, 2027 that conflicts with this Section is void.

(b) School districts that collect biometric information from students for legitimate instructional purposes shall adopt policies that require, at a minimum, all of the following:

(1) Written permission from the individual who has legal custody of the student, as defined in Section 10-20.12b of this Code, or from the student if he or she has reached the age of 18.

(2) The discontinuation of use of a student's biometric information under either of the following conditions:

(A) upon the student's graduation or withdrawal from the school district; or

(B) upon receipt in writing of a request for discontinuation by the individual having legal custody of the student or by the student if he or she has reached the age of 18.

(3) The destruction of all of a student's biometric information within 30 days after the use of the biometric information is discontinued in accordance with item (2) of this subsection (b).

(4) Within the context of the legitimate instructional purposes, the The use of biometric information solely for identification or fraud prevention.

(5) A prohibition on the sale, lease, or other disclosure of biometric information to another person or entity, unless:

(A) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or

(B) the disclosure is required by court order.

(6) The storage, transmittal, and protection of all biometric information from disclosure.

(c) Failure to provide written consent under item (1) of subsection (b) of this Section by the individual who has legal custody of the student or by the student, if he or she has reached the age of 18, must not be the basis for refusal of any services otherwise available to the student.

(d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the use of the biometric information is discontinued in accordance with item (2) of subsection (b) of this Section.

(e) Nothing in this Section may be construed to conflict with a school district's obligations under federal law, including, but not limited to, the Individuals with Disabilities Education Act and Section 504 of the Rehabilitation Act of 1973.

(Source: P.A. 95-232, eff. 8-16-07; 95-793, eff. 1-1-09; 95-876, eff. 8-21-08; 96-328, eff. 8-11-09.)

(105 ILCS 5/34-18.34)

Sec. 34-18.34. Student biometric information.

(a) For the purposes of this Section: ,

"Biometric" "biometric information" means any information that is collected through an identification process for individuals based on their unique behavioral or physiological characteristics, including fingerprint, hand geometry, voice, or facial recognition or iris or retinal scans.

"Biometric system" means any combination of hardware, software, firmware, or tools used to obtain, collect, process, store, transmit, display, or otherwise handle biometric information, including, but not limited to, facial recognition or voice recognition software and software to conduct fingerprint, hand geometry, or iris or retinal scans.

"Facial recognition" means any tool using an automated or semiautomated process that assists in uniquely identifying or verifying a person by comparing or analyzing patterns based on the person's face.

(a-5) Except for legitimate instructional purposes, as determined by the school district, the school district is prohibited from purchasing or otherwise acquiring biometric systems to use on students. This subsection does not apply if the school district purchases or acquires a biometric system but disables the biometric capabilities of that system so it cannot be used on students or has no reasonable knowledge that the software the school district purchased or otherwise acquired has biometric capabilities.

(a-10) By the 2027-2028 school year, the school district shall ensure that the biometric systems it uses are used only for legitimate instructional purposes, as determined by the school district. Within the context of the legitimate instructional purposes, the use of biometric information shall be solely for identification or fraud prevention. Biometric systems incorporated into school-issued electronic devices for identification or fraud prevention constitute a legitimate instructional purpose under this Section.

The provisions of subsection (a-5) and this subsection (a-10) regarding the use of biometric information for purposes other than legitimate instructional purposes shall not affect any existing contractual obligation under a contract entered into before January 1, 2027 between a school district and any entity for the purpose of obtaining, collecting, processing, storing, transmitting, displaying, or otherwise handling biometric information, as long as the contract is not extended or rolled over if the contract may be extended or rolled over. A school district that has entered into a contract with an entity for the purpose of obtaining, collecting, processing, storing, transmitting, displaying, or otherwise handling biometric information before January 1, 2027 shall provide a written notice, by the 2027-2028 school year, to the individual having legal custody of the student or to the student if he or she has reached the age of 18 of the existing option to discontinue the use of the student's biometric information under subparagraph (B) of paragraph (2) of subsection (b). Any provision of a contract between an entity and a school district for the purpose of obtaining, collecting, processing, storing, transmitting, displaying, or otherwise handling biometric information entered into on or after January 1, 2027 that conflicts with this Section is void.

(b) If the school district collects biometric information from students for legitimate instructional purposes, the district shall adopt a policy that requires, at a minimum, all of the following:

(1) Written permission from the individual who has legal custody of the student, as defined in Section 10-20.12b of this Code, or from the student if he or she has reached the age of 18.

(2) The discontinuation of use of a student's biometric information under either of the following conditions:

(A) upon the student's graduation or withdrawal from the school district; or

(B) upon receipt in writing of a request for discontinuation by the individual having legal custody of the student or by the student if he or she has reached the age of 18.

(3) The destruction of all of a student's biometric information within 30 days after the use of the biometric information is discontinued in accordance with item (2) of this subsection (b).

(4) Within the context of the legitimate instructional purposes, the The use of biometric information solely for identification or fraud prevention.

(5) A prohibition on the sale, lease, or other disclosure of biometric information to another person or entity, unless:

(A) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or

(B) the disclosure is required by court order.

(6) The storage, transmittal, and protection of all biometric information from disclosure.

(c) Failure to provide written consent under item (1) of subsection (b) of this Section by the individual who has legal custody of the student or by the student, if he or she has reached the age of 18, must not be the basis for refusal of any services otherwise available to the student.

(d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the use of the biometric information is discontinued in accordance with item (2) of subsection (b) of this Section.

(e) Nothing in this Section may be construed to conflict with the school district's obligations under federal law, including, but not limited to, the Individuals with Disabilities Education Act and Section 504 of the Rehabilitation Act of 1973.

(Source: P.A. 95-232, eff. 8-16-07; 95-793, eff. 1-1-09; 95-876, eff. 8-21-08.)