SB3092ham001 98TH GENERAL ASSEMBLY

Rep. Scott Drury

Filed: 5/27/2014

09800SB3092ham001 LRB098 15075 KTG 59710 a

AMENDMENT TO SENATE BILL 3092

AMENDMENT NO. ______. Amend Senate Bill 3092 by replacing everything after the enacting clause with the following:

"Section 5. The Illinois School Student Records Act is amended by changing Sections 2 and 6 as follows:

(105 ILCS 10/2) (from Ch. 122, par. 50-2)

Sec. 2. As used in this Act,

(a) "Student" means any person enrolled or previously enrolled in a school.

(b) "School" means any public preschool, day care center, kindergarten, nursery, elementary or secondary educational institution, vocational school, special educational facility or any other elementary or secondary educational agency or institution and any person, agency or institution which maintains school student records from more than one school, but does not include a private or non-public school.

(c) "State Board" means the State Board of Education.

(d) "School Student Record" means any writing or other recorded information concerning a student and by which a student may be individually or personally identified, maintained by a school or at its direction or by an employee of a school, regardless of how or where the information is stored. The following shall not be deemed school student records under this Act: writings or other recorded information maintained by an employee of a school or other person at the direction of a school for his or her exclusive use; provided that all such writings and other recorded information are destroyed not later than the student's graduation or permanent withdrawal from the school; and provided further that no such records or recorded information may be released or disclosed to any person except a person designated by the school as a substitute unless they are first incorporated in a school student record and made subject to all of the provisions of this Act. School student records shall not include information maintained by law enforcement professionals working in the school.

(e) "Student Permanent Record" means the minimum personal information necessary to a school in the education of the student and contained in a school student record. Such information may include the student's name, birth date, address, grades and grade level, parents' names and addresses, attendance records, and such other entries as the State Board may require or authorize.

(f) "Student Temporary Record" means all information contained in a school student record but not contained in the student permanent record. Such information may include family background information, intelligence test scores, aptitude test scores, psychological and personality test results, teacher evaluations, and other information of clear relevance to the education of the student, all subject to regulations of the State Board. The information shall include information provided under Section 8.6 of the Abused and Neglected Child Reporting Act. In addition, the student temporary record shall include information regarding serious disciplinary infractions that resulted in expulsion, suspension, or the imposition of punishment or sanction. For purposes of this provision, serious disciplinary infractions means: infractions involving drugs, weapons, or bodily harm to another.

(g) "Parent" means a person who is the natural parent of the student or other person who has the primary responsibility for the care and upbringing of the student. All rights and privileges accorded to a parent under this Act shall become exclusively those of the student upon his 18th birthday, graduation from secondary school, marriage or entry into military service, whichever occurs first. Such rights and privileges may also be exercised by the student at any time with respect to the student's permanent school record.

(h) "Eligible Student" means a student who has reached 18 years of age.

(Source: P.A. 92-295, eff. 1-1-02.)

(105 ILCS 10/6) (from Ch. 122, par. 50-6)

Sec. 6. (a) No school student records or information contained therein may be released, transferred, disclosed or otherwise disseminated, except as follows:

(1) To a parent or student or person specifically designated as a representative by a parent, as provided in paragraph (a) of Section 5. ;

(2) To an employee or official of the school or school district or State Board with current demonstrable educational or administrative interest in the student, in furtherance of such interest. ;

(3) To the official records custodian of another school within Illinois or an official with similar responsibilities of a school outside Illinois, in which the student has enrolled, or intends to enroll, upon the request of such official or student. ;

(4) Except as set forth in subparagraph (4.5) of this paragraph (a), to To any person or entity for the purpose of research, statistical reporting, or planning, audit, or evaluation, provided that (i) such research, statistical reporting, or planning, audit, or evaluation is permissible under and undertaken in accordance with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g) and (ii) the school board, school district, school, or State Board requires the person or entity to do the following:

(A) Not use, share, disclose, or compile the school student records or information contained therein for any purpose other than that for which the information is provided, which purpose shall be set forth in writing by the school board, school district, school, or State Board and signed by the person or entity.

(B) Not use, share, disclose, or compile the school student records or information contained therein for any commercial purpose, including, but not limited to, advertising or profiling.

(C) Not, in any way whatsoever, allow, facilitate, or aid in the marketing or advertising of a product or service to a student whose school student records or the information contained therein has been received by the person or entity.

(D) Take all reasonable steps to protect the school student records and information contained therein in a manner that meets or exceeds reasonable and appropriate commercial best practices. Where the school student records or information contained therein is maintained in an electronic format, reasonable and appropriate commercial best practices include, at a minimum, all of the following:

(i) Valid encryption processes for data at rest in the person or entity's own data storage systems that are consistent with NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices.

(ii) Valid encryption processes for data in motion on public networks that comply, as appropriate, with NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations; NIST Special Publication 800-77, Guide to IPsec VPNs; or NIST Special Publication 800-113, Guide to SSL VPNs, or others that are Federal Information Processing Standards (FIPS) Publication 140-2 validated.

(E) Delete a school student record and information contained therein if any of the following occurs:

(i) The school student record and information contained therein is no longer being used for the purpose directed by the school board, school district, school, or State Board.

(ii) A parent or eligible student requests deletion, unless the school student record or information contained therein is being used or maintained at the direction of a school board, school district, or school, or the State Board and is under the direct control of such school board, school district, school, or State Board.

(iii) The school board, school district, school, or State Board requests deletion.

(4.1) Nothing in paragraph (4) shall prohibit a person or entity from sharing, disclosing, or compiling school student records or the information contained therein if other provisions of federal or State law require such sharing, disclosure, or compilation, and the person or entity complies with the requirements of federal and State law in protecting that information.

(4.2) If a school board, school district, or school, or the State Board is unable to gain compliance by a person or entity with the requirements of paragraph (4), but determines that releasing, transferring, disclosing, or otherwise disseminating school student records or information contained therein to such a person or entity is essential to an educational objective, the school board, school district, school, or State Board may release, transfer, disclose, or otherwise disseminate such school student records and the information contained therein provided that all of the following occurs:

(A) The school board, school district, school, or State Board publicly notifies parents and eligible students at least 21 days in advance of the student's school student records or information contained therein being released, transferred, disclosed, or otherwise disseminated of: (i) the planned release, transfer, disclosure, or dissemination; and (ii) the purpose of the planned release, transfer, disclosure, or dissemination.

(B) The school board, school district, school, or State Board provides parents and eligible students with (i) the opportunity to opt out of having the relevant school student records or information contained therein released, transferred, disclosed, or otherwise disseminated; and (ii) instructions setting forth how to opt out. ;

(4.5) To researchers at an accredited post-secondary educational institution or an organization conducting research pursuant to a specific, written agreement with the school or school district or State Board and in accordance with the federal Family Educational Rights and Privacy Act, provided that such researchers and organizations comply with the following requirements:

(A) The nature of the research shall be first publicly disclosed in advance of the research being conducted by providing general notice regarding planned studies or research to parents, guardians, or eligible students prior to the beginning of each school year and by posting an updated notice of additional research or studies on the Internet website of the school board, school district, school, or State Board as additional research or studies are added. If the school board, school district, or school does not have an Internet website that can be updated with notice of additional research or studies, the school board, school district, or school shall send written notification to affected parents, guardians, or eligible students as additional research or studies are added. Any notice provided under this paragraph shall set forth, in general terms, the nature of the research, the persons to whom the research will apply, and the topics thereof. The notice requirements in this paragraph do not apply to eligible students or parents or guardians of students who have graduated or left the school, school district, or State as of the effective date of this amendatory Act of the 98th General Assembly.

(B) The post-secondary educational institution or an organization conducting research and the school, school district, or State Board shall enter into a data use agreement which shall be signed by the party gaining access to the data and the school board, school district, or school and which complies with the federal Family Educational Rights and Privacy Act and its accompanying regulations and, at a minimum, sets forth the following:

(i) a requirement that the post-secondary educational institution or the organization conducting research shall abide by all requirements of this subdivision (B);

(ii) the purpose, scope, subjects, and duration of the study or studies, the information to be disclosed, and the person or persons to whom the information shall be disclosed; the person or persons to whom the information shall be disclosed may be updated to include additional persons;

(iii) a requirement that the persons described in item (ii) shall use school student records only to meet the purpose or purposes of the study as set forth pursuant to item (ii) and only after written or other recorded information concerning a student and by which a student may be individually identified has been removed from such records;

(iv) a requirement that the post-secondary educational institution or the organization conducting research shall use written or other recorded information concerning a student and by which a student may be individually or personally identified only to link data files and, in such instances, the post-secondary educational institution or the organization conducting research shall designate in writing the person or persons to whom such information will be disclosed;

(v) a requirement that the post-secondary educational institution or the organization conducting research shall destroy all written or other recorded information that individually or personally identifies a student when the information is no longer needed, but in no event later than 36 months after the study has been completed;

(vi) a requirement that the post-secondary educational institution or the organization conducting research shall certify in writing that it has the capacity to and shall restrict access to school student records and shall maintain the security of all written and electronic information received pursuant to this Section in compliance with rules that shall be adopted by the State Board, which shall be consistent with and regularly updated to comply with commonly accepted data-security practices, including, but not limited to, those set forth by the United States Department of Education Privacy Technical Assistance Center;

(vii) a requirement that, in compliance with the rules adopted pursuant to item (vi), the post-secondary educational institution or the organization conducting research shall develop, implement, maintain, and use appropriate administrative, technical, and physical security measures to preserve the confidentiality, integrity, and availability of all school student records.

(C) The post-secondary educational institution or the organization conducting research shall use personally identifiable information from school student records only to meet the purpose or purposes of the study as stated in the written data use agreement described in subdivision (B) of this subparagraph (4.5).

For purposes of this subparagraph (4.5), any information by which a student may be individually or personally identified shall be released, transferred, disclosed, or otherwise disseminated only as contemplated by the data use agreement between the parties containing the provisions set forth in subdivision (B) of this subparagraph (4.5). The school student records shall be redacted prior to analysis by the post-secondary educational institution or the organization conducting research. Any personally identifiable information used to link data sets shall be stored in a secure data file or location outside of the secure data storage where redacted information from the school student records is stored. The post-secondary educational institution or the organization conducting research shall implement and adhere to policies and procedures that restrict access to information by which a student may be individually or personally identified. The post-secondary educational institution or the organization conducting research shall designate an individual to act as the custodian of the personally identifiable information who is responsible for restricting access to that information.

Nothing in this subparagraph (4.5) shall prohibit the State Board or any school or school district from providing personally identifiable information about individual students to an accredited post-secondary educational institution or an organization conducting research pursuant to a specific, written agreement with the school or school district or State Board and in accordance with the federal Family Educational Rights and Privacy Act, where necessary for the State Board, school, or school district to comply with State or federal statutory mandates.

(5) Pursuant to a court order, provided that the parent shall be given prompt written notice upon receipt of such order of the terms of the order, the nature and substance of the information proposed to be released in compliance with such order and an opportunity to inspect and copy the school student records and to challenge their contents pursuant to Section 7. ;

(6) To any person as specifically required by State or federal law. ;

(6.5) To juvenile authorities when necessary for the discharge of their official duties who request information prior to adjudication of the student and who certify in writing that the information will not be disclosed to any other party except as provided under law or order of court. For purposes of this Section "juvenile authorities" means: (i) a judge of the circuit court and members of the staff of the court designated by the judge; (ii) parties to the proceedings under the Juvenile Court Act of 1987 and their attorneys; (iii) probation officers and court appointed advocates for the juvenile authorized by the judge hearing the case; (iv) any individual, public or private agency having custody of the child pursuant to court order; (v) any individual, public or private agency providing education, medical or mental health service to the child when the requested information is needed to determine the appropriate service or treatment for the minor; (vi) any potential placement provider when such release is authorized by the court for the limited purpose of determining the appropriateness of the potential placement; (vii) law enforcement officers and prosecutors; (viii) adult and juvenile prisoner review boards; (ix) authorized military personnel; (x) individuals authorized by court. ;

(7) Subject to regulations of the State Board, in connection with an emergency, to appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons. ;

(8) To any person, with the prior specific dated written consent of the parent designating the person to whom the records may be released, provided that at the time any such consent is requested or obtained, the parent shall be advised in writing that he has the right to inspect and copy such records in accordance with Section 5, to challenge their contents in accordance with Section 7 and to limit any such consent to designated records or designated portions of the information contained therein. ;

(9) To a governmental agency, or social service agency contracted by a governmental agency, in furtherance of an investigation of a student's school attendance pursuant to the compulsory student attendance laws of this State, provided that the records are released to the employee or agent designated by the agency. ;

(10) To those SHOCAP committee members who fall within the meaning of "state and local officials and authorities", as those terms are used within the meaning of the federal Family Educational Rights and Privacy Act, for the purposes of identifying serious habitual juvenile offenders and matching those offenders with community resources pursuant to Section 5-145 of the Juvenile Court Act of 1987, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the Family Educational Rights and Privacy Act. ;

(11) To the Department of Healthcare and Family Services in furtherance of the requirements of Section 2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or Section 10 of the School Breakfast and Lunch Program Act. ; or

(12) To the State Board or another State government agency or between or among State government agencies in order to evaluate or audit federal and State programs or perform research and planning, but only to the extent that the release, transfer, disclosure, or dissemination is consistent with the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g).

(b) No information may be released pursuant to subparagraphs (3) or (6) of paragraph (a) of this Section 6 unless the parent receives prior written notice of the nature and substance of the information proposed to be released, and an opportunity to inspect and copy such records in accordance with Section 5 and to challenge their contents in accordance with Section 7. Provided, however, that such notice shall be sufficient if published in a local newspaper of general circulation or other publication directed generally to the parents involved where the proposed release of information is pursuant to subparagraph 6 of paragraph (a) in this Section 6 and relates to more than 25 students.

(c) A record of any release of information pursuant to this Section must be made and kept as a part of the school student record and subject to the access granted by Section 5. Such record of release shall be maintained for the life of the school student records and shall be available only to the parent and the official records custodian. Each record of release shall also include:

(1) The nature and substance of the information released;

(2) The name and signature of the official records custodian releasing such information;

(3) The name of the person requesting such information, the capacity in which such a request has been made, and the purpose of such request;

(4) The date of the release; and

(5) A copy of any consent to such release.

(d) Except for the student and his parents, no person to whom information is released pursuant to this Section and no person specifically designated as a representative by a parent may permit any other person to have access to such information without a prior consent of the parent obtained in accordance with the requirements of subparagraph (8) of paragraph (a) of this Section.

(e) Nothing contained in this Act shall prohibit the publication of student directories which list student names, addresses and other identifying information and similar publications which comply with regulations issued by the State Board.

(Source: P.A. 95-331, eff. 8-21-07; 95-793, eff. 1-1-09; 96-107, eff. 7-30-09; 96-1000, eff. 7-2-10.)

Section 10. The Children's Privacy Protection and Parental Empowerment Act is amended by changing Section 10 as follows:

(325 ILCS 17/10)

Sec. 10. Prohibited act.

(a) The sale or purchase of personal information concerning an individual known to be a child without parental consent is prohibited.

(b) This Section does not apply when the sale or purchase described in subsection (a) is made under a criminal or civil investigation that is otherwise lawful.

(Source: P.A. 93-462, eff. 1-1-04.)

(325 ILCS 17/15 rep.)

Section 15. The Children's Privacy Protection and Parental Empowerment Act is amended by repealing Section 15.".