Bill Text: IL HB0810 | 2015-2016 | 99th General Assembly | Engrossed

---

Bill Title: Amends the School Code. Makes a technical change in a Section concerning the State Board of Education.

Spectrum: Moderate Partisan Bill (Democrat 9-2)

Status: (Engrossed - Dead) 2016-07-31 - Senate Committee Amendment No. 2 Pursuant to Senate Rule 3-9(b) / Referred to Assignments [HB0810 Detail]

Download: Illinois-2015-HB0810-Engrossed.html

---

HB0810 Engrossed LRB099 04620 NHT 24649 b
AN ACT concerning education.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The School Code is amended by adding Sections
22-80 and 22-81 as follows:
(105 ILCS 5/22-80 new)
Sec. 22-80. Student data privacy.
(a) It is the intent of the General Assembly to help ensure
that information generated by and about students in the course
of, and in connection with, their education is safeguarded and
that student privacy is honored, respected and protected. The
General Assembly finds the following:
(1) Information generated by and about students in the
course of, and in connection with, their education is a
vital resource for teachers and school staff in planning
education programs and services, scheduling students into
appropriate classes and completing reports for educational
agencies.
(2) Information generated by and about students in the
course of, and in connection with, their education is
critical to educators in helping students successfully
graduate from high school and being ready to enter the
workforce or postsecondary education.

HB0810 Engrossed - 2 - LRB099 04620 NHT 24649 b
(3) While information generated by and about students
in the course of, and in connection with, their education
is important for educational purposes, it is also
critically important to ensure that the information is
protected, safeguarded and kept private and used only by
appropriate educational authorities or their permitted
designees and then, only to serve the best interests of the
student.
To that end, this Section will help ensure that information
generated by and about students in the course of, and in
connection with, their education is protected and expectations
of privacy are honored.
(b) In this Section:
"Biometric record" shall have the meaning set forth in the
Illinois School Student Records Act.
"Eligible student" shall have the meaning set forth in the
Illinois School Student Records Act.
"Parent" shall have the meaning set forth in the Illinois
School Student Records Act.
"Personally identifiable information" shall have the
meaning set forth in the Illinois School Student Records Act.
"Record" shall have the meaning set forth in the Illinois
School Student Records Act.
"School" shall have the meaning set forth in the Illinois
School Student Records Act.
"School board" shall have the meaning set forth in the

HB0810 Engrossed - 3 - LRB099 04620 NHT 24649 b
Illinois School Student Records Act.
"School student record" shall have the meaning set forth in
the Illinois School Student Records Act.
"State Board" shall have the meaning set forth in the
Illinois School Student Records Act.
"Student" shall have the meaning set forth in the Illinois
School Student Records Act.
"Student data" means school student records, student
permanent records, student temporary records, or any other
records, personally identifiable information, or intellectual
property of a student.
"Student permanent record" shall have the meaning set forth
in the Illinois School Student Records Act.
"Student temporary record" shall have the meaning set forth
in the Illinois School Student Records Act.
"Targeted advertising" means any form of advertising aimed
directly at a specific individual or group of individuals based
on a known or assumed trait or traits, including, but not
limited to, age, gender, race, grade level, address, observed
behavior, or academic achievement.
"Vendor" means any entity and its officers, employees,
agents, independent contractors, and subcontractors that
provides or offers to provide a product or service to a school
board, which product or service is marketed or designed for
school purposes or which the entity knows or reasonably should
know will be used for school purposes.

HB0810 Engrossed - 4 - LRB099 04620 NHT 24649 b
(c) Any vendor who receives any student data from a school
board or the State Board in any manner is prohibited from:
(1) advertising or marketing, including targeted
advertising, based on:
(A) any information, including personally
identifiable information, contained in the school
student records, student permanent records, student
temporary records, or any other records of a student;
(B) any information generated by or about students
in connection with their use of the vendor's product or
service; or
(C) any records created by the vendor as a result
of students' use of the vendor's product or service;
(2) creating, generating, or otherwise amassing a
profile about any student for any purpose other than to
provide the school board with information about student
academic growth or achievement;
(3) selling or otherwise disclosing the following to
anyone other than the school board, unless such sale or
disclosure is required by court order or to comply with the
Illinois School Student Records Act or the federal Family
Educational Rights and Privacy Act (20 U.S.C. 1232g) or is
expressly authorized by this Section:
(A) any information, including personally
identifiable information, contained in the school
student records, student permanent records, student

HB0810 Engrossed - 5 - LRB099 04620 NHT 24649 b
temporary records, or any other records of a student;
(B) any information generated by or about students
in connection with their use of the vendor's product or
service;
(C) any records created by the vendor as a result
of students' use of the vendor's product or service; or
(D) any student's intellectual property;
(4) exercising or claiming any rights, implied or
otherwise, to:
(A) any information, including personally
identifiable information, contained in the school
student records, student permanent records, student
temporary records, or any other records of a student;
(B) any information generated by or about students
in connection with their use of the vendor's product or
service;
(C) any records created by the vendor as a result
of students' use of the vendor's product or service; or
(D) any student's intellectual property;
(5) storing or processing outside the United States:
(A) any information, including personally
identifiable information, contained in the school
student records, student permanent records, student
temporary records or any other records of a student;
(B) any information generated by or about students
in connection with their use of the vendor's product or

HB0810 Engrossed - 6 - LRB099 04620 NHT 24649 b
service;
(C) any records created by the vendor as a result
of students' use of the vendor's product or service; or
(D) any student's intellectual property;
(6) transferring the following to any third party
(including subcontractors), affiliate, or government
agency other than the State Board, unless required by court
order or expressly authorized by the school board in
compliance with this Section:
(A) any information, including personally
identifiable information, contained in the school
student records, student permanent records, student
temporary records, or any other records of a student;
(B) any information generated by or about students
in connection with their use of the vendor's product or
service;
(C) any records created by the vendor as a result
of students' use of the vendor's product or service; or
(D) any student's intellectual property;
(7) permitting access by anyone to the following,
unless such access is required for the vendor to provide
its product or service to the school board:
(A) any information, including personally
identifiable information, contained in the school
student records, student permanent records, student
temporary records or any other records of a student;

HB0810 Engrossed - 7 - LRB099 04620 NHT 24649 b
(B) any information generated by or about students
in connection with their use of the vendor's product or
service;
(C) any records created by the vendor as a result
of students' use of the vendor's product or service; or
(D) any student's intellectual property;
(8) requiring a school board or its employees, agents,
volunteers, or students to indemnify a vendor or pay the
vendor's attorneys' fees or costs in connection with any
dispute arising out of, or otherwise connected to, student
data;
(9) requiring a school board or its employees, agents,
volunteers, or students to arbitrate any dispute arising
out of, or otherwise connected to, student data;
(10) entering into any contract or other agreement with
a school board that authorizes in any manner activities
prohibited by this Section; and
(11) modifying or otherwise altering the terms and
conditions of any contract or other agreement with a school
board related to student data without the express consent
of the school board.
(d) Any vendor who receives any student data from a school
board or the State Board in any manner shall:
(1) store and process such records and information in
accordance with commercial best practices, which shall
include, but not be limited to, data-security practices set

HB0810 Engrossed - 8 - LRB099 04620 NHT 24649 b
forth by the United States Department of Education Privacy
Technical Assistance Center and any rules adopted by the
State Board;
(2) implement and maintain appropriate administrative,
physical, and technical safeguards, to secure such records
and information from unauthorized access, destruction,
use, modification, or disclosure, which safeguards shall
be consistent with any rules adopted by the State Board and
any guidance provided by the United States Department of
Education Privacy and Technical Assistance Center;
(3) immediately notify the school board of any security
breach resulting in unauthorized access to any student
data, regardless of whether it is the school board's
student data;
(4) delete the personally identifiable information of
a specific student:
(A) at the request of the student's school or
school board; or
(B) at the request of an eligible student or a
parent, provided the school board consents to the
request;
(5) designate an officer or employee as a responsible
person who shall be trained in a manner so as to ensure
compliance with this Section and ensure the security and
confidentiality of student data;
(6) within 30 days of the completion or termination of

HB0810 Engrossed - 9 - LRB099 04620 NHT 24649 b
the terms of any contract with a school board related to
student data, delete or return to the school board all
student data and information and records generated
therefrom and, in the event of deletion, provide a written
certification that such deletion has occurred. In the event
the vendor chooses to delete the data, records, and
information described in this subdivision (6), it shall
provide the school board with a written certification that
the data, records, and information have been deleted, which
certification shall be provided to the school board within
30 days of the termination of the contract;
(7) permit eligible students and parents to access and
correct any information contained in the school student
records, student permanent records, student temporary
records, or any other records provided to the vendor by the
school board;
(8) permit a school board to audit and inspect the
vendor's practices with respect to any student data
received by the vendor from the school board or any
information or records generated therefrom;
(9) permit the school board access to any student data
provided by the school board and any information and
records generated therefrom in order for the school board
to respond to a request under the Freedom of Information
Act or pursuant to a court order;
(10) be permitted to diagnose and correct problems with

HB0810 Engrossed - 10 - LRB099 04620 NHT 24649 b
the vendor's product or service, provided that to diagnose
or correct a problem does not require the vendor to engage
in any activities prohibited by this Section; and
(11) agree that any dispute arising out of, or
otherwise connected to, student data shall be litigated
using Illinois law and that the proper venue is the circuit
court of the county in which the school board is located.
(e) Any vendor who seeks to receive from a school board or
the State Board in any manner any student data is required to
enter into a written contract with the school board before any
records can be transferred, which contract shall contain the
following:
(1) provisions consistent with each requirement set
forth in subsections (c) and (d) of this Section;
(2) a listing of the precise student data to be
provided to the vendor;
(3) a statement of the product or service being
provided to the school board by the vendor;
(4) a statement that the vendor is a school official
with a legitimate educational interest, performing an
institutional service or function for which the school
board would otherwise use employees, under the direct
control of the school board with respect to the use and
maintenance of student data, and is using such student data
only for an authorized purpose and will not re-disclose it
to third parties or affiliates without permission from the

HB0810 Engrossed - 11 - LRB099 04620 NHT 24649 b
school board or pursuant to court order;
(5) a statement that the student data continues to be
the property of and under the control of the school board,
and the vendor has a limited, nonexclusive license solely
for the purpose of performing its obligations under the
contract;
(6) a description of the actions the vendor will take
to ensure the security and confidentiality of student data;
compliance with this requirement shall not, in itself,
absolve the vendor of liability in the event of an
unauthorized disclosure of student data; and
(7) a statement that the contract is the entire
agreement between the school board (including school board
employees and other end users) and the vendor.
(f) Each school board shall adopt a policy regarding which
school employees have the power to bind the school board to the
terms of any agreements, whether electronic, click-through,
click-wrap, verbal, or in writing. If a vendor enters into an
agreement with an employee or other end users who are not
authorized through the school board's policy to enter into such
an agreement, then the agreement shall be voidable by the
school board.
(g) Each school board entering into a contract or agreement
as allowed by this Section shall maintain an original copy of
its term and conditions at the school board's primary place of
business, including a copy of the terms and conditions set

HB0810 Engrossed - 12 - LRB099 04620 NHT 24649 b
forth in any agreement described in subsection (f) of this
Section.
(h) The State Board shall create, publish, and make
publicly available all data elements collected by the State
Board that contain personally identifiable information.
(i) In the event of a security breach resulting, in whole
or in part, from the vendor's conduct, in addition to any other
remedies available to the school board under law or equity, the
vendor shall reimburse the school board in full for all costs
and expenses incurred by the school board in investigating and
remediating the breach, including, but not limited to:
(1) providing notification to those students and their
parents, in the event the student is under the age of 18,
whose personally identifiable information was compromised
and to regulatory agencies or other entities as required by
law or contract;
(2) providing one year's credit monitoring to those
students and eligible students whose student data was
exposed in such a manner during the breach that a
reasonable person would have cause to believe that it could
impact his or her credit or financial security; and
(3) payment of legal fees, audit costs, fines, and
other fees or damages imposed against the school board as a
result of the security breach.
(j) The State Board shall develop, publish, and make
publicly available model student data privacy policies and

HB0810 Engrossed - 13 - LRB099 04620 NHT 24649 b
procedures that comply with relevant state and federal law.
(k) Within 180 days after the effective date of this
amendatory Act of the 99th General Assembly, the State Board
shall create a model notice that school boards may use to
provide notice to parents that states, in general terms, what
types of student data are collected by the school board and
shared with vendors under this Section and the purposes of
collecting and using the student data. Upon the creation of the
notice described in this subsection (k), a school board shall,
at the beginning of each school year, provide such notice in
writing or electronically to parents and eligible students.
(l) In addition to any other penalties, any contract
governed by this Section that fails to comply with the
requirements of this Section shall be rendered void if, upon
notice and a reasonable opportunity to cure, the noncompliant
party fails to cure any defect. Written notice of noncompliance
may be provided by either party to the contract. Any vendor
subject to a contract voided under this subdivision is
required, within 60 days, to return all student data and any
information or records generated therefrom in its possession to
the school board. Any vendor that fails to cure any defect in
the contract shall not be entitled to any payment required
under the contract and shall return to the school board all
payments previously made by the school board.
(105 ILCS 5/22-81 new)

HB0810 Engrossed - 14 - LRB099 04620 NHT 24649 b
Sec. 22-81. Educator data privacy.
(a) It is the intent of the General Assembly to help ensure
that information generated by and about educators in the course
of, and in connection with, the performance of their duties is
safeguarded and that educator privacy is honored, respected and
protected. The General Assembly finds the following:
(1) Information generated by and about educators in the
course of, and in connection with, the performance of their
duties is a vital resource for school boards, the State
Board and research organizations in planning education
programs and services, completing reports for educational
agencies, and improving the performance of schools.
(2) Information generated by and about educators in the
course of, and in connection with, the performance of their
duties is critical to the performance and improvement of
schools.
(3) While information generated by and about educators
in the course of, and in connection with, the performance
of their duties is important for educational purposes, it
is also critically important to ensure that the information
is protected, safeguarded and kept private and used only by
appropriate educational authorities or their permitted
designees.
To that end, this Section will help ensure that information
generated by and about educators in the course of, and in
connection with, the performance of their duties is protected

HB0810 Engrossed - 15 - LRB099 04620 NHT 24649 b
and expectations of privacy are honored.
(b) In this Section:
"Biometric record" shall have the meaning set forth in the
Illinois School Student Records Act.
"Educator" means any person employed by or otherwise
working for a school board to provide educational services
within a school.
"Educator data" means educator records or any other records
containing personally identifiable information of an educator.
"Educator record" means any writing or other recorded
information concerning an educator by which an educator may be
individually or personally identified maintained by a school or
at its direction or by an employee of a school, regardless of
how or where the information is stored.
"Personally identifiable information" means:
(1) the educator's name;
(2) the names of the educator's immediate family
members;
(3) the address of the educator or educator's immediate
family members;
(4) a personal identifier, such as the educator's
social security number, student number, or biometric
record;
(5) other indirect identifiers, such as the educator's
date of birth, place of birth, and mother's maiden name;
(6) other information that, alone or in combination, is

HB0810 Engrossed - 16 - LRB099 04620 NHT 24649 b
linked or linkable to a specific educator that would allow
a reasonable person in the school community, who does not
have personal knowledge of the relevant circumstances, to
identify the educator with reasonable certainty; or
(7) information requested by a person who the
educational agency or institution reasonably believes
knows the identity of the educator to whom the record
relates.
"Record" means any information recorded or generated in any
way, including, but not limited to, electronically-generated
data, handwriting, print, computer media, video or audio tape,
film, microfilm, and microfiche.
"School" shall have the meaning set forth in the Illinois
School Student Records Act.
"School board" shall have the meaning set forth in the
Illinois School Student Records Act.
"State Board" shall have the meaning set forth in the
Illinois School Student Records Act.
"Targeted advertising" means any form of advertising aimed
directly at a specific individual or group of individuals based
on a known or assumed trait, or traits, including, but not
limited to, age, gender, race, address, observed behavior, or
classroom performance.
"Vendor" means any entity and its officers, employees,
agents, independent contractors, and subcontractors that
provides or offers to provide a product or service to a school

HB0810 Engrossed - 17 - LRB099 04620 NHT 24649 b
board, which product or service is marketed or designed for
school purposes or which the entity knows or reasonably should
know will be used for school purposes.
(c) Any vendor who receives any educator data from a school
board or the State Board in any manner is prohibited from:
(1) advertising or marketing, including targeted
advertising, based on:
(A) any information, including personally
identifiable information, contained in the educator
records;
(B) any information generated by or about
educators in connection with their use of the vendor's
product or service; or
(C) any records created by the vendor as a result
of educators' use of the vendor's product or service;
(2) creating, generating, or otherwise amassing a
profile about any educator for any purpose other than to
provide the school board with information about educator
performance or achievement;
(3) selling or otherwise disclosing the following to
anyone other than the school board, unless such sale or
disclosure is required by court order or is expressly
authorized by this Section:
(A) any information, including personally
identifiable information, contained in the educator
records;

HB0810 Engrossed - 18 - LRB099 04620 NHT 24649 b
(B) any information generated by or about
educators in connection with their use of the vendor's
product or service; or
(C) any records created by the vendor as a result
of educators' use of the vendor's product or service;
(4) exercising or claiming any rights, implied or
otherwise, to:
(A) any information, including personally
identifiable information, contained in the educator
records;
(B) any information generated by or about
educators in connection with their use of the vendor's
product or service; or
(C) any records created by the vendor as a result
of educators' use of the vendor's product or service;
(5) storing or processing outside the United States:
(A) any information, including personally
identifiable information, contained in the educator
records;
(B) any information generated by or about
educators in connection with their use of the vendor's
product or service; or
(C) any records created by the vendor as a result
of educators' use of the vendor's product or service;
(6) transferring the following to any third-party
(including subcontractors), affiliate, or government

HB0810 Engrossed - 19 - LRB099 04620 NHT 24649 b
agency other than the State Board, unless required by court
order or expressly authorized by the school board in
compliance with this Section:
(A) any information, including personally
identifiable information, contained in the educator
records;
(B) any information generated by or about
educators in connection with their use of the vendor's
product or service; or
(C) any records created by the vendor as a result
of educators' use of the vendor's product or service;
(7) permitting access by anyone to the following,
unless such access is required for the vendor to provide
its product or service to the school board:
(A) any information, including personally
identifiable information, contained in the educator
records;
(B) any information generated by or about
educators in connection with their use of the vendor's
product or service; or
(C) any records created by the vendor as a result
of educators' use of the vendor's product or service;
(8) requiring a school board or its employees, agents,
volunteers, or educators to indemnify a vendor or pay the
vendor's attorneys' fees or costs in connection with any
dispute arising out of, or otherwise connected to, educator

HB0810 Engrossed - 20 - LRB099 04620 NHT 24649 b
data;
(9) requiring a school board or its employees, agents,
volunteers, or educators to arbitrate any dispute arising
out of, or otherwise connected to, educator data;
(10) entering into any contract or other agreement with
a school board that authorizes in any manner activities
prohibited by this Section; and
(11) modifying or otherwise altering the terms and
conditions of any contract or other agreement with a school
board related to educator data without the express consent
of the school board.
(d) Any vendor who receives any educator data from a school
board or the State Board in any manner shall:
(1) store and process such records and information in
accordance with commercial best practices, which shall
include, but not be limited to, data-security practices set
forth by the United States Department of Education Privacy
Technical Assistance Center and any rules adopted by the
State Board;
(2) implement and maintain appropriate administrative,
physical, and technical safeguards, to secure such records
and information from unauthorized access, destruction,
use, modification, or disclosure, which safeguards shall
be consistent with any rules adopted by the State Board and
any guidance provided by the United States Department of
Education Privacy and Technical Assistance Center;

HB0810 Engrossed - 21 - LRB099 04620 NHT 24649 b
(3) immediately notify the school board of any security
breach resulting in unauthorized access to any educator
data, regardless of whether it is the school board's
educator data;
(4) delete the personally identifiable information of
a specific educator:
(A) at the request of the educator's school or
school board; or
(B) at the request of an educator, provided the
school board consents to the request;
(5) designate an officer or employee as a responsible
person who shall be trained in a manner so as to ensure
compliance with this Section and ensure the security and
confidentiality of student data;
(6) within 30 days of the completion or termination of
the terms of any contract with a school board related to
educator data, delete or return to the school board all
educator data and information and records generated
therefrom and, in the event of deletion, provide a written
certification that such deletion has occurred. In the event
the vendor chooses to delete the data, records, and
information described in this subdivision (6), it shall
provide the school board with a written certification that
the data, records, and information have been deleted, which
certification shall be provided to the school board within
30 days of the termination of the contract;

HB0810 Engrossed - 22 - LRB099 04620 NHT 24649 b
(7) permit educators to access and correct any
information contained in the educator records provided to
the vendor by the school board;
(8) permit a school board to audit and inspect the
vendor's practices with respect to any educator data
received by the vendor from the school board or any
information or records generated therefrom;
(9) permit the school board access to any educator data
provided by the school board and any information and
records generated therefrom in order for the school board
to respond to a request under the Freedom of Information
Act or pursuant to a court order;
(10) be permitted to diagnose and correct problems with
the vendor's product or service, provided that to diagnose
or correct a problem does not require the vendor to engage
in any activities prohibited by this Section; and
(11) agree that any dispute arising out of, or
otherwise connected to, student data shall be litigated
using Illinois law and that the proper venue is the circuit
court of the county in which the school board is located.
(e) Any vendor who seeks to receive from a school board or
the State Board in any manner any educator data is required to
enter into a written contract with the school board before any
records can be transferred, which contract shall contain the
following:
(1) provisions consistent with each requirement set

HB0810 Engrossed - 23 - LRB099 04620 NHT 24649 b
forth in subsections (c) and (d) of this Section;
(2) a listing of the precise educator data to be
provided to the vendor;
(3) a statement of the product or service being
provided to the school board by the vendor;
(4) a statement that the vendor is a school official
with a legitimate educational interest, performing an
institutional service or function for which the school
board would otherwise use employees, under the direct
control of the school board with respect to the use and
maintenance of educator data, and is using such educator
data only for an authorized purpose and will not
re-disclose it to third parties or affiliates without
permission from the school board or pursuant to court
order;
(5) a statement that the educator data continues to be
the property of and under the control of the school board,
and the vendor has a limited, nonexclusive license solely
for the purpose of performing its obligations under the
contract;
(6) a description of the actions the vendor will take,
including the designation and training of responsible
employees, to ensure the security and confidentiality of
educator data; compliance with this requirement shall not,
in itself, absolve the vendor of liability in the event of
an unauthorized disclosure of educator data; and

HB0810 Engrossed - 24 - LRB099 04620 NHT 24649 b
(7) a statement that the contract is the entire
agreement between the school board (including school board
employees and other end users) and the vendor.
(f) Each school board shall adopt a policy regarding which
school employees have the power to bind the school board to the
terms of any agreements, whether electronic, click-through,
click-wrap, verbal, or in writing. If a vendor enters into an
agreement with an employee or other end users who are not
authorized through the school board's policy to enter into such
an agreement, then the agreement shall be voidable by the
school board.
(g) Each school board entering into a contract or agreement
as allowed by this Section shall maintain an original copy of
its term and conditions at the school board's primary place of
business, including a copy of the terms and conditions set
forth in any agreement described in subsection (f) of this
Section.
(h) In the event of a security breach resulting, in whole
or in part, from the vendor's conduct, in addition to any other
remedies available to the school board under law or equity, the
vendor shall reimburse the school board in full for all costs
and expenses incurred by the school board in investigating and
remediating the breach, including, but not limited to:
(1) providing notification to the educators whose
personally identifiable information was compromised and to
regulatory agencies or other entities as required by law or

HB0810 Engrossed - 25 - LRB099 04620 NHT 24649 b
contract;
(2) providing one year's credit monitoring to those
educators whose educator data was exposed in such a manner
during the breach that a reasonable person would have cause
to believe that it could impact his or her credit or
financial security; and
(3) payment of legal fees, audit costs, fines, and
other fees or damages imposed against the school board as a
result of the security breach.
(i) The State Board shall develop, publish, and make
publicly available model educator data privacy policies and
procedures that comply with relevant state and federal law.
(j) In addition to any other penalties, any contract
governed by this Section that fails to comply with the
requirements of this Section shall be rendered void if, upon
notice and a reasonable opportunity to cure, the noncompliant
party fails to cure any defect. Written notice of noncompliance
may be provided by either party to the contract. Any vendor
subject to a contract voided under this subdivision is
required, within 60 days, to return all student data and any
information or records generated therefrom in its possession to
the school board. Any vendor that fails to cure any defect in
the contract shall not be entitled to any payment required
under the contract and shall return to the school board all
payments previously made by the school board.

HB0810 Engrossed - 26 - LRB099 04620 NHT 24649 b
Section 10. The Illinois School Student Records Act is
amended by changing Sections 2, 6, and 9 as follows:
(105 ILCS 10/2) (from Ch. 122, par. 50-2)
Sec. 2. In this Act:
"Biometric record" means a record of one or more measurable
biological or behavioral characteristics that can be used for
automated recognition of an individual. Examples include
fingerprints, retina and iris patterns, voiceprints, DNA
sequence, facial characteristics, and handwriting.
"Eligible student" means a student who has reached 18 years
of age.
"Parent" means a person who is the natural parent of the
student or other person who has the primary responsibility for
the care and upbringing of the student. All rights and
privileges accorded to a parent under this Act shall become
exclusively those of the student upon the student's 18th
birthday, graduation from secondary school, marriage, or entry
into military service, whichever occurs first. Such rights and
privileges may also be exercised by the student at any time
with respect to the student's permanent school record.
"Personally identifiable information" means:
(1) the student's name;
(2) the name of the student's parent or other family
members;
(3) the address of the student or student's family;

HB0810 Engrossed - 27 - LRB099 04620 NHT 24649 b
(4) a personal identifier, such as the student's social
security number, student number, or biometric record;
(5) other indirect identifiers, such as the student's
date of birth, place of birth, and mother's maiden name;
(6) other information that, alone or in combination, is
linked or linkable to a specific student that would allow a
reasonable person in the school community, who does not
have personal knowledge of the relevant circumstances, to
identify the student with reasonable certainty; or
(7) information requested by a person who the
educational agency or institution reasonably believes
knows the identity of the student to whom the education
record relates.
"Record" means any information recorded or generated in any
way, including, but not limited to, electronically-generated
data, handwriting, print, computer media, video or audio tape,
film, microfilm, and microfiche.
"School" means any public preschool, day care center,
kindergarten, nursery, elementary or secondary educational
institution, vocational school, special education facility or
any other elementary or secondary educational agency or
institution and any person, agency or institution which
maintains school student records from more than one school, but
does not include a private or non-public school.
"School board" means any school board, board of directors,
or any other governing body established under the School Code.

HB0810 Engrossed - 28 - LRB099 04620 NHT 24649 b
"School student record" means any writing or other recorded
information concerning a student by which a student may be
individually or personally identified that is maintained by a
school or at its direction or by an employee of a school,
regardless of how or where the information is stored. The
following shall not be deemed school student records under this
Act: writings or other recorded information maintained by an
employee of a school or other person at the direction of a
school for his or her exclusive use; provided that all such
writings and other recorded information are destroyed not later
than the student's graduation or permanent withdrawal from the
school; and provided further that no such records or recorded
information may be released or disclosed to any person except a
person designated by the school as a substitute unless they are
first incorporated in a school student record and made subject
to all of the provisions of this Act. School student records
shall not include information maintained by law enforcement
professionals working in the school.
"State Board" means the State Board of Education.
"Student" means any person enrolled or previously enrolled
in a school.
"Student permanent record" means the minimum personal
information necessary to a school in the education of the
student and contained in a school student record. Such
information may include the student's name, birth date,
address, grades and grade level, parents' names and addresses,

HB0810 Engrossed - 29 - LRB099 04620 NHT 24649 b
attendance records, and such other entries as the State Board
may require or authorize.
"Student temporary record" means all information contained
in a school student record but not contained in the student
permanent record. Such information may include family
background information, intelligence test scores, aptitude
test scores, psychological and personality test results,
teacher evaluations, and other information of clear relevance
to the education of the student, all subject to rules of the
State Board. The information shall include information
provided under Section 8.6 of the Abused and Neglected Child
Reporting Act. In addition, the student temporary record shall
include information regarding disciplinary infractions
involving drugs, weapons, or bodily harm to another that
resulted in expulsion, suspension, or the imposition of
punishment or sanction.
As used in this Act,
(a) "Student" means any person enrolled or previously
enrolled in a school.
(b) "School" means any public preschool, day care center,
kindergarten, nursery, elementary or secondary educational
institution, vocational school, special educational facility
or any other elementary or secondary educational agency or
institution and any person, agency or institution which
maintains school student records from more than one school, but
does not include a private or non-public school.

HB0810 Engrossed - 30 - LRB099 04620 NHT 24649 b
(c) "State Board" means the State Board of Education.
(d) "School Student Record" means any writing or other
recorded information concerning a student and by which a
student may be individually identified, maintained by a school
or at its direction or by an employee of a school, regardless
of how or where the information is stored. The following shall
not be deemed school student records under this Act: writings
or other recorded information maintained by an employee of a
school or other person at the direction of a school for his or
her exclusive use; provided that all such writings and other
recorded information are destroyed not later than the student's
graduation or permanent withdrawal from the school; and
provided further that no such records or recorded information
may be released or disclosed to any person except a person
designated by the school as a substitute unless they are first
incorporated in a school student record and made subject to all
of the provisions of this Act. School student records shall not
include information maintained by law enforcement
professionals working in the school.
(e) "Student Permanent Record" means the minimum personal
information necessary to a school in the education of the
student and contained in a school student record. Such
information may include the student's name, birth date,
address, grades and grade level, parents' names and addresses,
attendance records, and such other entries as the State Board
may require or authorize.

HB0810 Engrossed - 31 - LRB099 04620 NHT 24649 b
(f) "Student Temporary Record" means all information
contained in a school student record but not contained in the
student permanent record. Such information may include family
background information, intelligence test scores, aptitude
test scores, psychological and personality test results,
teacher evaluations, and other information of clear relevance
to the education of the student, all subject to regulations of
the State Board. The information shall include information
provided under Section 8.6 of the Abused and Neglected Child
Reporting Act. In addition, the student temporary record shall
include information regarding serious disciplinary infractions
that resulted in expulsion, suspension, or the imposition of
punishment or sanction. For purposes of this provision, serious
disciplinary infractions means: infractions involving drugs,
weapons, or bodily harm to another.
(g) "Parent" means a person who is the natural parent of
the student or other person who has the primary responsibility
for the care and upbringing of the student. All rights and
privileges accorded to a parent under this Act shall become
exclusively those of the student upon his 18th birthday,
graduation from secondary school, marriage or entry into
military service, whichever occurs first. Such rights and
privileges may also be exercised by the student at any time
with respect to the student's permanent school record.
(Source: P.A. 92-295, eff. 1-1-02.)

HB0810 Engrossed - 32 - LRB099 04620 NHT 24649 b
(105 ILCS 10/6) (from Ch. 122, par. 50-6)
Sec. 6. (a) No school student records or information
contained therein may be released, transferred, disclosed or
otherwise disseminated, except as follows:
(1) to To a parent or student or person specifically
designated as a representative by a parent, as provided in
paragraph (a) of Section 5;
(2) to To an employee or official of the school or
school district or State Board with current demonstrable
educational or administrative interest in the student, in
furtherance of such interest;
(3) to To the official records custodian of another
school within Illinois or an official with similar
responsibilities of a school outside Illinois, in which the
student has enrolled, or intends to enroll, upon the
request of such official or student;
(4) to To any person for the purpose of research,
statistical reporting, or planning, provided that such
research, statistical reporting, or planning is
permissible under and undertaken in accordance with the
federal Family Educational Rights and Privacy Act (20
U.S.C. 1232g);
(5) pursuant Pursuant to a court order, provided that
the parent shall be given prompt written notice upon
receipt of such order of the terms of the order, the nature
and substance of the information proposed to be released in

HB0810 Engrossed - 33 - LRB099 04620 NHT 24649 b
compliance with such order and an opportunity to inspect
and copy the school student records and to challenge their
contents pursuant to Section 7;
(6) to To any person as specifically required by State
or federal law;
(6.5) to To juvenile authorities when necessary for the
discharge of their official duties who request information
prior to adjudication of the student and who certify in
writing that the information will not be disclosed to any
other party except as provided under law or order of court.
For purposes of this Section "juvenile authorities" means:
(i) a judge of the circuit court and members of the staff
of the court designated by the judge; (ii) parties to the
proceedings under the Juvenile Court Act of 1987 and their
attorneys; (iii) probation officers and court appointed
advocates for the juvenile authorized by the judge hearing
the case; (iv) any individual, public or private agency
having custody of the child pursuant to court order; (v)
any individual, public or private agency providing
education, medical or mental health service to the child
when the requested information is needed to determine the
appropriate service or treatment for the minor; (vi) any
potential placement provider when such release is
authorized by the court for the limited purpose of
determining the appropriateness of the potential
placement; (vii) law enforcement officers and prosecutors;

HB0810 Engrossed - 34 - LRB099 04620 NHT 24649 b
(viii) adult and juvenile prisoner review boards; (ix)
authorized military personnel; (x) individuals authorized
by court;
(7) subject Subject to regulations of the State Board,
in connection with an emergency, to appropriate persons if
the knowledge of such information is necessary to protect
the health or safety of the student or other persons;
(8) to To any person, with the prior specific dated
written consent of the parent designating the person to
whom the records may be released, provided that at the time
any such consent is requested or obtained, the parent shall
be advised in writing that he has the right to inspect and
copy such records in accordance with Section 5, to
challenge their contents in accordance with Section 7 and
to limit any such consent to designated records or
designated portions of the information contained therein;
(9) to To a governmental agency, or social service
agency contracted by a governmental agency, in furtherance
of an investigation of a student's school attendance
pursuant to the compulsory student attendance laws of this
State, provided that the records are released to the
employee or agent designated by the agency;
(10) to To those SHOCAP committee members who fall
within the meaning of "state and local officials and
authorities", as those terms are used within the meaning of
the federal Family Educational Rights and Privacy Act, for

HB0810 Engrossed - 35 - LRB099 04620 NHT 24649 b
the purposes of identifying serious habitual juvenile
offenders and matching those offenders with community
resources pursuant to Section 5-145 of the Juvenile Court
Act of 1987, but only to the extent that the release,
transfer, disclosure, or dissemination is consistent with
the Family Educational Rights and Privacy Act;
(11) to To the Department of Healthcare and Family
Services in furtherance of the requirements of Section
2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or
Section 10 of the School Breakfast and Lunch Program Act;
or
(12) to To the State Board or another State government
agency or between or among State government agencies in
order to evaluate or audit federal and State programs or
perform research and planning, but only to the extent that
the release, transfer, disclosure, or dissemination is
consistent with the federal Family Educational Rights and
Privacy Act (20 U.S.C. 1232g).
(a-5) Pursuant to subparagraph (4) of paragraph (a) of this
Section, a school board or the State Board may provide records
of a student to researchers at an accredited post-secondary
educational institution or an organization conducting research
if any such research is conducted in accordance with the
federal Family Educational Rights and Privacy Act and does not
take place until the following requirements are complied with:
(1) Prior to the beginning of each school year, the

HB0810 Engrossed - 36 - LRB099 04620 NHT 24649 b
school board shall provide notice to parents, guardians or
eligible students regarding planned studies. For those
school boards that maintain an Internet website, the school
board shall post on its Internet website a current list of
all research studies using records obtained from the school
board without obtaining consent from parents, guardians or
eligible students currently being conducted or scheduled
to be conducted. In April and December of each year, the
school board shall update the Internet website to include
new research studies that are approved or conducted. For
those school boards that do not maintain an Internet
website, each school board shall provide parents,
guardians and eligible students with a current list of all
research studies being conducted or scheduled to be
conducted in the same notice described above and shall
provide supplemental notices every April and December
provided new research studies have been approved or are
being conducted.
(A) The school board shall send the notice
described in this subparagraph (1) by the same means
generally used to send notices to parents, guardians or
eligible students.
(B) The notice described in this subparagraph (1)
shall describe generally the purposes of conducting
educational research, contain a short description of
all current and scheduled research studies and set

HB0810 Engrossed - 37 - LRB099 04620 NHT 24649 b
forth the address of the Internet website containing a
current list of all research studies being conducted
and scheduled to be conducted, which web address shall
also be set forth in the school board's student
handbook. The notice shall also advise parents,
guardians and eligible students that the State Board
conducts research studies and shall provide the
Internet website address for that part of the State
Board's website that contains a list of the current and
scheduled studies to be conducted.
(C) For those school boards that maintain an
Internet website, the webpage that contains the list of
all current and scheduled research studies shall also
set forth, in general terms, the nature of each listed
research study, the categories of students whose
records will be used in each listed research study and
the names of all organizations involved in each listed
research study. For those school boards that do not
maintain an Internet website, the school boards shall
provide the information described in this subdivision
(C) in the notice described in this subparagraph (1).
(2) A written data use agreement that complies with the
Family Educational Rights and Privacy Act and its
accompanying regulations and, at a minimum, contains the
provisions set forth below is entered into by and between
the party gaining access to the records of the school board

HB0810 Engrossed - 38 - LRB099 04620 NHT 24649 b
or State Board and the entity with the legal authority to
permit the use of the data:
(A) The accredited post-secondary educational
institution or the organization conducting research
shall abide by all requirements of this subparagraph
(2).
(B) A statement of the purpose, scope and duration
of the research study or studies, as well as a
description of the records to be used as part of the
study and the person or persons to whom the records
will be disclosed, provided that the list of persons to
whom the records may be disclosed may be amended from
time to time with the agreement of all parties to the
data use agreement.
(C) The accredited post-secondary educational
institution or the organization conducting research
shall use school student records only to meet the
purpose or purposes of the study as set forth in
subdivision (B) of this subparagraph (2).
(D) The accredited post-secondary educational
institution or the organization conducting research
may only use records containing personally
identifiable information of a student or by which a
student may otherwise be individually or personally
identified for two reasons: (i) to link data files; or
(ii) to identify eligible students for research

HB0810 Engrossed - 39 - LRB099 04620 NHT 24649 b
studies for which written parental, guardian or
eligible student consent will be obtained for
participation and the person or persons to whom such
information will be disclosed is set forth in the data
use agreement.
(E) The accredited post-secondary educational
institution or the organization conducting research
shall destroy all records containing personally
identifiable information of a student or that
otherwise individually or personally identifies a
student when the information is no longer needed, but
in no event later than 36 months after the research
study has been completed.
(F) The accredited post-secondary educational
institution or the organization conducting research
shall certify in writing that it has the capacity to
and shall restrict access to school student records to
the person or persons set forth in subdivision (B) of
this subparagraph (2).
(G) The accredited post-secondary educational
institution or the organization conducting research
shall certify in writing that it shall maintain the
security of all records received pursuant to this
paragraph (a-5) in compliance with rules that shall be
adopted by the State Board, which rules shall be
consistent, and regularly updated to comply, with

HB0810 Engrossed - 40 - LRB099 04620 NHT 24649 b
commonly accepted data-security practices, including,
but not limited to, those set forth by the United
States Department of Education Privacy Technical
Assistance Center.
(H) In compliance with the rules adopted pursuant
to subdivision (G) of this subparagraph (2) and any
other rules that may be necessary and adopted by the
State Board, the accredited post-secondary educational
institution or the organization conducting research
shall develop, implement, maintain, and use
appropriate administrative, technical and physical
security measures to preserve the confidentiality and
integrity of all school student records.
(3) Accredited post-secondary educational institutions
and organizations conducting research may only use records
containing personally identifiable information or a
student or by which a student may otherwise be personally
or individually identified for two reasons: (i) to link
data files or (ii) to identify eligible students for
research studies for which written parental, guardian or
eligible student consent will be obtained for
participation and the person or persons to whom such
information will be disclosed is set forth in the data use
agreement.
(4) The accredited post-secondary institution or the
organization conducting research agrees that it shall use

HB0810 Engrossed - 41 - LRB099 04620 NHT 24649 b
personally identifiable information from school student
records only to meet the purpose or purposes of the
research study or studies as stated in the data use
agreement described in subparagraph (2) of this paragraph
(a-5).
(5) Any information by which a student may be
individually or personally identified shall be released,
transferred, disclosed or otherwise disseminated only as
contemplated by the written data use agreement of paragraph
(a-5).
(6) All school student records shall have personally
identifiable information removed prior to analysis by the
accredited post-secondary educational institution or the
organization conducting research.
(7) The accredited post-secondary institution or
organization conducting research shall implement and
adhere to policies and procedures that restrict access to
records which have personally identifiable information.
(A) The accredited post-secondary institution or
organization conducting research shall designate an
individual to act as the custodian of the records with
personally identifiable information who is responsible
for restricting access to those records and provide the
name of that individual to the entity with the legal
authority to permit the use of the records.
(B) Any personally identifiable information used

HB0810 Engrossed - 42 - LRB099 04620 NHT 24649 b
to link data sets shall be securely stored in a
location separate and apart from the location of the
de-identified school student records, in a secure data
file.
Nothing in this subparagraph (a-5) shall prohibit the State
Board or any school board from providing personally
identifiable information about individual students to an
accredited post-secondary educational institution or an
organization conducting research pursuant to a specific,
written agreement with a school board or State Board and in
accordance with the federal Family Educational Rights and
Privacy Act, where necessary for the school board or State
Board to comply with state or federal statutory mandates.
(b) No information may be released pursuant to subparagraph
subparagraphs (3) or (6) of paragraph (a) of this Section 6
unless the parent receives prior written notice of the nature
and substance of the information proposed to be released, and
an opportunity to inspect and copy such records in accordance
with Section 5 and to challenge their contents in accordance
with Section 7. Provided, however, that such notice shall be
sufficient if published in a local newspaper of general
circulation or other publication directed generally to the
parents involved where the proposed release of information is
pursuant to subparagraph (6) 6 of paragraph (a) of in this
Section 6 and relates to more than 25 students.
(c) A record of any release of information pursuant to this

HB0810 Engrossed - 43 - LRB099 04620 NHT 24649 b
Section must be made and kept as a part of the school student
record and subject to the access granted by Section 5. Such
record of release shall be maintained for the life of the
school student records and shall be available only to the
parent and the official records custodian. Each record of
release shall also include:
(1) the The nature and substance of the information
released;
(2) the The name and signature of the official records
custodian releasing such information;
(3) the The name of the person requesting such
information, the capacity in which such a request has been
made, and the purpose of such request;
(4) the The date of the release; and
(5) a A copy of any consent to such release.
(d) Except for the student and his parents, no person to
whom information is released pursuant to this Section and no
person specifically designated as a representative by a parent
may permit any other person to have access to such information
without a prior consent of the parent obtained in accordance
with the requirements of subparagraph (8) of paragraph (a) of
this Section.
(e) Nothing contained in this Act shall prohibit the
publication of student directories which list student names,
addresses and other identifying information and similar
publications which comply with regulations issued by the State

HB0810 Engrossed - 44 - LRB099 04620 NHT 24649 b
Board.
(Source: P.A. 95-331, eff. 8-21-07; 95-793, eff. 1-1-09;
96-107, eff. 7-30-09; 96-1000, eff. 7-2-10; revised 11-26-14.)
(105 ILCS 10/9) (from Ch. 122, par. 50-9)
Sec. 9. (a) Any person aggrieved by any violation of this
Act may institute an action for injunctive relief in the
Circuit Court of the County in which the violation has occurred
or the Circuit Court of the County in which the school is
located.
(b) Any person injured by a wilful or negligent violation
of this Act may institute an action for damages in the Circuit
Court of the County in which the violation has occurred or the
Circuit Court of the County in which the school is located.
(c) In the case of any successful action under paragraph
(a) or (b) of this Section, any person or school found to have
wilfully or negligently violated any provision of this Act is
liable to the plaintiff for the plaintiff's damages, the costs
of the action and reasonable attorneys' fees, as determined by
the Court.
(d) Actions for injunctive relief to secure compliance with
this Act may be brought by the State Board, by the State's
Attorney of the County in which the alleged violation has
occurred or the State's Attorney of the County in which the
school is located, in each case in the Circuit Court of such
County.

HB0810 Engrossed - 45 - LRB099 04620 NHT 24649 b
(e) Wilful failure to comply with any Section of this Act
is a petty offense; except that any person who wilfully and
maliciously falsifies any school student record, student
permanent record or student temporary record shall be guilty of
a Class A misdemeanor.
(f) Absent proof of malice, no cause of action or claim for
relief, civil or criminal, may be maintained against any
school, or employee or official of a school or person acting at
the direction of a school for any statement made or judgment
expressed in any entry to a school student record of a type
which does not violate this Act or the regulations issued by
the State Board pursuant to this Act; provided that this
paragraph (f) does not limit or deny any defense available
under existing law.
(g) In addition to any other penalties and remedies
provided by this Section 9 of this Act, any accredited
post-secondary educational institution or organization
conducting research that violates the requirements of
subparagraph (a-5) of Section 6 of this Act shall immediately
cease conducting any research that utilizes school student
records and shall be prohibited from conducting additional
research studies based on such records and information for a
period of 6 months from the date of the discovery of the
violation.
(h) In addition to any other penalties and remedies
provided by this Section 9 of this Act, any school board that

HB0810 Engrossed - 46 - LRB099 04620 NHT 24649 b
violates the requirements of subparagraph (a-5) of Section 6 of
this Act shall be prohibited from entering into a data use
agreement with any accredited post-secondary educational
institution or organization conducting research for a period of
12 months from the date of the discovery of the violation, and
all existing data use agreements shall be voided.
(Source: P.A. 84-712.)
Section 15. The Children's Privacy Protection and Parental
Empowerment Act is amended by changing Section 5 as follows:
(325 ILCS 17/5)
Sec. 5. Definitions. As used in this Act:
"Child" means a person under the age of 18 16. "Child" does
not include a minor emancipated by operation of law.
"Parent" means a parent, step-parent, or legal guardian.
"Personal information" means any of the following:
(1) A person's name.
(2) A person's address.
(3) A person's telephone number.
(4) A person's driver's license number or State of
Illinois identification card as assigned by the Illinois
Secretary of State or by a similar agency of another state.
(5) A person's social security number.
(6) Any other information that can be used to locate or
contact a specific individual.

HB0810 Engrossed - 47 - LRB099 04620 NHT 24649 b
"Personal information" does not include any of the
following:
(1) Public records as defined by Section 2 of the
Freedom of Information Act.
(2) Court records.
(3) Information found in publicly available sources,
including newspapers, magazines, and telephone
directories.
(4) Any other information that is not known to concern
a child.
(Source: P.A. 93-462, eff. 1-1-04.)