SB3092sam001 98TH GENERAL ASSEMBLY

Sen. William Delgado

Filed: 4/10/2014

09800SB3092sam001 LRB098 15075 NHT 58512 a

AMENDMENT TO SENATE BILL 3092

AMENDMENT NO. ______. Amend Senate Bill 3092 by replacing everything after the enacting clause with the following:

"Section 5. The P-20 Longitudinal Education Data System Act is amended by adding Section 32 as follows:

(105 ILCS 13/32 new)

Sec. 32. Personally identifiable information limitations.

(a) In this Section:

"Education records" has the meaning ascribed to that term in 34 CFR 99.3.

"Organization" means not-for-profit organizations, think tanks, or other organizations conducting research studies.

"Personally identifiable information" means (i) any personally identifiable information under the federal Family Educational Rights Act of 1974 (FERPA), other than "directory information" as that term is defined in Section 99.3 of the federal regulations implementing FERPA (34 CFR 99.3), and (ii) the personally identifiable information of teachers, other educators, and school administrators, other than publicly available, school-related information such as the name, school location, and grade levels or subjects taught.

(b) If an audit or evaluation or a compliance or enforcement activity in connection with legal requirements that relate to State-supported or school district-supported educational programs requires or is used as the basis for granting access to personally identifiable information, the State Board or a school shall designate parties only under their direct control to act as authorized representatives to conduct the audit, evaluation, or activity.

(c) The State Board or schools may not disclose any personally identifiable information, including personally identifiable information from education records of students, to a contractor, consultant, or other party to whom the State Board or school has outsourced services or functions without providing notice to parents, guardians, and eligible students by posting the intent to disclose the information on the Internet website of the school or State Board at least 30 days in advance or as soon as practicable, unless that outside party:

(1) performs an institutional service or function for which the State Board or the school would otherwise use employees;

(2) is under the direct control of the State Board or the school with respect to the use and maintenance of education records;

(3) limits internal access to education records to those individuals who are determined to have legitimate educational interests;

(4) does not use the education records for any purposes other than those authorized in its contract;

(5) does not disclose any personally identifiable information to any other party (i) without the prior notification to the eligible student, parent, or guardian or (ii) unless required by law and the party provides a notice of the disclosure to the State Board or school board that provided the information no later than the time the information is disclosed, to the extent allowed by law or by the terms of a court order;

(6) maintains reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of personally identifiable information in its custody and conducts regular security audits to confirm the efficacy of those safeguards;

(7) uses appropriate encryption technologies to protect data while in motion or in its custody from unauthorized disclosure;

(8) has sufficient administrative and technical procedures to monitor continuously the security of personally identifiable information in its custody;

(9) maintains a breach remediation plan prior to initial receipts of the personally identifiable information and reports breaches as specified by the Personal Information Protection Act;

(10) reports all actual security breaches to the State Board or the school that provided personally identifiable information and education records as soon as possible, but no later than 72 hours after an actual breach was known or in the most expedient amount of time possible under the circumstances;

(11) agrees, in the event of a security breach or an unauthorized disclosure of personally identifiable information, to pay all costs and liabilities incurred by the State Board or school related to the security breach or unauthorized disclosure, including without limitation the costs of responding to inquiries about the security breach or unauthorized disclosure, of notifying the subjects of personally identifiable information about the breach, of mitigating the effects of the breach for the subjects of personally identifiable information, and of investigating the cause or consequences of the security breach or unauthorized disclosure; and

(12) destroys or returns to the State Board or school all personally identifiable information in its custody upon request and at the termination of the contract.

(d) The State Board or schools may disclose personally identifiable information from an education record of a student without the consent of the eligible student, parent, or guardian to a party conducting studies for or on behalf of the State Board or school to (i) develop, validate, or administer predictive tests, (ii) administer student aid programs, or (iii) improve instruction, provided that the outside party conducting the study meets all of the requirements for contractors set forth in subsection (c) of this Section.

(d-5) The State Board or schools may disclose personally identifiable information from an education record of a student to researchers at an organization or accredited post-secondary educational institution conducting research pursuant to a specific, written agreement with the school or State Board and in accordance with the federal Family Educational Rights and Privacy Act of 1974, provided that:

(1) the nature of the research is first publicly disclosed to parents, guardians, and eligible students on the Internet website of the school or State Board at least 30 days in advance of the research being conducted or as soon as practicable;

(2) the organization or institution and the school or State Board enter into a data use agreement that complies with the federal Family Educational Rights and Privacy Act of 1974 and its accompanying rules and includes, at a minimum, the following:

(A) the purpose, scope, and duration of the study or studies and the information to be disclosed;

(B) provisions requiring the organization or institution to use personally identifiable information from school student records only to meet the purpose or purposes of the study as stated in the written agreement;

(C) provisions requiring the organization or institution to conduct the study in a manner that does not permit personal identification of parents or guardians and students by anyone other than representatives of the organization with legitimate interests;

(D) provisions requiring the organization or institution to destroy all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and specifying the time period in which the information must be destroyed;

(E) provisions requiring the organization or institution to certify that it has the capacity to and will restrict access to the school student records and maintain the security of electronic information; and

(F) provisions requiring the organization or institution to develop, implement, maintain, and use appropriate administrative, technical, and physical security measures to preserve the confidentiality, integrity, and availability of all school student records; and

(3) the organization or institution uses personally identifiable information from school student records only to meet the purpose or purposes of the study as stated in the written agreement.

For purposes of this subsection (d-5), any information by which a student may be individually or personally identified may only be released, transferred, disclosed, or otherwise disseminated as contemplated by the agreement between the parties. The school student records must be redacted prior to analysis by the organization or institution. Any personally identifiable information used to link data sets must be stored in a secure data file or location outside of the secure data storage where redacted information from the school regarding student records is stored. The organization or institution shall implement and adhere to policies and procedures that restrict access to information by which a student may be individually or personally identified. The organization or institution shall designate an individual to act as the custodian of the personally identifiable information who is responsible for restricting access to that information.

Nothing in this subsection (d-5) prohibits or limits the ability of the State Board or any school to provide personally identifiable information about individual students to a school official, organization, or institution for the purposes of developing, administering, scoring, or interpreting results of student assessments or predictive tests if those assessments or tests require individualized development or administration based on the needs of individual students.

(e) The State Board or schools may not disclose any personally identifiable information, including personally identifiable information from education records of students, without the written consent of eligible students, parents, or guardians to any party for a commercial use, including without limitation marketing products or services, compiling lists for sale or rental, developing products or services, or creating individual, household, or group profiles, nor may such disclosure be made for the provision of services other than contracting, studies, and audits or evaluations as authorized and limited by subsections (c), (d), and (d-5) of this Section.

(f) The State Board or schools may not, directly or through contracts with outside parties, maintain personally identifiable information, including personally identifiable information from education records of students, without the proper notification to eligible students, parents, or guardians, unless the maintenance of the information is:

(1) explicitly mandated in federal or State statute;

(2) administratively required for the proper performance of their duties under the law and is relevant to and necessary for the delivery of services; or

(3) designed to support a study of students or former students.

(g) The State Board and schools shall publicly and conspicuously disclose on their Internet websites and through annual electronic notification to the chairperson of the House of Representatives Elementary & Secondary Education Committee and the chairperson of the Senate Education Committee the existence and character of any personally identifiable information that they, directly or through contracts with outside parties, maintain. The disclosure and notification shall include:

(1) the name and location of the data repository where the information is maintained;

(2) the legal authority that authorizes the establishment and existence of the data repository;

(3) the principal purpose or purposes for which the information is intended to be used;

(4) the categories of individuals on whom records are maintained in the data repository;

(5) the categories of records maintained in the data repository;

(6) each expected disclosure of the records contained in the data repository, including the categories of recipients and the purpose of each disclosure;

(7) the policies and practices of the State Board or school regarding storage, retrievability, access controls, retention, and disposal of the records;

(8) the title and business address of the State Board or school official who is responsible for the data repository and the name and business address of any contractor or other outside party maintaining the data repository for or on behalf of the State Board or school;

(9) the procedures whereby eligible students, parents, or guardians can be notified at their request if the data repository contains a record pertaining to the student, parent, or guardian;

(10) the procedures whereby eligible students, parents, or guardians can be notified at their request on how to gain access to any record pertaining to the student, parent, or guardian contained in the data repository and how they can contest its content; and

(11) the categories of sources of records in the data repository.

(h) The State Board and schools may not append education records with personally identifiable information obtained from other federal or State agencies through data matches without the proper notification to eligible students, parents, or guardians unless the data matches are:

(1) explicitly mandated in federal or State statute; or

(2) administratively required for the proper performance of their duties under the law and are relevant to and necessary for the delivery of services.

(i) Each violation of this Section by an organization or entity that is not the State Board or a school is subject to a civil penalty of up to $1,000 for a first violation, up to $5,000 for a second violation, and up to $10,000 for a third or subsequent violation. Each violation involving a different individual's personally identifiable information shall be considered a separate violation for purposes of civil penalties.

(j) The Attorney General shall have the authority to enforce compliance with this Section by investigation and subsequent commencement of a civil action to seek civil penalties for violations of this Section and to seek appropriate injunctive relief, including without limitation a prohibition on obtaining personally identifiable information for an appropriate time period. In carrying out an investigation and in maintaining a civil action, the Attorney General or any deputy or assistant Attorney General is authorized to subpoena witnesses, compel their attendance, examine them under oath, and require that any books, records, documents, papers, or electronic records relevant or material to the inquiry be turned over for inspection, examination, or audit, pursuant to the Civil Practice Law and rules. Subpoenas issued pursuant to this subsection (j) may be enforced pursuant to the Civil Practice Law and rules.

(k) Nothing contained in this Section shall be construed as creating a private right of action against the State Board or a school.

(l) Nothing in this Section shall limit the administrative use of personally identifiable information by a person acting exclusively in the person's capacity as an employee of a school, this State, a court, or the federal government that is otherwise required by law.

Section 99. Effective date. This Act takes effect upon becoming law.".