HB0810 Engrossed LRB099 04620 NHT 24649 b
1		AN ACT concerning education.
2		Be it enacted by the People of the State of Illinois,
3		represented in the General Assembly:
4		Section 5. The School Code is amended by adding Sections
5		22-80 and 22-81 as follows:
6		(105 ILCS 5/22-80 new)
7		Sec. 22-80. Student data privacy.
8		(a) It is the intent of the General Assembly to help ensure
9		that information generated by and about students in the course
10		of, and in connection with, their education is safeguarded and
11		that student privacy is honored, respected and protected. The
12		General Assembly finds the following:
13		(1) Information generated by and about students in the
14		course of, and in connection with, their education is a
15		vital resource for teachers and school staff in planning
16		education programs and services, scheduling students into
17		appropriate classes and completing reports for educational
18		agencies.
19		(2) Information generated by and about students in the
20		course of, and in connection with, their education is
21		critical to educators in helping students successfully
22		graduate from high school and being ready to enter the
23		workforce or postsecondary education.

HB0810 Engrossed - 2 - LRB099 04620 NHT 24649 b
1		(3) While information generated by and about students
2		in the course of, and in connection with, their education
3		is important for educational purposes, it is also
4		critically important to ensure that the information is
5		protected, safeguarded and kept private and used only by
6		appropriate educational authorities or their permitted
7		designees and then, only to serve the best interests of the
8		student.
9		To that end, this Section will help ensure that information
10		generated by and about students in the course of, and in
11		connection with, their education is protected and expectations
12		of privacy are honored.
13		(b) In this Section:
14		"Biometric record" shall have the meaning set forth in the
15		Illinois School Student Records Act.
16		"Eligible student" shall have the meaning set forth in the
17		Illinois School Student Records Act.
18		"Parent" shall have the meaning set forth in the Illinois
19		School Student Records Act.
20		"Personally identifiable information" shall have the
21		meaning set forth in the Illinois School Student Records Act.
22		"Record" shall have the meaning set forth in the Illinois
23		School Student Records Act.
24		"School" shall have the meaning set forth in the Illinois
25		School Student Records Act.
26		"School board" shall have the meaning set forth in the

HB0810 Engrossed - 3 - LRB099 04620 NHT 24649 b
1		Illinois School Student Records Act.
2		"School student record" shall have the meaning set forth in
3		the Illinois School Student Records Act.
4		"State Board" shall have the meaning set forth in the
5		Illinois School Student Records Act.
6		"Student" shall have the meaning set forth in the Illinois
7		School Student Records Act.
8		"Student data" means school student records, student
9		permanent records, student temporary records, or any other
10		records, personally identifiable information, or intellectual
11		property of a student.
12		"Student permanent record" shall have the meaning set forth
13		in the Illinois School Student Records Act.
14		"Student temporary record" shall have the meaning set forth
15		in the Illinois School Student Records Act.
16		"Targeted advertising" means any form of advertising aimed
17		directly at a specific individual or group of individuals based
18		on a known or assumed trait or traits, including, but not
19		limited to, age, gender, race, grade level, address, observed
20		behavior, or academic achievement.
21		"Vendor" means any entity and its officers, employees,
22		agents, independent contractors, and subcontractors that
23		provides or offers to provide a product or service to a school
24		board, which product or service is marketed or designed for
25		school purposes or which the entity knows or reasonably should
26		know will be used for school purposes.

HB0810 Engrossed - 4 - LRB099 04620 NHT 24649 b
1		(c) Any vendor who receives any student data from a school
2		board or the State Board in any manner is prohibited from:
3		(1) advertising or marketing, including targeted
4		advertising, based on:
5		(A) any information, including personally
6		identifiable information, contained in the school
7		student records, student permanent records, student
8		temporary records, or any other records of a student;
9		(B) any information generated by or about students
10		in connection with their use of the vendor's product or
11		service; or
12		(C) any records created by the vendor as a result
13		of students' use of the vendor's product or service;
14		(2) creating, generating, or otherwise amassing a
15		profile about any student for any purpose other than to
16		provide the school board with information about student
17		academic growth or achievement;
18		(3) selling or otherwise disclosing the following to
19		anyone other than the school board, unless such sale or
20		disclosure is required by court order or to comply with the
21		Illinois School Student Records Act or the federal Family
22		Educational Rights and Privacy Act (20 U.S.C. 1232g) or is
23		expressly authorized by this Section:
24		(A) any information, including personally
25		identifiable information, contained in the school
26		student records, student permanent records, student

HB0810 Engrossed - 5 - LRB099 04620 NHT 24649 b
1		temporary records, or any other records of a student;
2		(B) any information generated by or about students
3		in connection with their use of the vendor's product or
4		service;
5		(C) any records created by the vendor as a result
6		of students' use of the vendor's product or service; or
7		(D) any student's intellectual property;
8		(4) exercising or claiming any rights, implied or
9		otherwise, to:
10		(A) any information, including personally
11		identifiable information, contained in the school
12		student records, student permanent records, student
13		temporary records, or any other records of a student;
14		(B) any information generated by or about students
15		in connection with their use of the vendor's product or
16		service;
17		(C) any records created by the vendor as a result
18		of students' use of the vendor's product or service; or
19		(D) any student's intellectual property;
20		(5) storing or processing outside the United States:
21		(A) any information, including personally
22		identifiable information, contained in the school
23		student records, student permanent records, student
24		temporary records or any other records of a student;
25		(B) any information generated by or about students
26		in connection with their use of the vendor's product or

HB0810 Engrossed - 6 - LRB099 04620 NHT 24649 b
1		service;
2		(C) any records created by the vendor as a result
3		of students' use of the vendor's product or service; or
4		(D) any student's intellectual property;
5		(6) transferring the following to any third party
6		(including subcontractors), affiliate, or government
7		agency other than the State Board, unless required by court
8		order or expressly authorized by the school board in
9		compliance with this Section:
10		(A) any information, including personally
11		identifiable information, contained in the school
12		student records, student permanent records, student
13		temporary records, or any other records of a student;
14		(B) any information generated by or about students
15		in connection with their use of the vendor's product or
16		service;
17		(C) any records created by the vendor as a result
18		of students' use of the vendor's product or service; or
19		(D) any student's intellectual property;
20		(7) permitting access by anyone to the following,
21		unless such access is required for the vendor to provide
22		its product or service to the school board:
23		(A) any information, including personally
24		identifiable information, contained in the school
25		student records, student permanent records, student
26		temporary records or any other records of a student;

HB0810 Engrossed - 7 - LRB099 04620 NHT 24649 b
1		(B) any information generated by or about students
2		in connection with their use of the vendor's product or
3		service;
4		(C) any records created by the vendor as a result
5		of students' use of the vendor's product or service; or
6		(D) any student's intellectual property;
7		(8) requiring a school board or its employees, agents,
8		volunteers, or students to indemnify a vendor or pay the
9		vendor's attorneys' fees or costs in connection with any
10		dispute arising out of, or otherwise connected to, student
11		data;
12		(9) requiring a school board or its employees, agents,
13		volunteers, or students to arbitrate any dispute arising
14		out of, or otherwise connected to, student data;
15		(10) entering into any contract or other agreement with
16		a school board that authorizes in any manner activities
17		prohibited by this Section; and
18		(11) modifying or otherwise altering the terms and
19		conditions of any contract or other agreement with a school
20		board related to student data without the express consent
21		of the school board.
22		(d) Any vendor who receives any student data from a school
23		board or the State Board in any manner shall:
24		(1) store and process such records and information in
25		accordance with commercial best practices, which shall
26		include, but not be limited to, data-security practices set

HB0810 Engrossed - 8 - LRB099 04620 NHT 24649 b
1		forth by the United States Department of Education Privacy
2		Technical Assistance Center and any rules adopted by the
3		State Board;
4		(2) implement and maintain appropriate administrative,
5		physical, and technical safeguards, to secure such records
6		and information from unauthorized access, destruction,
7		use, modification, or disclosure, which safeguards shall
8		be consistent with any rules adopted by the State Board and
9		any guidance provided by the United States Department of
10		Education Privacy and Technical Assistance Center;
11		(3) immediately notify the school board of any security
12		breach resulting in unauthorized access to any student
13		data, regardless of whether it is the school board's
14		student data;
15		(4) delete the personally identifiable information of
16		a specific student:
17		(A) at the request of the student's school or
18		school board; or
19		(B) at the request of an eligible student or a
20		parent, provided the school board consents to the
21		request;
22		(5) designate an officer or employee as a responsible
23		person who shall be trained in a manner so as to ensure
24		compliance with this Section and ensure the security and
25		confidentiality of student data;
26		(6) within 30 days of the completion or termination of

HB0810 Engrossed - 9 - LRB099 04620 NHT 24649 b
1		the terms of any contract with a school board related to
2		student data, delete or return to the school board all
3		student data and information and records generated
4		therefrom and, in the event of deletion, provide a written
5		certification that such deletion has occurred. In the event
6		the vendor chooses to delete the data, records, and
7		information described in this subdivision (6), it shall
8		provide the school board with a written certification that
9		the data, records, and information have been deleted, which
10		certification shall be provided to the school board within
11		30 days of the termination of the contract;
12		(7) permit eligible students and parents to access and
13		correct any information contained in the school student
14		records, student permanent records, student temporary
15		records, or any other records provided to the vendor by the
16		school board;
17		(8) permit a school board to audit and inspect the
18		vendor's practices with respect to any student data
19		received by the vendor from the school board or any
20		information or records generated therefrom;
21		(9) permit the school board access to any student data
22		provided by the school board and any information and
23		records generated therefrom in order for the school board
24		to respond to a request under the Freedom of Information
25		Act or pursuant to a court order;
26		(10) be permitted to diagnose and correct problems with

HB0810 Engrossed - 10 - LRB099 04620 NHT 24649 b
1		the vendor's product or service, provided that to diagnose
2		or correct a problem does not require the vendor to engage
3		in any activities prohibited by this Section; and
4		(11) agree that any dispute arising out of, or
5		otherwise connected to, student data shall be litigated
6		using Illinois law and that the proper venue is the circuit
7		court of the county in which the school board is located.
8		(e) Any vendor who seeks to receive from a school board or
9		the State Board in any manner any student data is required to
10		enter into a written contract with the school board before any
11		records can be transferred, which contract shall contain the
12		following:
13		(1) provisions consistent with each requirement set
14		forth in subsections (c) and (d) of this Section;
15		(2) a listing of the precise student data to be
16		provided to the vendor;
17		(3) a statement of the product or service being
18		provided to the school board by the vendor;
19		(4) a statement that the vendor is a school official
20		with a legitimate educational interest, performing an
21		institutional service or function for which the school
22		board would otherwise use employees, under the direct
23		control of the school board with respect to the use and
24		maintenance of student data, and is using such student data
25		only for an authorized purpose and will not re-disclose it
26		to third parties or affiliates without permission from the

HB0810 Engrossed - 11 - LRB099 04620 NHT 24649 b
1		school board or pursuant to court order;
2		(5) a statement that the student data continues to be
3		the property of and under the control of the school board,
4		and the vendor has a limited, nonexclusive license solely
5		for the purpose of performing its obligations under the
6		contract;
7		(6) a description of the actions the vendor will take
8		to ensure the security and confidentiality of student data;
9		compliance with this requirement shall not, in itself,
10		absolve the vendor of liability in the event of an
11		unauthorized disclosure of student data; and
12		(7) a statement that the contract is the entire
13		agreement between the school board (including school board
14		employees and other end users) and the vendor.
15		(f) Each school board shall adopt a policy regarding which
16		school employees have the power to bind the school board to the
17		terms of any agreements, whether electronic, click-through,
18		click-wrap, verbal, or in writing. If a vendor enters into an
19		agreement with an employee or other end users who are not
20		authorized through the school board's policy to enter into such
21		an agreement, then the agreement shall be voidable by the
22		school board.
23		(g) Each school board entering into a contract or agreement
24		as allowed by this Section shall maintain an original copy of
25		its term and conditions at the school board's primary place of
26		business, including a copy of the terms and conditions set

HB0810 Engrossed - 12 - LRB099 04620 NHT 24649 b
1		forth in any agreement described in subsection (f) of this
2		Section.
3		(h) The State Board shall create, publish, and make
4		publicly available all data elements collected by the State
5		Board that contain personally identifiable information.
6		(i) In the event of a security breach resulting, in whole
7		or in part, from the vendor's conduct, in addition to any other
8		remedies available to the school board under law or equity, the
9		vendor shall reimburse the school board in full for all costs
10		and expenses incurred by the school board in investigating and
11		remediating the breach, including, but not limited to:
12		(1) providing notification to those students and their
13		parents, in the event the student is under the age of 18,
14		whose personally identifiable information was compromised
15		and to regulatory agencies or other entities as required by
16		law or contract;
17		(2) providing one year's credit monitoring to those
18		students and eligible students whose student data was
19		exposed in such a manner during the breach that a
20		reasonable person would have cause to believe that it could
21		impact his or her credit or financial security; and
22		(3) payment of legal fees, audit costs, fines, and
23		other fees or damages imposed against the school board as a
24		result of the security breach.
25		(j) The State Board shall develop, publish, and make
26		publicly available model student data privacy policies and

HB0810 Engrossed - 13 - LRB099 04620 NHT 24649 b
1		procedures that comply with relevant state and federal law.
2		(k) Within 180 days after the effective date of this
3		amendatory Act of the 99th General Assembly, the State Board
4		shall create a model notice that school boards may use to
5		provide notice to parents that states, in general terms, what
6		types of student data are collected by the school board and
7		shared with vendors under this Section and the purposes of
8		collecting and using the student data. Upon the creation of the
9		notice described in this subsection (k), a school board shall,
10		at the beginning of each school year, provide such notice in
11		writing or electronically to parents and eligible students.
12		(l) In addition to any other penalties, any contract
13		governed by this Section that fails to comply with the
14		requirements of this Section shall be rendered void if, upon
15		notice and a reasonable opportunity to cure, the noncompliant
16		party fails to cure any defect. Written notice of noncompliance
17		may be provided by either party to the contract. Any vendor
18		subject to a contract voided under this subdivision is
19		required, within 60 days, to return all student data and any
20		information or records generated therefrom in its possession to
21		the school board. Any vendor that fails to cure any defect in
22		the contract shall not be entitled to any payment required
23		under the contract and shall return to the school board all
24		payments previously made by the school board.
25		(105 ILCS 5/22-81 new)

HB0810 Engrossed - 14 - LRB099 04620 NHT 24649 b
1		Sec. 22-81. Educator data privacy.
2		(a) It is the intent of the General Assembly to help ensure
3		that information generated by and about educators in the course
4		of, and in connection with, the performance of their duties is
5		safeguarded and that educator privacy is honored, respected and
6		protected. The General Assembly finds the following:
7		(1) Information generated by and about educators in the
8		course of, and in connection with, the performance of their
9		duties is a vital resource for school boards, the State
10		Board and research organizations in planning education
11		programs and services, completing reports for educational
12		agencies, and improving the performance of schools.
13		(2) Information generated by and about educators in the
14		course of, and in connection with, the performance of their
15		duties is critical to the performance and improvement of
16		schools.
17		(3) While information generated by and about educators
18		in the course of, and in connection with, the performance
19		of their duties is important for educational purposes, it
20		is also critically important to ensure that the information
21		is protected, safeguarded and kept private and used only by
22		appropriate educational authorities or their permitted
23		designees.
24		To that end, this Section will help ensure that information
25		generated by and about educators in the course of, and in
26		connection with, the performance of their duties is protected

HB0810 Engrossed - 15 - LRB099 04620 NHT 24649 b
1		and expectations of privacy are honored.
2		(b) In this Section:
3		"Biometric record" shall have the meaning set forth in the
4		Illinois School Student Records Act.
5		"Educator" means any person employed by or otherwise
6		working for a school board to provide educational services
7		within a school.
8		"Educator data" means educator records or any other records
9		containing personally identifiable information of an educator.
10		"Educator record" means any writing or other recorded
11		information concerning an educator by which an educator may be
12		individually or personally identified maintained by a school or
13		at its direction or by an employee of a school, regardless of
14		how or where the information is stored.
15		"Personally identifiable information" means:
16		(1) the educator's name;
17		(2) the names of the educator's immediate family
18		members;
19		(3) the address of the educator or educator's immediate
20		family members;
21		(4) a personal identifier, such as the educator's
22		social security number, student number, or biometric
23		record;
24		(5) other indirect identifiers, such as the educator's
25		date of birth, place of birth, and mother's maiden name;
26		(6) other information that, alone or in combination, is

HB0810 Engrossed - 16 - LRB099 04620 NHT 24649 b
1		linked or linkable to a specific educator that would allow
2		a reasonable person in the school community, who does not
3		have personal knowledge of the relevant circumstances, to
4		identify the educator with reasonable certainty; or
5		(7) information requested by a person who the
6		educational agency or institution reasonably believes
7		knows the identity of the educator to whom the record
8		relates.
9		"Record" means any information recorded or generated in any
10		way, including, but not limited to, electronically-generated
11		data, handwriting, print, computer media, video or audio tape,
12		film, microfilm, and microfiche.
13		"School" shall have the meaning set forth in the Illinois
14		School Student Records Act.
15		"School board" shall have the meaning set forth in the
16		Illinois School Student Records Act.
17		"State Board" shall have the meaning set forth in the
18		Illinois School Student Records Act.
19		"Targeted advertising" means any form of advertising aimed
20		directly at a specific individual or group of individuals based
21		on a known or assumed trait, or traits, including, but not
22		limited to, age, gender, race, address, observed behavior, or
23		classroom performance.
24		"Vendor" means any entity and its officers, employees,
25		agents, independent contractors, and subcontractors that
26		provides or offers to provide a product or service to a school

HB0810 Engrossed - 17 - LRB099 04620 NHT 24649 b
1		board, which product or service is marketed or designed for
2		school purposes or which the entity knows or reasonably should
3		know will be used for school purposes.
4		(c) Any vendor who receives any educator data from a school
5		board or the State Board in any manner is prohibited from:
6		(1) advertising or marketing, including targeted
7		advertising, based on:
8		(A) any information, including personally
9		identifiable information, contained in the educator
10		records;
11		(B) any information generated by or about
12		educators in connection with their use of the vendor's
13		product or service; or
14		(C) any records created by the vendor as a result
15		of educators' use of the vendor's product or service;
16		(2) creating, generating, or otherwise amassing a
17		profile about any educator for any purpose other than to
18		provide the school board with information about educator
19		performance or achievement;
20		(3) selling or otherwise disclosing the following to
21		anyone other than the school board, unless such sale or
22		disclosure is required by court order or is expressly
23		authorized by this Section:
24		(A) any information, including personally
25		identifiable information, contained in the educator
26		records;

HB0810 Engrossed - 18 - LRB099 04620 NHT 24649 b
1		(B) any information generated by or about
2		educators in connection with their use of the vendor's
3		product or service; or
4		(C) any records created by the vendor as a result
5		of educators' use of the vendor's product or service;
6		(4) exercising or claiming any rights, implied or
7		otherwise, to:
8		(A) any information, including personally
9		identifiable information, contained in the educator
10		records;
11		(B) any information generated by or about
12		educators in connection with their use of the vendor's
13		product or service; or
14		(C) any records created by the vendor as a result
15		of educators' use of the vendor's product or service;
16		(5) storing or processing outside the United States:
17		(A) any information, including personally
18		identifiable information, contained in the educator
19		records;
20		(B) any information generated by or about
21		educators in connection with their use of the vendor's
22		product or service; or
23		(C) any records created by the vendor as a result
24		of educators' use of the vendor's product or service;
25		(6) transferring the following to any third-party
26		(including subcontractors), affiliate, or government

HB0810 Engrossed - 19 - LRB099 04620 NHT 24649 b
1		agency other than the State Board, unless required by court
2		order or expressly authorized by the school board in
3		compliance with this Section:
4		(A) any information, including personally
5		identifiable information, contained in the educator
6		records;
7		(B) any information generated by or about
8		educators in connection with their use of the vendor's
9		product or service; or
10		(C) any records created by the vendor as a result
11		of educators' use of the vendor's product or service;
12		(7) permitting access by anyone to the following,
13		unless such access is required for the vendor to provide
14		its product or service to the school board:
15		(A) any information, including personally
16		identifiable information, contained in the educator
17		records;
18		(B) any information generated by or about
19		educators in connection with their use of the vendor's
20		product or service; or
21		(C) any records created by the vendor as a result
22		of educators' use of the vendor's product or service;
23		(8) requiring a school board or its employees, agents,
24		volunteers, or educators to indemnify a vendor or pay the
25		vendor's attorneys' fees or costs in connection with any
26		dispute arising out of, or otherwise connected to, educator

HB0810 Engrossed - 20 - LRB099 04620 NHT 24649 b
1		data;
2		(9) requiring a school board or its employees, agents,
3		volunteers, or educators to arbitrate any dispute arising
4		out of, or otherwise connected to, educator data;
5		(10) entering into any contract or other agreement with
6		a school board that authorizes in any manner activities
7		prohibited by this Section; and
8		(11) modifying or otherwise altering the terms and
9		conditions of any contract or other agreement with a school
10		board related to educator data without the express consent
11		of the school board.
12		(d) Any vendor who receives any educator data from a school
13		board or the State Board in any manner shall:
14		(1) store and process such records and information in
15		accordance with commercial best practices, which shall
16		include, but not be limited to, data-security practices set
17		forth by the United States Department of Education Privacy
18		Technical Assistance Center and any rules adopted by the
19		State Board;
20		(2) implement and maintain appropriate administrative,
21		physical, and technical safeguards, to secure such records
22		and information from unauthorized access, destruction,
23		use, modification, or disclosure, which safeguards shall
24		be consistent with any rules adopted by the State Board and
25		any guidance provided by the United States Department of
26		Education Privacy and Technical Assistance Center;

HB0810 Engrossed - 21 - LRB099 04620 NHT 24649 b
1		(3) immediately notify the school board of any security
2		breach resulting in unauthorized access to any educator
3		data, regardless of whether it is the school board's
4		educator data;
5		(4) delete the personally identifiable information of
6		a specific educator:
7		(A) at the request of the educator's school or
8		school board; or
9		(B) at the request of an educator, provided the
10		school board consents to the request;
11		(5) designate an officer or employee as a responsible
12		person who shall be trained in a manner so as to ensure
13		compliance with this Section and ensure the security and
14		confidentiality of student data;
15		(6) within 30 days of the completion or termination of
16		the terms of any contract with a school board related to
17		educator data, delete or return to the school board all
18		educator data and information and records generated
19		therefrom and, in the event of deletion, provide a written
20		certification that such deletion has occurred. In the event
21		the vendor chooses to delete the data, records, and
22		information described in this subdivision (6), it shall
23		provide the school board with a written certification that
24		the data, records, and information have been deleted, which
25		certification shall be provided to the school board within
26		30 days of the termination of the contract;

HB0810 Engrossed - 22 - LRB099 04620 NHT 24649 b
1		(7) permit educators to access and correct any
2		information contained in the educator records provided to
3		the vendor by the school board;
4		(8) permit a school board to audit and inspect the
5		vendor's practices with respect to any educator data
6		received by the vendor from the school board or any
7		information or records generated therefrom;
8		(9) permit the school board access to any educator data
9		provided by the school board and any information and
10		records generated therefrom in order for the school board
11		to respond to a request under the Freedom of Information
12		Act or pursuant to a court order;
13		(10) be permitted to diagnose and correct problems with
14		the vendor's product or service, provided that to diagnose
15		or correct a problem does not require the vendor to engage
16		in any activities prohibited by this Section; and
17		(11) agree that any dispute arising out of, or
18		otherwise connected to, student data shall be litigated
19		using Illinois law and that the proper venue is the circuit
20		court of the county in which the school board is located.
21		(e) Any vendor who seeks to receive from a school board or
22		the State Board in any manner any educator data is required to
23		enter into a written contract with the school board before any
24		records can be transferred, which contract shall contain the
25		following:
26		(1) provisions consistent with each requirement set

HB0810 Engrossed - 23 - LRB099 04620 NHT 24649 b
1		forth in subsections (c) and (d) of this Section;
2		(2) a listing of the precise educator data to be
3		provided to the vendor;
4		(3) a statement of the product or service being
5		provided to the school board by the vendor;
6		(4) a statement that the vendor is a school official
7		with a legitimate educational interest, performing an
8		institutional service or function for which the school
9		board would otherwise use employees, under the direct
10		control of the school board with respect to the use and
11		maintenance of educator data, and is using such educator
12		data only for an authorized purpose and will not
13		re-disclose it to third parties or affiliates without
14		permission from the school board or pursuant to court
15		order;
16		(5) a statement that the educator data continues to be
17		the property of and under the control of the school board,
18		and the vendor has a limited, nonexclusive license solely
19		for the purpose of performing its obligations under the
20		contract;
21		(6) a description of the actions the vendor will take,
22		including the designation and training of responsible
23		employees, to ensure the security and confidentiality of
24		educator data; compliance with this requirement shall not,
25		in itself, absolve the vendor of liability in the event of
26		an unauthorized disclosure of educator data; and

HB0810 Engrossed - 24 - LRB099 04620 NHT 24649 b
1		(7) a statement that the contract is the entire
2		agreement between the school board (including school board
3		employees and other end users) and the vendor.
4		(f) Each school board shall adopt a policy regarding which
5		school employees have the power to bind the school board to the
6		terms of any agreements, whether electronic, click-through,
7		click-wrap, verbal, or in writing. If a vendor enters into an
8		agreement with an employee or other end users who are not
9		authorized through the school board's policy to enter into such
10		an agreement, then the agreement shall be voidable by the
11		school board.
12		(g) Each school board entering into a contract or agreement
13		as allowed by this Section shall maintain an original copy of
14		its term and conditions at the school board's primary place of
15		business, including a copy of the terms and conditions set
16		forth in any agreement described in subsection (f) of this
17		Section.
18		(h) In the event of a security breach resulting, in whole
19		or in part, from the vendor's conduct, in addition to any other
20		remedies available to the school board under law or equity, the
21		vendor shall reimburse the school board in full for all costs
22		and expenses incurred by the school board in investigating and
23		remediating the breach, including, but not limited to:
24		(1) providing notification to the educators whose
25		personally identifiable information was compromised and to
26		regulatory agencies or other entities as required by law or

HB0810 Engrossed - 25 - LRB099 04620 NHT 24649 b
1		contract;
2		(2) providing one year's credit monitoring to those
3		educators whose educator data was exposed in such a manner
4		during the breach that a reasonable person would have cause
5		to believe that it could impact his or her credit or
6		financial security; and
7		(3) payment of legal fees, audit costs, fines, and
8		other fees or damages imposed against the school board as a
9		result of the security breach.
10		(i) The State Board shall develop, publish, and make
11		publicly available model educator data privacy policies and
12		procedures that comply with relevant state and federal law.
13		(j) In addition to any other penalties, any contract
14		governed by this Section that fails to comply with the
15		requirements of this Section shall be rendered void if, upon
16		notice and a reasonable opportunity to cure, the noncompliant
17		party fails to cure any defect. Written notice of noncompliance
18		may be provided by either party to the contract. Any vendor
19		subject to a contract voided under this subdivision is
20		required, within 60 days, to return all student data and any
21		information or records generated therefrom in its possession to
22		the school board. Any vendor that fails to cure any defect in
23		the contract shall not be entitled to any payment required
24		under the contract and shall return to the school board all
25		payments previously made by the school board.

HB0810 Engrossed - 26 - LRB099 04620 NHT 24649 b
1		Section 10. The Illinois School Student Records Act is
2		amended by changing Sections 2, 6, and 9 as follows:
3		(105 ILCS 10/2) (from Ch. 122, par. 50-2)
4		Sec. 2. In this Act:
5		"Biometric record" means a record of one or more measurable
6		biological or behavioral characteristics that can be used for
7		automated recognition of an individual. Examples include
8		fingerprints, retina and iris patterns, voiceprints, DNA
9		sequence, facial characteristics, and handwriting.
10		"Eligible student" means a student who has reached 18 years
11		of age.
12		"Parent" means a person who is the natural parent of the
13		student or other person who has the primary responsibility for
14		the care and upbringing of the student. All rights and
15		privileges accorded to a parent under this Act shall become
16		exclusively those of the student upon the student's 18th
17		birthday, graduation from secondary school, marriage, or entry
18		into military service, whichever occurs first. Such rights and
19		privileges may also be exercised by the student at any time
20		with respect to the student's permanent school record.
21		"Personally identifiable information" means:
22		(1) the student's name;
23		(2) the name of the student's parent or other family
24		members;
25		(3) the address of the student or student's family;

HB0810 Engrossed - 27 - LRB099 04620 NHT 24649 b
1		(4) a personal identifier, such as the student's social
2		security number, student number, or biometric record;
3		(5) other indirect identifiers, such as the student's
4		date of birth, place of birth, and mother's maiden name;
5		(6) other information that, alone or in combination, is
6		linked or linkable to a specific student that would allow a
7		reasonable person in the school community, who does not
8		have personal knowledge of the relevant circumstances, to
9		identify the student with reasonable certainty; or
10		(7) information requested by a person who the
11		educational agency or institution reasonably believes
12		knows the identity of the student to whom the education
13		record relates.
14		"Record" means any information recorded or generated in any
15		way, including, but not limited to, electronically-generated
16		data, handwriting, print, computer media, video or audio tape,
17		film, microfilm, and microfiche.
18		"School" means any public preschool, day care center,
19		kindergarten, nursery, elementary or secondary educational
20		institution, vocational school, special education facility or
21		any other elementary or secondary educational agency or
22		institution and any person, agency or institution which
23		maintains school student records from more than one school, but
24		does not include a private or non-public school.
25		"School board" means any school board, board of directors,
26		or any other governing body established under the School Code.

HB0810 Engrossed - 28 - LRB099 04620 NHT 24649 b
1		"School student record" means any writing or other recorded
2		information concerning a student by which a student may be
3		individually or personally identified that is maintained by a
4		school or at its direction or by an employee of a school,
5		regardless of how or where the information is stored. The
6		following shall not be deemed school student records under this
7		Act: writings or other recorded information maintained by an
8		employee of a school or other person at the direction of a
9		school for his or her exclusive use; provided that all such
10		writings and other recorded information are destroyed not later
11		than the student's graduation or permanent withdrawal from the
12		school; and provided further that no such records or recorded
13		information may be released or disclosed to any person except a
14		person designated by the school as a substitute unless they are
15		first incorporated in a school student record and made subject
16		to all of the provisions of this Act. School student records
17		shall not include information maintained by law enforcement
18		professionals working in the school.
19		"State Board" means the State Board of Education.
20		"Student" means any person enrolled or previously enrolled
21		in a school.
22		"Student permanent record" means the minimum personal
23		information necessary to a school in the education of the
24		student and contained in a school student record. Such
25		information may include the student's name, birth date,
26		address, grades and grade level, parents' names and addresses,

HB0810 Engrossed - 29 - LRB099 04620 NHT 24649 b
1		attendance records, and such other entries as the State Board
2		may require or authorize.
3		"Student temporary record" means all information contained
4		in a school student record but not contained in the student
5		permanent record. Such information may include family
6		background information, intelligence test scores, aptitude
7		test scores, psychological and personality test results,
8		teacher evaluations, and other information of clear relevance
9		to the education of the student, all subject to rules of the
10		State Board. The information shall include information
11		provided under Section 8.6 of the Abused and Neglected Child
12		Reporting Act. In addition, the student temporary record shall
13		include information regarding disciplinary infractions
14		involving drugs, weapons, or bodily harm to another that
15		resulted in expulsion, suspension, or the imposition of
16		punishment or sanction.
17		As used in this Act,
18		(a) "Student" means any person enrolled or previously
19		enrolled in a school.
20		(b) "School" means any public preschool, day care center,
21		kindergarten, nursery, elementary or secondary educational
22		institution, vocational school, special educational facility
23		or any other elementary or secondary educational agency or
24		institution and any person, agency or institution which
25		maintains school student records from more than one school, but
26		does not include a private or non-public school.

HB0810 Engrossed - 30 - LRB099 04620 NHT 24649 b
1		(c) "State Board" means the State Board of Education.
2		(d) "School Student Record" means any writing or other
3		recorded information concerning a student and by which a
4		student may be individually identified, maintained by a school
5		or at its direction or by an employee of a school, regardless
6		of how or where the information is stored. The following shall
7		not be deemed school student records under this Act: writings
8		or other recorded information maintained by an employee of a
9		school or other person at the direction of a school for his or
10		her exclusive use; provided that all such writings and other
11		recorded information are destroyed not later than the student's
12		graduation or permanent withdrawal from the school; and
13		provided further that no such records or recorded information
14		may be released or disclosed to any person except a person
15		designated by the school as a substitute unless they are first
16		incorporated in a school student record and made subject to all
17		of the provisions of this Act. School student records shall not
18		include information maintained by law enforcement
19		professionals working in the school.
20		(e) "Student Permanent Record" means the minimum personal
21		information necessary to a school in the education of the
22		student and contained in a school student record. Such
23		information may include the student's name, birth date,
24		address, grades and grade level, parents' names and addresses,
25		attendance records, and such other entries as the State Board
26		may require or authorize.

HB0810 Engrossed - 31 - LRB099 04620 NHT 24649 b
1		(f) "Student Temporary Record" means all information
2		contained in a school student record but not contained in the
3		student permanent record. Such information may include family
4		background information, intelligence test scores, aptitude
5		test scores, psychological and personality test results,
6		teacher evaluations, and other information of clear relevance
7		to the education of the student, all subject to regulations of
8		the State Board. The information shall include information
9		provided under Section 8.6 of the Abused and Neglected Child
10		Reporting Act. In addition, the student temporary record shall
11		include information regarding serious disciplinary infractions
12		that resulted in expulsion, suspension, or the imposition of
13		punishment or sanction. For purposes of this provision, serious
14		disciplinary infractions means: infractions involving drugs,
15		weapons, or bodily harm to another.
16		(g) "Parent" means a person who is the natural parent of
17		the student or other person who has the primary responsibility
18		for the care and upbringing of the student. All rights and
19		privileges accorded to a parent under this Act shall become
20		exclusively those of the student upon his 18th birthday,
21		graduation from secondary school, marriage or entry into
22		military service, whichever occurs first. Such rights and
23		privileges may also be exercised by the student at any time
24		with respect to the student's permanent school record.
25		(Source: P.A. 92-295, eff. 1-1-02.)

HB0810 Engrossed - 32 - LRB099 04620 NHT 24649 b
1		(105 ILCS 10/6) (from Ch. 122, par. 50-6)
2		Sec. 6. (a) No school student records or information
3		contained therein may be released, transferred, disclosed or
4		otherwise disseminated, except as follows:
5		(1) to To a parent or student or person specifically
6		designated as a representative by a parent, as provided in
7		paragraph (a) of Section 5;
8		(2) to To an employee or official of the school or
9		school district or State Board with current demonstrable
10		educational or administrative interest in the student, in
11		furtherance of such interest;
12		(3) to To the official records custodian of another
13		school within Illinois or an official with similar
14		responsibilities of a school outside Illinois, in which the
15		student has enrolled, or intends to enroll, upon the
16		request of such official or student;
17		(4) to To any person for the purpose of research,
18		statistical reporting, or planning, provided that such
19		research, statistical reporting, or planning is
20		permissible under and undertaken in accordance with the
21		federal Family Educational Rights and Privacy Act (20
22		U.S.C. 1232g);
23		(5) pursuant Pursuant to a court order, provided that
24		the parent shall be given prompt written notice upon
25		receipt of such order of the terms of the order, the nature
26		and substance of the information proposed to be released in

HB0810 Engrossed - 33 - LRB099 04620 NHT 24649 b
1		compliance with such order and an opportunity to inspect
2		and copy the school student records and to challenge their
3		contents pursuant to Section 7;
4		(6) to To any person as specifically required by State
5		or federal law;
6		(6.5) to To juvenile authorities when necessary for the
7		discharge of their official duties who request information
8		prior to adjudication of the student and who certify in
9		writing that the information will not be disclosed to any
10		other party except as provided under law or order of court.
11		For purposes of this Section "juvenile authorities" means:
12		(i) a judge of the circuit court and members of the staff
13		of the court designated by the judge; (ii) parties to the
14		proceedings under the Juvenile Court Act of 1987 and their
15		attorneys; (iii) probation officers and court appointed
16		advocates for the juvenile authorized by the judge hearing
17		the case; (iv) any individual, public or private agency
18		having custody of the child pursuant to court order; (v)
19		any individual, public or private agency providing
20		education, medical or mental health service to the child
21		when the requested information is needed to determine the
22		appropriate service or treatment for the minor; (vi) any
23		potential placement provider when such release is
24		authorized by the court for the limited purpose of
25		determining the appropriateness of the potential
26		placement; (vii) law enforcement officers and prosecutors;

HB0810 Engrossed - 34 - LRB099 04620 NHT 24649 b
1		(viii) adult and juvenile prisoner review boards; (ix)
2		authorized military personnel; (x) individuals authorized
3		by court;
4		(7) subject Subject to regulations of the State Board,
5		in connection with an emergency, to appropriate persons if
6		the knowledge of such information is necessary to protect
7		the health or safety of the student or other persons;
8		(8) to To any person, with the prior specific dated
9		written consent of the parent designating the person to
10		whom the records may be released, provided that at the time
11		any such consent is requested or obtained, the parent shall
12		be advised in writing that he has the right to inspect and
13		copy such records in accordance with Section 5, to
14		challenge their contents in accordance with Section 7 and
15		to limit any such consent to designated records or
16		designated portions of the information contained therein;
17		(9) to To a governmental agency, or social service
18		agency contracted by a governmental agency, in furtherance
19		of an investigation of a student's school attendance
20		pursuant to the compulsory student attendance laws of this
21		State, provided that the records are released to the
22		employee or agent designated by the agency;
23		(10) to To those SHOCAP committee members who fall
24		within the meaning of "state and local officials and
25		authorities", as those terms are used within the meaning of
26		the federal Family Educational Rights and Privacy Act, for

HB0810 Engrossed - 35 - LRB099 04620 NHT 24649 b
1		the purposes of identifying serious habitual juvenile
2		offenders and matching those offenders with community
3		resources pursuant to Section 5-145 of the Juvenile Court
4		Act of 1987, but only to the extent that the release,
5		transfer, disclosure, or dissemination is consistent with
6		the Family Educational Rights and Privacy Act;
7		(11) to To the Department of Healthcare and Family
8		Services in furtherance of the requirements of Section
9		2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or
10		Section 10 of the School Breakfast and Lunch Program Act;
11		or
12		(12) to To the State Board or another State government
13		agency or between or among State government agencies in
14		order to evaluate or audit federal and State programs or
15		perform research and planning, but only to the extent that
16		the release, transfer, disclosure, or dissemination is
17		consistent with the federal Family Educational Rights and
18		Privacy Act (20 U.S.C. 1232g).
19		(a-5) Pursuant to subparagraph (4) of paragraph (a) of this
20		Section, a school board or the State Board may provide records
21		of a student to researchers at an accredited post-secondary
22		educational institution or an organization conducting research
23		if any such research is conducted in accordance with the
24		federal Family Educational Rights and Privacy Act and does not
25		take place until the following requirements are complied with:
26		(1) Prior to the beginning of each school year, the

HB0810 Engrossed - 36 - LRB099 04620 NHT 24649 b
1		school board shall provide notice to parents, guardians or
2		eligible students regarding planned studies. For those
3		school boards that maintain an Internet website, the school
4		board shall post on its Internet website a current list of
5		all research studies using records obtained from the school
6		board without obtaining consent from parents, guardians or
7		eligible students currently being conducted or scheduled
8		to be conducted. In April and December of each year, the
9		school board shall update the Internet website to include
10		new research studies that are approved or conducted. For
11		those school boards that do not maintain an Internet
12		website, each school board shall provide parents,
13		guardians and eligible students with a current list of all
14		research studies being conducted or scheduled to be
15		conducted in the same notice described above and shall
16		provide supplemental notices every April and December
17		provided new research studies have been approved or are
18		being conducted.
19		(A) The school board shall send the notice
20		described in this subparagraph (1) by the same means
21		generally used to send notices to parents, guardians or
22		eligible students.
23		(B) The notice described in this subparagraph (1)
24		shall describe generally the purposes of conducting
25		educational research, contain a short description of
26		all current and scheduled research studies and set

HB0810 Engrossed - 37 - LRB099 04620 NHT 24649 b
1		forth the address of the Internet website containing a
2		current list of all research studies being conducted
3		and scheduled to be conducted, which web address shall
4		also be set forth in the school board's student
5		handbook. The notice shall also advise parents,
6		guardians and eligible students that the State Board
7		conducts research studies and shall provide the
8		Internet website address for that part of the State
9		Board's website that contains a list of the current and
10		scheduled studies to be conducted.
11		(C) For those school boards that maintain an
12		Internet website, the webpage that contains the list of
13		all current and scheduled research studies shall also
14		set forth, in general terms, the nature of each listed
15		research study, the categories of students whose
16		records will be used in each listed research study and
17		the names of all organizations involved in each listed
18		research study. For those school boards that do not
19		maintain an Internet website, the school boards shall
20		provide the information described in this subdivision
21		(C) in the notice described in this subparagraph (1).
22		(2) A written data use agreement that complies with the
23		Family Educational Rights and Privacy Act and its
24		accompanying regulations and, at a minimum, contains the
25		provisions set forth below is entered into by and between
26		the party gaining access to the records of the school board

HB0810 Engrossed - 38 - LRB099 04620 NHT 24649 b
1		or State Board and the entity with the legal authority to
2		permit the use of the data:
3		(A) The accredited post-secondary educational
4		institution or the organization conducting research
5		shall abide by all requirements of this subparagraph
6		(2).
7		(B) A statement of the purpose, scope and duration
8		of the research study or studies, as well as a
9		description of the records to be used as part of the
10		study and the person or persons to whom the records
11		will be disclosed, provided that the list of persons to
12		whom the records may be disclosed may be amended from
13		time to time with the agreement of all parties to the
14		data use agreement.
15		(C) The accredited post-secondary educational
16		institution or the organization conducting research
17		shall use school student records only to meet the
18		purpose or purposes of the study as set forth in
19		subdivision (B) of this subparagraph (2).
20		(D) The accredited post-secondary educational
21		institution or the organization conducting research
22		may only use records containing personally
23		identifiable information of a student or by which a
24		student may otherwise be individually or personally
25		identified for two reasons: (i) to link data files; or
26		(ii) to identify eligible students for research

HB0810 Engrossed - 39 - LRB099 04620 NHT 24649 b
1		studies for which written parental, guardian or
2		eligible student consent will be obtained for
3		participation and the person or persons to whom such
4		information will be disclosed is set forth in the data
5		use agreement.
6		(E) The accredited post-secondary educational
7		institution or the organization conducting research
8		shall destroy all records containing personally
9		identifiable information of a student or that
10		otherwise individually or personally identifies a
11		student when the information is no longer needed, but
12		in no event later than 36 months after the research
13		study has been completed.
14		(F) The accredited post-secondary educational
15		institution or the organization conducting research
16		shall certify in writing that it has the capacity to
17		and shall restrict access to school student records to
18		the person or persons set forth in subdivision (B) of
19		this subparagraph (2).
20		(G) The accredited post-secondary educational
21		institution or the organization conducting research
22		shall certify in writing that it shall maintain the
23		security of all records received pursuant to this
24		paragraph (a-5) in compliance with rules that shall be
25		adopted by the State Board, which rules shall be
26		consistent, and regularly updated to comply, with

HB0810 Engrossed - 40 - LRB099 04620 NHT 24649 b
1		commonly accepted data-security practices, including,
2		but not limited to, those set forth by the United
3		States Department of Education Privacy Technical
4		Assistance Center.
5		(H) In compliance with the rules adopted pursuant
6		to subdivision (G) of this subparagraph (2) and any
7		other rules that may be necessary and adopted by the
8		State Board, the accredited post-secondary educational
9		institution or the organization conducting research
10		shall develop, implement, maintain, and use
11		appropriate administrative, technical and physical
12		security measures to preserve the confidentiality and
13		integrity of all school student records.
14		(3) Accredited post-secondary educational institutions
15		and organizations conducting research may only use records
16		containing personally identifiable information or a
17		student or by which a student may otherwise be personally
18		or individually identified for two reasons: (i) to link
19		data files or (ii) to identify eligible students for
20		research studies for which written parental, guardian or
21		eligible student consent will be obtained for
22		participation and the person or persons to whom such
23		information will be disclosed is set forth in the data use
24		agreement.
25		(4) The accredited post-secondary institution or the
26		organization conducting research agrees that it shall use

HB0810 Engrossed - 41 - LRB099 04620 NHT 24649 b
1		personally identifiable information from school student
2		records only to meet the purpose or purposes of the
3		research study or studies as stated in the data use
4		agreement described in subparagraph (2) of this paragraph
5		(a-5).
6		(5) Any information by which a student may be
7		individually or personally identified shall be released,
8		transferred, disclosed or otherwise disseminated only as
9		contemplated by the written data use agreement of paragraph
10		(a-5).
11		(6) All school student records shall have personally
12		identifiable information removed prior to analysis by the
13		accredited post-secondary educational institution or the
14		organization conducting research.
15		(7) The accredited post-secondary institution or
16		organization conducting research shall implement and
17		adhere to policies and procedures that restrict access to
18		records which have personally identifiable information.
19		(A) The accredited post-secondary institution or
20		organization conducting research shall designate an
21		individual to act as the custodian of the records with
22		personally identifiable information who is responsible
23		for restricting access to those records and provide the
24		name of that individual to the entity with the legal
25		authority to permit the use of the records.
26		(B) Any personally identifiable information used

HB0810 Engrossed - 42 - LRB099 04620 NHT 24649 b
1		to link data sets shall be securely stored in a
2		location separate and apart from the location of the
3		de-identified school student records, in a secure data
4		file.
5		Nothing in this subparagraph (a-5) shall prohibit the State
6		Board or any school board from providing personally
7		identifiable information about individual students to an
8		accredited post-secondary educational institution or an
9		organization conducting research pursuant to a specific,
10		written agreement with a school board or State Board and in
11		accordance with the federal Family Educational Rights and
12		Privacy Act, where necessary for the school board or State
13		Board to comply with state or federal statutory mandates.
14		(b) No information may be released pursuant to subparagraph
15		subparagraphs (3) or (6) of paragraph (a) of this Section 6
16		unless the parent receives prior written notice of the nature
17		and substance of the information proposed to be released, and
18		an opportunity to inspect and copy such records in accordance
19		with Section 5 and to challenge their contents in accordance
20		with Section 7. Provided, however, that such notice shall be
21		sufficient if published in a local newspaper of general
22		circulation or other publication directed generally to the
23		parents involved where the proposed release of information is
24		pursuant to subparagraph (6) 6 of paragraph (a) of in this
25		Section 6 and relates to more than 25 students.
26		(c) A record of any release of information pursuant to this

HB0810 Engrossed - 43 - LRB099 04620 NHT 24649 b
1		Section must be made and kept as a part of the school student
2		record and subject to the access granted by Section 5. Such
3		record of release shall be maintained for the life of the
4		school student records and shall be available only to the
5		parent and the official records custodian. Each record of
6		release shall also include:
7		(1) the The nature and substance of the information
8		released;
9		(2) the The name and signature of the official records
10		custodian releasing such information;
11		(3) the The name of the person requesting such
12		information, the capacity in which such a request has been
13		made, and the purpose of such request;
14		(4) the The date of the release; and
15		(5) a A copy of any consent to such release.
16		(d) Except for the student and his parents, no person to
17		whom information is released pursuant to this Section and no
18		person specifically designated as a representative by a parent
19		may permit any other person to have access to such information
20		without a prior consent of the parent obtained in accordance
21		with the requirements of subparagraph (8) of paragraph (a) of
22		this Section.
23		(e) Nothing contained in this Act shall prohibit the
24		publication of student directories which list student names,
25		addresses and other identifying information and similar
26		publications which comply with regulations issued by the State

HB0810 Engrossed - 44 - LRB099 04620 NHT 24649 b
1		Board.
2		(Source: P.A. 95-331, eff. 8-21-07; 95-793, eff. 1-1-09;
3		96-107, eff. 7-30-09; 96-1000, eff. 7-2-10; revised 11-26-14.)
4		(105 ILCS 10/9) (from Ch. 122, par. 50-9)
5		Sec. 9. (a) Any person aggrieved by any violation of this
6		Act may institute an action for injunctive relief in the
7		Circuit Court of the County in which the violation has occurred
8		or the Circuit Court of the County in which the school is
9		located.
10		(b) Any person injured by a wilful or negligent violation
11		of this Act may institute an action for damages in the Circuit
12		Court of the County in which the violation has occurred or the
13		Circuit Court of the County in which the school is located.
14		(c) In the case of any successful action under paragraph
15		(a) or (b) of this Section, any person or school found to have
16		wilfully or negligently violated any provision of this Act is
17		liable to the plaintiff for the plaintiff's damages, the costs
18		of the action and reasonable attorneys' fees, as determined by
19		the Court.
20		(d) Actions for injunctive relief to secure compliance with
21		this Act may be brought by the State Board, by the State's
22		Attorney of the County in which the alleged violation has
23		occurred or the State's Attorney of the County in which the
24		school is located, in each case in the Circuit Court of such
25		County.

HB0810 Engrossed - 45 - LRB099 04620 NHT 24649 b
1		(e) Wilful failure to comply with any Section of this Act
2		is a petty offense; except that any person who wilfully and
3		maliciously falsifies any school student record, student
4		permanent record or student temporary record shall be guilty of
5		a Class A misdemeanor.
6		(f) Absent proof of malice, no cause of action or claim for
7		relief, civil or criminal, may be maintained against any
8		school, or employee or official of a school or person acting at
9		the direction of a school for any statement made or judgment
10		expressed in any entry to a school student record of a type
11		which does not violate this Act or the regulations issued by
12		the State Board pursuant to this Act; provided that this
13		paragraph (f) does not limit or deny any defense available
14		under existing law.
15		(g) In addition to any other penalties and remedies
16		provided by this Section 9 of this Act, any accredited
17		post-secondary educational institution or organization
18		conducting research that violates the requirements of
19		subparagraph (a-5) of Section 6 of this Act shall immediately
20		cease conducting any research that utilizes school student
21		records and shall be prohibited from conducting additional
22		research studies based on such records and information for a
23		period of 6 months from the date of the discovery of the
24		violation.
25		(h) In addition to any other penalties and remedies
26		provided by this Section 9 of this Act, any school board that

HB0810 Engrossed - 46 - LRB099 04620 NHT 24649 b
1		violates the requirements of subparagraph (a-5) of Section 6 of
2		this Act shall be prohibited from entering into a data use
3		agreement with any accredited post-secondary educational
4		institution or organization conducting research for a period of
5		12 months from the date of the discovery of the violation, and
6		all existing data use agreements shall be voided.
7		(Source: P.A. 84-712.)
8		Section 15. The Children's Privacy Protection and Parental
9		Empowerment Act is amended by changing Section 5 as follows:
10		(325 ILCS 17/5)
11		Sec. 5. Definitions. As used in this Act:
12		"Child" means a person under the age of 18 16. "Child" does
13		not include a minor emancipated by operation of law.
14		"Parent" means a parent, step-parent, or legal guardian.
15		"Personal information" means any of the following:
16		(1) A person's name.
17		(2) A person's address.
18		(3) A person's telephone number.
19		(4) A person's driver's license number or State of
20		Illinois identification card as assigned by the Illinois
21		Secretary of State or by a similar agency of another state.
22		(5) A person's social security number.
23		(6) Any other information that can be used to locate or
24		contact a specific individual.

HB0810 Engrossed - 47 - LRB099 04620 NHT 24649 b
1		"Personal information" does not include any of the
2		following:
3		(1) Public records as defined by Section 2 of the
4		Freedom of Information Act.
5		(2) Court records.
6		(3) Information found in publicly available sources,
7		including newspapers, magazines, and telephone
8		directories.
9		(4) Any other information that is not known to concern
10		a child.
11		(Source: P.A. 93-462, eff. 1-1-04.)