Illinois General Assembly - Full Text of HB3606
Illinois General Assembly

Previous General Assemblies

Full Text of HB3606  101st General Assembly


Rep. Robert Martwick

Filed: 4/9/2019





10100HB3606ham003LRB101 09053 AXK 59528 a


2    AMENDMENT NO. ______. Amend House Bill 3606 by replacing
3everything after the enacting clause with the following:
4    "Section 5. The Student Online Personal Protection Act is
5amended by changing Sections 5, 10, and 15 and by adding
6Sections 26, 27, 28, and 33 as follows:
7    (105 ILCS 85/5)
8    Sec. 5. Definitions. In this Act:
9    "Breach" means the unauthorized disclosure of data or
10unauthorized provision of physical or electronic means of
11gaining access to data that compromises the security,
12confidentiality, or integrity of covered information.
13    "Covered information" means personally identifiable
14information or material or information that is linked to
15personally identifiable information or material in any media or
16format that is not publicly available and is any of the



10100HB3606ham003- 2 -LRB101 09053 AXK 59528 a

2        (1) Created by or provided to an operator by a student
3    or the student's parent or legal guardian in the course of
4    the student's, parent's, or legal guardian's use of the
5    operator's site, service, or application for K through 12
6    school purposes.
7        (2) Created by or provided to an operator by an
8    employee or agent of a school or school district for K
9    through 12 school purposes.
10        (3) Gathered by an operator through the operation of
11    its site, service, or application for K through 12 school
12    purposes and personally identifies a student, including,
13    but not limited to, information in the student's
14    educational record or electronic mail, first and last name,
15    home address, telephone number, electronic mail address,
16    or other information that allows physical or online
17    contact, discipline records, test results, special
18    education data, juvenile dependency records, grades,
19    evaluations, criminal records, medical records, health
20    records, a social security number, biometric information,
21    disabilities, socioeconomic information, food purchases,
22    political affiliations, religious information, text
23    messages, documents, student identifiers, search activity,
24    photos, voice recordings, or geolocation information.
25    "Interactive computer service" has the meaning ascribed to
26that term in Section 230 of the federal Communications Decency



10100HB3606ham003- 3 -LRB101 09053 AXK 59528 a

1Act of 1996 (47 U.S.C. 230).
2    "K through 12 school purposes" means purposes that are
3directed by or that customarily take place at the direction of
4a school, teacher, or school district; aid in the
5administration of school activities, including, but not
6limited to, instruction in the classroom or at home,
7administrative activities, and collaboration between students,
8school personnel, or parents; or are otherwise for the use and
9benefit of the school.
10    "Longitudinal data system" has the meaning given to that
11term under the P-20 Longitudinal Education Data System Act.
12    "Operator" means, to the extent that an entity is operating
13in this capacity, the operator of an Internet website, online
14service, online application, or mobile application with actual
15knowledge that the site, service, or application is used
16primarily for K through 12 school purposes and was designed and
17marketed for K through 12 school purposes.
18    "Parent" has the meaning given to that term under the
19Illinois School Student Records Act.
20    "School" means (1) any preschool, public kindergarten,
21elementary or secondary educational institution, vocational
22school, special educational facility, or any other elementary
23or secondary educational agency or institution or (2) any
24person, agency, or institution that maintains school student
25records from more than one school. Except as otherwise provided
26in this Act, "school" "School" includes a private or nonpublic



10100HB3606ham003- 4 -LRB101 09053 AXK 59528 a

2    "State Board" means the State Board of Education.
3    "Student" has the meaning given to that term under the
4Illinois School Student Records Act.
5    "Targeted advertising" means presenting advertisements to
6a student where the advertisement is selected based on
7information obtained or inferred over time from that student's
8online behavior, usage of applications, or covered
9information. The term does not include advertising to a student
10at an online location based upon that student's current visit
11to that location or in response to that student's request for
12information or feedback, without the retention of that
13student's online activities or requests over time for the
14purpose of targeting subsequent ads.
15(Source: P.A. 100-315, eff. 8-24-17.)
16    (105 ILCS 85/10)
17    Sec. 10. Operator prohibitions. An operator shall not
18knowingly do any of the following:
19        (1) Engage in targeted advertising on the operator's
20    site, service, or application or target advertising on any
21    other site, service, or application if the targeting of the
22    advertising is based on any information, including covered
23    information and persistent unique identifiers, that the
24    operator has acquired because of the use of that operator's
25    site, service, or application for K through 12 school



10100HB3606ham003- 5 -LRB101 09053 AXK 59528 a

1    purposes.
2        (2) Use information, including persistent unique
3    identifiers, created or gathered by the operator's site,
4    service, or application to amass a profile about a student,
5    except in furtherance of K through 12 school purposes.
6    "Amass a profile" does not include the collection and
7    retention of account information that remains under the
8    control of the student, the student's parent or legal
9    guardian, or the school.
10        (3) Sell or rent a student's information, including
11    covered information. This subdivision (3) does not apply to
12    the purchase, merger, or other type of acquisition of an
13    operator by another entity if the operator or successor
14    entity complies with this Act regarding previously
15    acquired student information.
16        (4) Except as otherwise provided in Section 20 of this
17    Act, disclose covered information, unless the disclosure
18    is made for the following purposes:
19            (A) In furtherance of the K through 12 school
20        purposes of the site, service, or application if the
21        recipient of the covered information disclosed under
22        this clause (A) does not further disclose the
23        information, unless done to allow or improve
24        operability and functionality of the operator's site,
25        service, or application.
26            (B) To ensure legal and regulatory compliance or



10100HB3606ham003- 6 -LRB101 09053 AXK 59528 a

1        take precautions against liability.
2            (C) To respond to the judicial process.
3            (D) To protect the safety or integrity of users of
4        the site or others or the security of the site,
5        service, or application.
6            (E) For a school, educational, or employment
7        purpose requested by the student or the student's
8        parent or legal guardian, provided that the
9        information is not used or further disclosed for any
10        other purpose.
11            (F) To a third party if the operator contractually
12        prohibits the third party from using any covered
13        information for any purpose other than providing the
14        contracted service to or on behalf of the operator,
15        prohibits the third party from disclosing any covered
16        information provided by the operator with subsequent
17        third parties, and requires the third party to
18        implement and maintain reasonable security procedures
19        and practices as required under Section 15.
20    Nothing in this Section prohibits the operator's use of
21information for maintaining, developing, supporting,
22improving, or diagnosing the operator's site, service, or
24(Source: P.A. 100-315, eff. 8-24-17.)
25    (105 ILCS 85/15)



10100HB3606ham003- 7 -LRB101 09053 AXK 59528 a

1    Sec. 15. Operator duties. An operator shall do the
3        (1) Implement and maintain reasonable security
4    procedures and practices appropriate to the nature of the
5    covered information and designed to protect that covered
6    information from unauthorized access, destruction, use,
7    modification, or disclosure that, based on the sensitivity
8    of the data and the risk from unauthorized access, (i) use
9    technologies and methodologies that are consistent with
10    the U.S. Department of Commerce's National Institute of
11    Standards and Technology's Framework for Improving
12    Critical Infrastructure Cybersecurity Version 1.1 and any
13    updates to it or (ii) maintain technical safeguards as they
14    relate to the possession of covered information in a manner
15    consistent with the provisions of 45 CFR 164.312.
16        (2) Delete, within a reasonable time period, a
17    student's covered information if the school or school
18    district requests deletion of covered information under
19    the control of the school or school district, unless a
20    student or his or her parent or legal guardian consents to
21    the maintenance of the covered information.
22        (3) Publicly disclose material information about its
23    collection, use, and disclosure of covered information,
24    including, but not limited to, publishing a terms of
25    service agreement, privacy policy, or similar document.
26        (4) Except for a nonpublic school, for any operator who



10100HB3606ham003- 8 -LRB101 09053 AXK 59528 a

1    seeks to receive from a school, school district, or the
2    State Board in any manner any covered information, enter
3    into a written agreement with the school, school district,
4    or State Board before the covered information may be
5    transferred. The written agreement may be created in
6    electronic form and signed with an electronic or digital
7    signature or may be a click wrap agreement that is used
8    with software licenses, downloaded or online applications
9    and transactions for educational technologies, or other
10    technologies in which a user must agree to terms and
11    conditions before using the product or service. The written
12    agreement must contain all of the following:
13            (A) A listing of the categories or types of covered
14        information to be provided to the operator.
15            (B) A statement of the product or service being
16        provided to the school by the operator.
17            (C) A statement that the operator is acting as a
18        school official with a legitimate educational
19        interest, is performing an institutional service or
20        function for which the school would otherwise use
21        employees, under the direct control of the school, with
22        respect to the use and maintenance of covered
23        information, and is using the covered information only
24        for an authorized purpose and may not re-disclose it to
25        third parties or affiliates, unless otherwise
26        permitted under this Act, without permission from the



10100HB3606ham003- 9 -LRB101 09053 AXK 59528 a

1        school or pursuant to court order.
2            (D) A description of how, if a breach is attributed
3        to the operator, any costs and expenses incurred by the
4        school in investigating and remediating the breach
5        will be allocated between the operator and the school.
6        The costs and expenses may include, but are not limited
7        to:
8                (i) providing notification to the parents of
9            those students whose covered information was
10            compromised and to regulatory agencies or other
11            entities as required by law or contract;
12                (ii) providing credit monitoring to those
13            students whose covered information was exposed in
14            a manner during the breach that a reasonable person
15            would believe that it could impact his or her
16            credit or financial security;
17                (iii) legal fees, audit costs, fines, and any
18            other fees or damages imposed against the school as
19            a result of the security breach; and
20                (iv) providing any other notifications or
21            fulfilling any other requirements adopted by the
22            State Board or of any other State or federal laws.
23            (E) A statement that the operator must delete or
24        transfer to the school all covered information if the
25        information is no longer needed for the purposes of the
26        written agreement and to specify the time period in



10100HB3606ham003- 10 -LRB101 09053 AXK 59528 a

1        which the information must be deleted or transferred
2        once the operator is made aware that the information is
3        no longer needed for the purposes of the written
4        agreement.
5            (F) A statement that the school must publish the
6        written agreement on the school's website. If mutually
7        agreed upon by the school and the operator, provisions
8        of the written agreement, other than those under
9        subparagraphs (A), (B), and (C), may be redacted in the
10        copy of the written agreement published on the school's
11        website.
12        (5) In case of any breach, within the most expedient
13    time possible and without unreasonable delay, but no later
14    than 30 calendar days after the determination that a breach
15    has occurred, notify the school of any breach of the
16    students' covered information.
17(Source: P.A. 100-315, eff. 8-24-17.)
18    (105 ILCS 85/26 new)
19    Sec. 26. School prohibitions. A school may not do either of
20the following:
21        (1) Sell, rent, lease, or trade covered information.
22        (2) Share, transfer, disclose, or provide access to a
23    student's covered information to an entity or individual,
24    other than the student's parent or the State Board, without
25    a written agreement, unless the disclosure or transfer is:



10100HB3606ham003- 11 -LRB101 09053 AXK 59528 a

1            (A) to the extent permitted by federal law, to law
2        enforcement officials to protect the safety of users or
3        others or the security or integrity of the operator's
4        service;
5            (B) required by court order or State or federal
6        law; or
7            (C) to ensure legal or regulatory compliance.
8        This paragraph (2) does not apply to nonpublic schools.
9    (105 ILCS 85/27 new)
10    Sec. 27. School duties.
11    (a) Each school shall post and maintain on its website all
12of the following information:
13        (1) An explanation, that is clear and understandable by
14    a layperson, of the data elements of covered information
15    that the school collects, maintains, or discloses to any
16    person, entity, third party, or governmental agency. The
17    information must explain how the school uses, to whom or
18    what entities it discloses, and for what purpose it
19    discloses the covered information.
20        (2) A list of operators that the school has written
21    agreements with, a copy of each written agreement, and a
22    business address for each operator.
23        (3) For each operator, a list of any subcontractors to
24    whom covered information may be disclosed under Section 15.
25        (4) A written description of the procedures that a



10100HB3606ham003- 12 -LRB101 09053 AXK 59528 a

1    parent may use to carry out the rights enumerated under
2    Section 33.
3        (5) A list of any breaches of covered information
4    maintained by the school or breaches under Section 15 that
5    includes, but is not limited to, all of the following
6    information:
7            (A) The number of students whose covered
8        information is involved in the breach.
9            (B) The date, estimated date, or estimated date
10        range of the breach.
11            (C) For a breach under Section 15, the name of the
12        operator.
13    The school must, at a minimum, update the items under
14paragraphs (1), (3), (4), and (5) no later than 30 calendar
15days following the start of a school year and no later than 30
16days following the beginning of a calendar year.
17    (b) Each school must adopt a policy designating which
18school employees are authorized to enter into written
19agreements with operators. This subsection may not be construed
20to limit individual school employees outside of the scope of
21their employment from entering into agreements with operators
22on their own behalf and for non-K through 12 school purposes,
23provided that no covered information is provided to the
24operators. Any agreement or contract entered into in violation
25of this Act is void and unenforceable as against public policy.
26    (c) A school must post on its website each written



10100HB3606ham003- 13 -LRB101 09053 AXK 59528 a

1agreement entered into under this Act, along with any
2information required under subsection (a), no later than 5
3business days after entering into the agreement.
4    (d) After receipt of notice of a breach under Section 15 or
5determination of a breach of covered information maintained by
6the school, a school shall electronically notify, no later than
730 calendar days after receipt of the notice or determination
8that a breach has occurred, the parent of any student whose
9covered information is involved in the breach. The notification
10must include, but is not limited to, all of the following:
11        (1) The date, estimated date, or estimated date range
12    of the breach.
13        (2) A description of the covered information that was
14    compromised or reasonably believed to have been
15    compromised in the breach.
16        (3) Information that the parent may use to contact the
17    operator and school to inquire about the breach.
18        (4) The toll-free numbers, addresses, and websites for
19    consumer reporting agencies.
20        (5) The toll-free number, address, and website for the
21    Federal Trade Commission.
22        (6) A statement that the parent may obtain information
23    from the Federal Trade Commission and consumer reporting
24    agencies about fraud alerts and security freezes.
25    (e) Each school must implement and maintain security
26procedures and practices designed to protect covered



10100HB3606ham003- 14 -LRB101 09053 AXK 59528 a

1information from unauthorized access, destruction, use,
2modification, or disclosure that, based on the sensitivity of
3the covered information and the risk from unauthorized access,
4(i) use technologies and methodologies that are consistent with
5the U.S. Department of Commerce's National Institute of
6Standards and Technology's Framework for Improving Critical
7Infrastructure Cybersecurity Version 1.1 and any updates to it
8or (ii) maintain technical safeguards as they relate to the
9possession of student records in a manner consistent with the
10provisions of 45 CFR 164.312.
11    (f) Each school shall designate an appropriate staff person
12as a privacy officer, who may also be an official records
13custodian as designated under the Illinois School Student
14Records Act, to carry out the duties and responsibilities
15assigned to schools and to ensure compliance with the
16requirements of this Section and Section 26.
17    (g) A school shall make a request, pursuant to paragraph
18(2) of Section 15, to an operator to delete covered information
19on behalf of a student's parent if the parent requests from the
20school that the student's covered information held by the
21operator be deleted, so long as the deletion of the covered
22information is not in violation of the Illinois School Student
23Records Act.
24    (h) This Section does not apply to nonpublic schools.
25    (105 ILCS 85/28 new)



10100HB3606ham003- 15 -LRB101 09053 AXK 59528 a

1    Sec. 28. State Board duties.
2    (a) The State Board may not sell, rent, lease, or trade
3covered information.
4    (b) The State Board may not share, transfer, disclose, or
5provide covered information to an entity or individual without
6a contract or written agreement, except for disclosures
7required by federal law to federal agencies.
8    (c) At least twice annually, the State Board must publish
9and maintain on its website a list of all of the entities or
10individuals, including, but not limited to, operators,
11individual researchers, research organizations, institutions
12of higher education, or government agencies, that the State
13Board contracts with or has agreements with and that hold
14covered information and a copy of each contract or agreement.
15The list must include all of the following information:
16        (1) The name of the entity or individual. In naming an
17    individual, the list must include the entity that sponsors
18    the individual or with which the individual is affiliated,
19    if any. If the individual is conducting research at an
20    institution of higher education, the list may include the
21    name of that institution and a contact person in the
22    department that is associated with the research in lieu of
23    the name of the researcher. If the entity is an operator,
24    the list must include its business address.
25        (2) The purpose and scope of the contract or agreement.
26        (3) The duration of the contract or agreement.



10100HB3606ham003- 16 -LRB101 09053 AXK 59528 a

1        (4) The types of covered information that the entity or
2    individual holds under the contract or agreement.
3        (5) The use of the covered information under the
4    contract or agreement.
5        (6) The length of time for which the entity or
6    individual may hold the covered information.
7        (7) A list of any subcontractors to whom covered
8    information may be disclosed under Section 15.
9    (d) The State Board shall create, publish, and make
10publicly available an inventory, along with a dictionary or
11index of data elements and their definitions, of covered
12information collected or maintained by the State Board,
13including, but not limited to, both of the following:
14        (1) Covered information that schools are required to
15    report to the State Board by State or federal law.
16        (2) Covered information in the State longitudinal data
17    system or any data warehouse used by the State Board to
18    populate the longitudinal data system.
19    The inventory shall make clear for what purposes the State
20Board uses the covered information.
21    (e) The State Board shall develop, publish, and make
22publicly available, for the benefit of schools, model student
23data privacy policies and procedures that comply with relevant
24State and federal law, including, but not limited to, a model
25notice that schools must use to provide notice to parents and
26students about operators. The notice must state, in general



10100HB3606ham003- 17 -LRB101 09053 AXK 59528 a

1terms, the types of student data that are collected by the
2schools and shared with operators under this Act and the
3purposes of collecting and using the student data. After
4creation of the notice under this subsection, a school shall,
5at the beginning of each school year, provide the notice to
6parents by the same means generally used to send notices to
7them. This subsection does not apply to nonpublic schools.
8    (105 ILCS 85/33 new)
9    Sec. 33. Parent and student rights.
10    (a) A student's covered information is the sole property of
11the student's parent.
12    (b) A student's covered information shall be collected only
13for K through 12 school purposes and not further processed in a
14manner that is incompatible with those purposes.
15    (c) A student's covered information shall only be adequate,
16relevant, and limited to what is necessary in relation to the K
17through 12 school purposes for which it is processed.
18    (d) Except for a parent of a student enrolled in a
19nonpublic school, the parent of a student enrolled in a school
20has the right to all of the following:
21        (1) Inspect and review the student's covered
22    information, regardless of whether it is maintained by the
23    school, the State Board, or an operator.
24        (2) Request from a school a paper or electronic copy of
25    the student's covered information, including covered



10100HB3606ham003- 18 -LRB101 09053 AXK 59528 a

1    information maintained by an operator or the State Board.
2    If a parent requests an electronic copy of the student's
3    covered information under this paragraph, the school must
4    provide an electronic copy of that information, unless the
5    school does not maintain the information in an electronic
6    format and reproducing the information in an electronic
7    format would be unduly burdensome to the school. If a
8    parent requests a paper copy of the student's covered
9    information, the school may charge the parent the
10    reasonable cost for copying the information in an amount
11    not to exceed the amount fixed in a schedule adopted by the
12    State Board, except that no parent may be denied a copy of
13    the information due to the parent's inability to bear the
14    cost of the copying. The State Board must adopt rules on
15    the methodology and frequency of requests under this
16    paragraph.
17        (3) Request corrections of factual inaccuracies
18    contained in the student's covered information. After
19    receiving a request for corrections that documents a
20    factual inaccuracy, a school must do either of the
21    following:
22            (A) Confirm the correction with the parent within
23        90 calendar days after receiving the parent's request
24        if the school or State Board maintains the covered
25        information that contains the factual inaccuracy.
26            (B) Notify the operator who must confirm the



10100HB3606ham003- 19 -LRB101 09053 AXK 59528 a

1        correction with the parent within 90 calendar days
2        after receiving the parent's request if the covered
3        information that contains the factual inaccuracy is
4        maintained by an operator.
5    (e) Nothing in this Section shall be construed to limit the
6rights granted to parents and students under the Illinois
7School Student Records Act.
8    Section 99. Effective date. This Act takes effect July 1,