Bill Text: IL SB2018 | 2017-2018 | 100th General Assembly | Introduced

---

Bill Title: Creates the Student Data Privacy Act. On and after October 1, 2017, requires the school board of a school district to enter into a written contract with a contractor any time the school board shares or provides access to student information, student records, or student-generated content with that contractor. Among other provisions, sets forth provisions concerning contract requirements, contractor and operator requirements and prohibitions, security breach procedures, and the establishment of a task force to study issues relating to student data privacy. Effective immediately.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Failed) 2019-01-09 - Session Sine Die [SB2018 Detail]

Download: Illinois-2017-SB2018-Introduced.html

---

100TH GENERAL ASSEMBLY State of Illinois 2017 and 2018 SB2018 Introduced 2/10/2017, by Sen. Thomas Cullerton SYNOPSIS AS INTRODUCED:
New Act
Creates the Student Data Privacy Act. On and after October 1, 2017, requires the school board of a school district to enter into a written contract with a contractor any time the school board shares or provides access to student information, student records, or student-generated content with that contractor. Among other provisions, sets forth provisions concerning contract requirements, contractor and operator requirements and prohibitions, security breach procedures, and the establishment of a task force to study issues relating to student data privacy. Effective immediately.
LRB100 09670 NHT 19839 b
FISCAL NOTE ACT MAY APPLY STATE MANDATES ACT MAY REQUIRE REIMBURSEMENT
A BILL FOR
SB2018 LRB100 09670 NHT 19839 b
AN ACT concerning education.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 1. Short title. This Act may be cited as the
Student Data Privacy Act.
Section 5. Definitions. In this Act:
"Contractor" means an operator or consultant that is in
possession of or has access to student information, student
records, or student-generated content as a result of a contract
with a school board.
"Consultant" means a professional who provides
noninstructional services, including, but not limited to,
administrative, planning, analysis, statistical or research
services, to a school board pursuant to a contract with the
school board.
"De-identified student information" means any student
information that has been altered to prevent the identification
of an individual student.
"Directory information" has the same meaning as provided in
34 CFR 99.3.
"Operator" means any person who (i) operates an Internet
web site, online service, or mobile application with actual
knowledge that the Internet web site, online service, or mobile

SB2018 - 2 - LRB100 09670 NHT 19839 b
application is used for school purposes and was designed and
marketed for school purposes, to the extent it is engaged in
the operation of that Internet web site, online service, or
mobile application, and (ii) collects, maintains, or uses
student information.
"Persistent unique identifier" means a unique piece of
information that can be used to recognize a user over time and
across different Internet web sites, online services, or mobile
applications and is acquired as a result of a student's use of
an operator's Internet web site, online service, or mobile
application.
"School purposes" means purposes that customarily take
place at the direction of a teacher or a school board or aid in
the administration of school activities, including, but not
limited to, instruction in the classroom, administrative
activities, and collaboration among students, school
personnel, or parents or legal guardians of students.
"Student" means a person who is a resident of this State
and who is (i) enrolled in a school district's preschool
program, (ii) enrolled in any of grades kindergarten through 12
in a public school, (iii) receiving special education and
related services under an individualized education program, or
(iv) otherwise the responsibility of a school district.
"Student-generated content" means any student materials
created by a student, including, but not limited to, essays,
research papers, portfolios, creative writing, music or other

SB2018 - 3 - LRB100 09670 NHT 19839 b
audio files, or photographs, except "student-generated
content" does not include student responses to a standardized
assessment.
"Student information" means personally identifiable
information or material of a student in any media or format
that is not publicly available and is any of the following: (i)
created or provided by a student or the parent or legal
guardian of a student to the operator in the course of the
student, parent, or legal guardian using the operator's
Internet web site, online service, or mobile application for
school purposes, (ii) created or provided by an employee or
agent of a school board to an operator for school purposes, or
(iii) gathered by an operator through the operation of the
operator's Internet web site, online service, or mobile
application and identifies a student, including, but not
limited to, information in the student's records or electronic
mail account, first or last name, home address, telephone
number, date of birth, electronic mail address, discipline
records, test results, grades, evaluations, criminal records,
medical records, health records, Social Security number,
biometric information, disabilities, socioeconomic
information, food purchases, political affiliations, religious
affiliations, text messages, documents, student identifiers,
search activity, photographs, voice recordings, survey
responses, or behavioral assessments.
"Student record" means any information directly related to

SB2018 - 4 - LRB100 09670 NHT 19839 b
a student that is maintained by a school board or the State
Board of Education or any information acquired from a student
through the use of educational software assigned to the student
by a teacher or employee of a school board, except "student
record" does not include de-identified student information
allowed under a contract to be used by the contractor to (i)
improve educational products for adaptive learning purposes
and customize student learning, (ii) demonstrate the
effectiveness of the contractor's products in the marketing of
those products, and (iii) develop and improve the contractor's
products and services.
"Targeted advertising" means presenting an advertisement
to a student where the selection of the advertisement is based
on student information, student records, or student-generated
content or inferred over time from the usage of the operator's
Internet web site, online service, or mobile application by a
student or the retention of a student's online activities or
requests over time for the purpose of targeting subsequent
advertisements. "Targeted advertising" does not include any
advertising to a student on an Internet web site that the
student is accessing at the time or in response to a student's
response or request for information or feedback.
Section 10. Contract required.
(a) This Section applies beginning on October 1, 2017 and
is applicable to contracts entered into, amended, or renewed on

SB2018 - 5 - LRB100 09670 NHT 19839 b
or after October 1, 2017. On and after October 1, 2017, the
school board of a school district shall enter into a written
contract with a contractor any time the school board shares or
provides access to student information, student records, or
student-generated content with the contractor. Each contract
shall include, but need not be limited to, the following:
(1) a statement that student information, student
records, and student-generated content are not the
property of or under the control of a contractor;
(2) a description of the means by which the school
board may request the deletion of student information,
student records, or student-generated content in the
possession of the contractor;
(3) a statement that the contractor shall not use
student information, student records, and
student-generated content for any purposes other than
those authorized pursuant to the contract;
(4) a description of the procedures by which a student
or parent or legal guardian of a student may review
personally identifiable information contained in student
information, student records, or student-generated content
and correct erroneous information, if any, in the student
record;
(5) a statement that the contractor shall take actions
designed to ensure the security and confidentiality of
student information, student records, and

SB2018 - 6 - LRB100 09670 NHT 19839 b
student-generated content;
(6) a description of the procedures that a contractor
will follow to notify the school board, in accordance with
the provisions of Section 20 of this Act, when there has
been an unauthorized release, disclosure, or acquisition
of student information, student records, or
student-generated content;
(7) a statement that student information, student
records, or student-generated content shall not be
retained or available to the contractor upon completion of
the contracted services unless a student or parent or legal
guardian of a student chooses to establish or maintain an
electronic account with the contractor for the purpose of
storing student-generated content;
(8) a statement that the contractor and the school
board shall ensure compliance with the federal Family
Educational Rights and Privacy Act of 1974;
(9) a statement that the laws of this State shall
govern the rights and duties of the contractor and the
school board; and
(10) a statement that if any provision of the contract
or the application of the contract is held invalid by a
court of competent jurisdiction, the invalidity does not
affect other provisions or applications of the contract
that can be given effect without the invalid provision or
application.

SB2018 - 7 - LRB100 09670 NHT 19839 b
(b) All student-generated content shall be the property of
the student or the parent or legal guardian of the student.
(c) A contractor shall implement and maintain security
procedures and practices designed to protect student
information, student records, and student-generated content
from unauthorized access, destruction, use, modification, or
disclosure that, based on the sensitivity of the data and the
risk from unauthorized access:
(1) use technologies and methodologies that are
consistent with the guidance issued pursuant to Section
13402(h)(2) of Public Law 111-5, as amended from time to
time;
(2) maintain technical safeguards as it relates to the
possession of student records in a manner consistent with
the provisions of 45 CFR 164.312; and
(3) otherwise meet or exceed industry standards.
(d) A contractor shall not use (i) student information,
student records, or student-generated content for any purposes
other than those authorized pursuant to the contract or (ii)
personally identifiable information contained in student
information, student records, or student-generated content to
engage in targeted advertising.
(e) Any provision of a contract entered into between a
contractor and a school board on or after October 1, 2017 that
conflicts with any provision of this Section shall be void.
(f) Any contract entered into on or after October 1, 2017

SB2018 - 8 - LRB100 09670 NHT 19839 b
that does not include a provision required by subsection (a) of
this Section shall be void, provided that the school board has
given reasonable notice to the contractor and the contractor
has failed within a reasonable time to amend the contract to
include the provision required by subsection (a) of this
Section.
(g) Not later than 5 business days after executing a
contract pursuant to this Section, a school board shall provide
electronic notice to any student and the parent or legal
guardian of a student affected by the contract. The notice
shall (i) state that the contract has been executed and the
date that the contract was executed, (ii) provide a brief
description of the contract and the purpose of the contract,
and (iii) state what student information, student records, or
student-generated content may be collected as a result of the
contract. The school board shall post the notice and the
contract on the school district's Internet web site.
Section 15. Operators.
(a) This Section applies beginning October 1, 2017. An
operator shall:
(1) implement and maintain security procedures and
practices that meet or exceed industry standards and that
are designed to protect student information, student
records, and student-generated content from unauthorized
access, destruction, use, modification, or disclosure; and

SB2018 - 9 - LRB100 09670 NHT 19839 b
(2) delete any student information, student records,
or student-generated content within a reasonable amount of
time if a student, parent or legal guardian of a student,
or school board that has the right to control the student
information requests the deletion of the student
information, student records, or student-generated
content.
(b) An operator shall not knowingly:
(1) engage in (i) targeted advertising on the
operator's Internet web site, online service, or mobile
application or (ii) targeted advertising on any other
Internet web site, online service, or mobile application if
the advertising is based on any student information,
student records, student-generated content, or persistent
unique identifiers that the operator has acquired because
of the use of the operator's Internet web site, online
service, or mobile application for school purposes;
(2) collect, store, and use student information,
student records, student-generated content, or persistent
unique identifiers for purposes other than the furtherance
of school purposes;
(3) sell, rent, or trade student information, student
records, or student-generated content unless the sale is
part of the purchase, merger, or acquisition of an operator
by a successor operator and the operator and successor
operator continue to be subject to the provisions of this

SB2018 - 10 - LRB100 09670 NHT 19839 b
Section regarding student information; or
(4) disclose student information, student records, or
student-generated content unless the disclosure is made:
(A) in furtherance of school purposes of the
Internet web site, online service, or mobile
application, provided that the recipient of the
student information uses the student information to
improve the operability and functionality of the
Internet web site, online service, or mobile
application and complies with subsection (a) of this
Section;
(B) to ensure compliance with federal or State law
or rules or pursuant to a court order;
(C) in response to a judicial order;
(D) to protect the safety or integrity of users or
others or the security of the Internet web site, online
service, or mobile application;
(E) to an entity hired by the operator to provide
services for the operator's Internet web site, online
service, or mobile application, provided that the
operator contractually (i) prohibits the entity from
using student information, student records, or
student-generated content for any purpose other than
providing the contracted service to or on behalf of the
operator, (ii) prohibits the entity from disclosing
student information, student records, or

SB2018 - 11 - LRB100 09670 NHT 19839 b
student-generated content provided by the operator to
subsequent third parties, and (iii) requires the
entity to comply with subsection (a) of this Section;
or
(F) for a school purpose or other educational or
employment purpose requested by a student or the parent
or legal guardian of a student, provided that the
student information is not used or disclosed for any
other purpose.
(c) An operator may use student information:
(1) to maintain, support, improve, evaluate, or
diagnose the operator's Internet web site, online service,
or mobile application;
(2) for adaptive learning purposes or customized
student learning;
(3) to provide recommendation engines to recommend
content or services relating to school purposes or other
educational or employment purposes, provided that the
recommendation is not determined in whole or in part by
payment or other consideration from a third party; or
(4) to respond to a request for information or feedback
from a student, provided that the response is not
determined in whole or in part by payment or other
consideration from a third party.
(d) An operator may use de-identified student information
or aggregated student information:

SB2018 - 12 - LRB100 09670 NHT 19839 b
(1) to develop or improve the operator's Internet web
site, online service, or mobile application or other
Internet web sites, online services, or mobile
applications owned by the operator; or
(2) to demonstrate or market the effectiveness of the
operator's Internet web site, online service, or mobile
application.
(e) An operator may share aggregated student information or
de-identified student information for the improvement and
development of Internet web sites, online services, or mobile
applications designed for school purposes.
(f) Nothing in this Section shall be construed to:
(1) limit the ability of a law enforcement agency to
obtain student information, student records, or
student-generated content from an operator as authorized
by law or pursuant to a court order;
(2) limit the ability of a student or the parent or
legal guardian of a student to download, export, transfer,
or otherwise save or maintain student information, student
records, or student-generated content;
(3) impose a duty upon a provider of an interactive
computer service, as defined in 47 U.S.C. 230, to ensure
compliance with this Section by third-party information
content providers, as defined in 47 U.S.C. 230;
(4) impose a duty upon a seller or provider of an
electronic store, gateway, marketplace, or other means of

SB2018 - 13 - LRB100 09670 NHT 19839 b
purchasing or downloading software applications to review
or enforce compliance with this Section on the software
applications;
(5) limit an Internet service provider from providing a
student, parent or legal guardian of a student, or school
board with the ability to connect to the Internet;
(6) prohibit an operator from advertising other
Internet web sites, online services, or mobile
applications that are used for school purposes to parents
or legal guardians of students, provided that the
advertising does not result from the operator's use of
student information, student records, or student-generated
content; or
(7) apply to Internet web sites, online services, or
mobile applications that are designed and marketed for use
by individuals generally, even if the account credentials
created for an operator's Internet web site, online
service, or mobile application may be used to access
Internet web sites, online services, or mobile
applications that are designed and marketed for school
purposes.
Section 20. Security breach.
(a) This Section applies beginning October 1, 2017.
(1) Upon the discovery of a breach of security that
results in the unauthorized release, disclosure, or

SB2018 - 14 - LRB100 09670 NHT 19839 b
acquisition of student information, excluding any
directory information contained in the student
information, a contractor shall notify, without
unreasonable delay, but not more than 30 days after the
discovery, the school board of the breach of security.
During the 30-day period, the contractor may:
(A) conduct an investigation to determine the
nature and scope of the unauthorized release,
disclosure, or acquisition and the identity of the
students whose student information is involved in the
unauthorized release, disclosure, or acquisition; or
(B) restore the reasonable integrity of the
contractor's data system.
(2) Upon the discovery of a breach of security that
results in the unauthorized release, disclosure, or
acquisition of directory information, student records, or
student-generated content, a contractor shall notify,
without unreasonable delay, but not more than 60 days after
the discovery, the school board of the breach of security.
During the 60-day period, the contractor may:
(A) conduct an investigation to determine the
nature and scope of the unauthorized release,
disclosure, or acquisition and the identity of the
students whose directory information, student records,
or student-generated content is involved in the
unauthorized release, disclosure, or acquisition; or

SB2018 - 15 - LRB100 09670 NHT 19839 b
(B) restore the reasonable integrity of the
contractor's data system.
(3) Upon receipt of notice of a breach of security
under subdivisions (1) or (2) of this subsection (a), a
school board shall electronically notify, not later than 48
hours after receipt of the notice, the student and the
parents or legal guardians of the student whose student
information, student records, or student-generated content
is involved in the breach of security. The school board
shall post the notice on the school district's Internet web
site.
(b) Upon the discovery of a breach of security that results
in the unauthorized release, disclosure, or acquisition of
student information, student records, or student-generated
content, an operator that is in possession of or maintains
student information, student records, or student-generated
content as a result of a student's use of the operator's
Internet web site, online service, or mobile application shall:
(1) notify, without unreasonable delay, but not more
than 30 days after the discovery, the student or the
parents or legal guardians of the student of any breach of
security that results in the unauthorized release,
disclosure, or acquisition of student information,
excluding any directory information contained in the
student information; and
(2) notify, without unreasonable delay, but not more

SB2018 - 16 - LRB100 09670 NHT 19839 b
than 60 days after the discovery, the student or the
parents or legal guardians of the student of any breach of
security that results in the unauthorized release,
disclosure, or acquisition of directory information,
student records, or student-generated content of the
student.
During the 30-day or 60-day period, the operator may (i)
conduct an investigation to determine the nature and scope of
the unauthorized release, disclosure, or acquisition and the
identity of the students whose student information, student
records, or student-generated content are involved in the
unauthorized release, disclosure, or acquisition or (ii)
restore the reasonable integrity of the operator's data system.
Section 25. Task force.
(a) There is established a task force to study issues
relating to student data privacy. The study shall include, but
not be limited to, an examination of:
(1) when a parent or legal guardian of a student may
reasonably or appropriately request the deletion of
student information, student records, or student-generated
content that is in the possession of a contractor or
operator;
(2) means of providing notice to parents and legal
guardians of students when a student uses an Internet web
site, online service, or mobile application of an operator

SB2018 - 17 - LRB100 09670 NHT 19839 b
for instructional purposes in a classroom or as part of an
assignment by a teacher;
(3) reasonable penalties for violations of this Act,
such as restricting a contractor or operator from accessing
or collecting student information, student records, or
student-generated content;
(4) strategies in effect in other states that ensure
that school employees, contractors, and operators are
trained in data security handling, compliance, and best
practices;
(5) the feasibility of developing a school
district-wide list of approved Internet web sites, online
services, and mobile applications;
(6) the use of an administrative hearing process
designed to provide legal recourse to students and parents
and legal guardians of students aggrieved by any violation
of this Act;
(7) the feasibility of creating an inventory of student
information, student records, and student-generated
content currently collected pursuant to State and federal
law;
(8) the feasibility of developing a tool kit for use by
school boards to:
(A) improve student data contracting practices and
compliance, including a statewide template for use by
districts;

SB2018 - 18 - LRB100 09670 NHT 19839 b
(B) increase school employee awareness of student
data security best practices, including model training
components;
(C) develop district-wide lists of approved
software applications and Internet web sites; and
(D) increase the availability and accessibility of
information on student data privacy for parents and
legal guardians of students and educators; and
(9) any other issue involving student data security
that the task force deems relevant.
(b) The task force shall consist of all of the following
members, who shall serve without compensation but may be
reimbursed for their reasonable and necessary expenses from
funds appropriated for that purpose:
(1) Members appointed by the State Superintendent of
Education as follows:
(A) One operator, one representative of a
contractor, and 2 experts in information technology
systems.
(B) One representative or member of a statewide
professional teachers' organization and one
representative or member of a different statewide
professional teachers' organization.
(C) One representative or member of a statewide
parent teacher association and one high school student
in this State.

SB2018 - 19 - LRB100 09670 NHT 19839 b
(D) One student privacy advocate.
(E) One representative or member of a statewide
association of school boards.
(F) One representative of a statewide association
of school administrators and one representative or
member of a statewide association of school district
superintendents.
(2) The Attorney General or the Attorney General's
designee.
(3) The State Superintendent of Education, who shall
serve as chairperson.
(c) All appointments to the task force shall be made not
later than 30 days after the effective date of this Act. Any
vacancy shall be filled by the appointing authority.
(d) The chairperson shall schedule the first meeting of the
task force, which shall be held not later than 60 days after
the effective date of this Act.
(e) The State Board of Education shall provide
administrative and other support to the task force.
(f) Not later than January 1, 2018, the task force shall
submit a report on its findings and recommendations to the
General Assembly. The task force shall terminate on the date
that it submits its report or January 1, 2018, whichever is
later.
(g) This Section is repealed on January 1, 2019.
Section 99. Effective date. This Act takes effect upon

SB2018 - 20 - LRB100 09670 NHT 19839 b
becoming law.