SB3092eng 98TH GENERAL ASSEMBLY

SB3092 Engrossed LRB098 15075 NHT 50039 b

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The P-20 Longitudinal Education Data System Act is amended by adding Section 32 as follows:

(105 ILCS 13/32 new)

Sec. 32. Personally identifiable information limitations.

(a) In this Section:

"Education records" has the meaning ascribed to that term in 34 CFR 99.3.

"Organization" means not-for-profit organizations, think tanks, or other organizations conducting research studies.

"Personally identifiable information" means (i) any personally identifiable information under the federal Family Educational Rights Act of 1974 (FERPA), other than "directory information" as that term is defined in Section 99.3 of the federal regulations implementing FERPA (34 CFR 99.3), and (ii) the personally identifiable information of teachers, other educators, and school administrators, other than publicly available, school-related information such as the name, school location, and grade levels or subjects taught.

(b) If an audit or evaluation or a compliance or enforcement activity in connection with legal requirements that relate to State-supported or school district-supported educational programs requires or is used as the basis for granting access to personally identifiable information, the State Board or a school shall designate parties only under their direct control to act as authorized representatives to conduct the audit, evaluation, or activity.

(c) The State Board or schools may not disclose any personally identifiable information, including personally identifiable information from education records of students, to a contractor, consultant, or other party to whom the State Board or school has outsourced services or functions without providing notice to parents, guardians, and eligible students by posting the intent to disclose the information on the Internet website of the school or State Board at least 30 days in advance or as soon as practicable, unless that outside party:

(1) performs an institutional service or function for which the State Board or the school would otherwise use employees;

(2) is under the direct control of the State Board or the school with respect to the use and maintenance of education records;

(3) limits internal access to education records to those individuals who are determined to have legitimate educational interests;

(4) does not use the education records for any purposes other than those authorized in its contract;

(5) does not disclose any personally identifiable information to any other party (i) without the prior notification to the eligible student, parent, or guardian or (ii) unless required by law and the party provides a notice of the disclosure to the State Board or school board that provided the information no later than the time the information is disclosed, to the extent allowed by law or by the terms of a court order;

(6) maintains reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of personally identifiable information in its custody and conducts regular security audits to confirm the efficacy of those safeguards;

(7) uses appropriate encryption technologies to protect data while in motion or in its custody from unauthorized disclosure;

(8) has sufficient administrative and technical procedures to monitor continuously the security of personally identifiable information in its custody;

(9) maintains a breach remediation plan prior to initial receipts of the personally identifiable information and reports breaches as specified by the Personal Information Protection Act;

(10) reports all actual security breaches to the State Board or the school that provided personally identifiable information and education records as soon as possible, but no later than 72 hours after an actual breach was known or in the most expedient amount of time possible under the circumstances;

(11) agrees, in the event of a security breach or an unauthorized disclosure of personally identifiable information, to pay all costs and liabilities incurred by the State Board or school related to the security breach or unauthorized disclosure, including without limitation the costs of responding to inquiries about the security breach or unauthorized disclosure, of notifying the subjects of personally identifiable information about the breach, of mitigating the effects of the breach for the subjects of personally identifiable information, and of investigating the cause or consequences of the security breach or unauthorized disclosure; and

(12) destroys or returns to the State Board or school all personally identifiable information in its custody upon request and at the termination of the contract.

(d) The State Board or schools may disclose personally identifiable information from an education record of a student without the consent of the eligible student, parent, or guardian to a party conducting studies for or on behalf of the State Board or school to (i) develop, validate, or administer predictive tests, (ii) administer student aid programs, or (iii) improve instruction, provided that the outside party conducting the study meets all of the requirements for contractors set forth in subsection (c) of this Section.

(d-5) The State Board or schools may disclose personally identifiable information from an education record of a student to researchers at an organization or accredited post-secondary educational institution conducting research pursuant to a specific, written agreement with the school or State Board and in accordance with the federal Family Educational Rights and Privacy Act of 1974, provided that:

(1) the nature of the research is first publicly disclosed to parents, guardians, and eligible students on the Internet website of the school or State Board at least 30 days in advance of the research being conducted or as soon as practicable;

(2) the organization or institution and the school or State Board enter into a data use agreement that complies with the federal Family Educational Rights and Privacy Act of 1974 and its accompanying rules; and

(3) the organization or institution uses personally identifiable information from school student records only to meet the purpose or purposes of the study as stated in the written agreement.

For purposes of this subsection (d-5), any information by which a student may be individually or personally identified may only be released, transferred, disclosed, or otherwise disseminated as contemplated by the agreement between the parties. The school student records must be redacted prior to analysis by the organization or institution. Any personally identifiable information used to link data sets must be stored in a secure data file or location outside of the secure data storage where redacted information from the school regarding student records is stored. The organization or institution shall implement and adhere to policies and procedures that restrict access to information by which a student may be individually or personally identified. The organization or institution shall designate an individual to act as the custodian of the personally identifiable information who is responsible for restricting access to that information.

Nothing in this subsection (d-5) prohibits or limits the ability of the State Board or any school to provide personally identifiable information about individual students to a school official, organization, or institution for the purposes of developing, administering, scoring, or interpreting results of student assessments or predictive tests if those assessments or tests require individualized development or administration based on the needs of individual students.

(e) The State Board or schools may not disclose any personally identifiable information, including personally identifiable information from education records of students, without the written consent of eligible students, parents, or guardians to any party for a commercial use, including without limitation marketing products or services, compiling lists for sale or rental, developing products or services, or creating individual, household, or group profiles, nor may such disclosure be made for the provision of services other than contracting, studies, and audits or evaluations as authorized and limited by subsections (c), (d), and (d-5) of this Section.

(f) The State Board or schools may not, directly or through contracts with outside parties, maintain personally identifiable information, including personally identifiable information from education records of students, without the proper notification to eligible students, parents, or guardians, unless the maintenance of the information is:

(1) explicitly mandated in federal or State statute;

(2) administratively required for the proper performance of their duties under the law and is relevant to and necessary for the delivery of services; or

(3) designed to support a study of students or former students.

(g) The State Board and schools shall publicly and conspicuously disclose on their Internet websites and through annual electronic notification to the chairperson of the House of Representatives Elementary & Secondary Education Committee and the chairperson of the Senate Education Committee the existence and character of any personally identifiable information that they, directly or through contracts with outside parties, maintain. The disclosure and notification shall include:

(1) the name and location of the data repository where the information is maintained;

(2) the legal authority that authorizes the establishment and existence of the data repository;

(3) the principal purpose or purposes for which the information is intended to be used;

(4) the categories of individuals on whom records are maintained in the data repository;

(5) the categories of records maintained in the data repository;

(6) each expected disclosure of the records contained in the data repository, including the categories of recipients and the purpose of each disclosure;

(7) the policies and practices of the State Board or school regarding storage, retrievability, access controls, retention, and disposal of the records;

(8) the title and business address of the State Board or school official who is responsible for the data repository and the name and business address of any contractor or other outside party maintaining the data repository for or on behalf of the State Board or school;

(9) the procedures whereby eligible students, parents, or guardians can be notified at their request if the data repository contains a record pertaining to the student, parent, or guardian;

(10) the procedures whereby eligible students, parents, or guardians can be notified at their request on how to gain access to any record pertaining to the student, parent, or guardian contained in the data repository and how they can contest its content; and

(11) the categories of sources of records in the data repository.

(h) The State Board and schools may not append education records with personally identifiable information obtained from other federal or State agencies through data matches without the proper notification to eligible students, parents, or guardians unless the data matches are:

(1) explicitly mandated in federal or State statute;

(2) administratively required for the proper performance of their duties under the law and are relevant to and necessary for the delivery of services; or

(3) designed to support a study of students or former students.

(i) Any person aggrieved by any violation of this Section may institute an action for injunctive relief in the circuit court of the county in which the violation has occurred or the circuit court of the county in which the school is located. Any person injured by a willful or negligent violation of this Section may institute an action for damages in the circuit court of the county in which the violation has occurred or the circuit court of the county in which the school is located. In the case of any successful action under this paragraph, any person or school found to have willfully or negligently violated any provision of this Section is liable to the plaintiff for the plaintiff's damages, the costs of the action, and reasonable attorney's fees, as determined by the court.

Actions for injunctive relief to secure compliance with this Section may be brought by the State Board, by the State's Attorney of the county in which the alleged violation has occurred or the State's Attorney of the county in which the school is located, in each case in the circuit court of such county.

Willful failure to comply with this Section is a petty offense, except that any person who willfully and maliciously falsifies any school student record, student permanent record, or student temporary record is guilty of a Class A misdemeanor.

Absent proof of malice, no cause of action or claim for relief, civil or criminal, may be maintained against any school, employee or official of a school, or person acting at the direction of a school for any statement made or judgment expressed in any entry to a school student record of a type that does not violate this Section or rules adopted by the State Board, provided that this paragraph does not limit or deny any defense available under existing law.

(j) Nothing contained in this Section shall be construed as creating a private right of action against the State Board or a school.

(k) Nothing in this Section shall limit the administrative use of personally identifiable information by a person acting exclusively in the person's capacity as an employee of a school, this State, a court, or the federal government that is otherwise required by law.

Section 99. Effective date. This Act takes effect upon becoming law.