Bill Text: IL HB3606 | 2019-2020 | 101st General Assembly | Enrolled


Bill Title: Creates the Student Online Personal Protection Act of 2019. Provides for legislative intent and definitions. Provides for operator prohibitions, operator duties, school authority prohibitions, school authority duties, State Board of Education duties, and parent rights. Creates the Student Data Protection Oversight Committee and provides for the Committee's membership and support. Requires the Committee to submit an annual report to the General Assembly and the State Board of Education with recommendations, if any, for policy revisions and legislative amendments that would carry out the intent of the Act. Amends the Illinois School Student Records Act. Adds a definition of record. Requires written consent of a student's parent to publish student directories that list student names, addresses, and other identifying information and similar publications. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Repeals the Student Online Personal Protection Act. Effective immediately.

Spectrum: Partisan Bill (Democrat 40-1)

Status: (Enrolled) 2019-06-28 - Sent to the Governor [HB3606 Detail]

Download: Illinois-2019-HB3606-Enrolled.html



HB3606 EnrolledLRB101 09053 AXK 54146 b
1 AN ACT concerning education.
2 Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
4 Section 5. The Student Online Personal Protection Act is
5amended by changing Sections 5, 10, 15, and 30 and by adding
6Sections 26, 27, 28, and 33 as follows:
7 (105 ILCS 85/5)
8 Sec. 5. Definitions. In this Act:
9 "Breach" means the unauthorized acquisition of
10computerized data that compromises the security,
11confidentiality, or integrity of covered information
12maintained by an operator or school. "Breach" does not include
13the good faith acquisition of personal information by an
14employee or agent of an operator or school for a legitimate
15purpose of the operator or school if the covered information is
16not used for a purpose prohibited by this Act or subject to
17further unauthorized disclosure.
18 "Covered information" means personally identifiable
19information or material or information that is linked to
20personally identifiable information or material in any media or
21format that is not publicly available and is any of the
22following:
23 (1) Created by or provided to an operator by a student

HB3606 Enrolled- 2 -LRB101 09053 AXK 54146 b
1 or the student's parent or legal guardian in the course of
2 the student's or , parent's, or legal guardian's use of the
3 operator's site, service, or application for K through 12
4 school purposes.
5 (2) Created by or provided to an operator by an
6 employee or agent of a school or school district for K
7 through 12 school purposes.
8 (3) Gathered by an operator through the operation of
9 its site, service, or application for K through 12 school
10 purposes and personally identifies a student, including,
11 but not limited to, information in the student's
12 educational record or electronic mail, first and last name,
13 home address, telephone number, electronic mail address,
14 or other information that allows physical or online
15 contact, discipline records, test results, special
16 education data, juvenile dependency records, grades,
17 evaluations, criminal records, medical records, health
18 records, a social security number, biometric information,
19 disabilities, socioeconomic information, food purchases,
20 political affiliations, religious information, text
21 messages, documents, student identifiers, search activity,
22 photos, voice recordings, or geolocation information.
23 "Interactive computer service" has the meaning ascribed to
24that term in Section 230 of the federal Communications Decency
25Act of 1996 (47 U.S.C. 230).
26 "K through 12 school purposes" means purposes that are

HB3606 Enrolled- 3 -LRB101 09053 AXK 54146 b
1directed by or that customarily take place at the direction of
2a school, teacher, or school district; aid in the
3administration of school activities, including, but not
4limited to, instruction in the classroom or at home,
5administrative activities, and collaboration between students,
6school personnel, or parents; or are otherwise for the use and
7benefit of the school.
8 "Longitudinal data system" has the meaning given to that
9term under the P-20 Longitudinal Education Data System Act.
10 "Operator" means, to the extent that an entity is operating
11in this capacity, the operator of an Internet website, online
12service, online application, or mobile application with actual
13knowledge that the site, service, or application is used
14primarily for K through 12 school purposes and was designed and
15marketed for K through 12 school purposes.
16 "Parent" has the meaning given to that term under the
17Illinois School Student Records Act.
18 "School" means (1) any preschool, public kindergarten,
19elementary or secondary educational institution, vocational
20school, special educational facility, or any other elementary
21or secondary educational agency or institution or (2) any
22person, agency, or institution that maintains school student
23records from more than one school. Except as otherwise provided
24in this Act, "school" "School" includes a private or nonpublic
25school.
26 "State Board" means the State Board of Education.

HB3606 Enrolled- 4 -LRB101 09053 AXK 54146 b
1 "Student" has the meaning given to that term under the
2Illinois School Student Records Act.
3 "Targeted advertising" means presenting advertisements to
4a student where the advertisement is selected based on
5information obtained or inferred over time from that student's
6online behavior, usage of applications, or covered
7information. The term does not include advertising to a student
8at an online location based upon that student's current visit
9to that location or in response to that student's request for
10information or feedback, without the retention of that
11student's online activities or requests over time for the
12purpose of targeting subsequent ads.
13(Source: P.A. 100-315, eff. 8-24-17.)
14 (105 ILCS 85/10)
15 Sec. 10. Operator prohibitions. An operator shall not
16knowingly do any of the following:
17 (1) Engage in targeted advertising on the operator's
18 site, service, or application or target advertising on any
19 other site, service, or application if the targeting of the
20 advertising is based on any information, including covered
21 information and persistent unique identifiers, that the
22 operator has acquired because of the use of that operator's
23 site, service, or application for K through 12 school
24 purposes.
25 (2) Use information, including persistent unique

HB3606 Enrolled- 5 -LRB101 09053 AXK 54146 b
1 identifiers, created or gathered by the operator's site,
2 service, or application to amass a profile about a student,
3 except in furtherance of K through 12 school purposes.
4 "Amass a profile" does not include the collection and
5 retention of account information that remains under the
6 control of the student, the student's parent or legal
7 guardian, or the school.
8 (3) Sell or rent a student's information, including
9 covered information. This subdivision (3) does not apply to
10 the purchase, merger, or other type of acquisition of an
11 operator by another entity if the operator or successor
12 entity complies with this Act regarding previously
13 acquired student information.
14 (4) Except as otherwise provided in Section 20 of this
15 Act, disclose covered information, unless the disclosure
16 is made for the following purposes:
17 (A) In furtherance of the K through 12 school
18 purposes of the site, service, or application if the
19 recipient of the covered information disclosed under
20 this clause (A) does not further disclose the
21 information, unless done to allow or improve
22 operability and functionality of the operator's site,
23 service, or application.
24 (B) To ensure legal and regulatory compliance or
25 take precautions against liability.
26 (C) To respond to the judicial process.

HB3606 Enrolled- 6 -LRB101 09053 AXK 54146 b
1 (D) To protect the safety or integrity of users of
2 the site or others or the security of the site,
3 service, or application.
4 (E) For a school, educational, or employment
5 purpose requested by the student or the student's
6 parent or legal guardian, provided that the
7 information is not used or further disclosed for any
8 other purpose.
9 (F) To a third party if the operator contractually
10 prohibits the third party from using any covered
11 information for any purpose other than providing the
12 contracted service to or on behalf of the operator,
13 prohibits the third party from disclosing any covered
14 information provided by the operator with subsequent
15 third parties, and requires the third party to
16 implement and maintain reasonable security procedures
17 and practices as required under Section 15.
18 Nothing in this Section prohibits the operator's use of
19information for maintaining, developing, supporting,
20improving, or diagnosing the operator's site, service, or
21application.
22(Source: P.A. 100-315, eff. 8-24-17.)
23 (105 ILCS 85/15)
24 Sec. 15. Operator duties. An operator shall do the
25following:

HB3606 Enrolled- 7 -LRB101 09053 AXK 54146 b
1 (1) Implement and maintain reasonable security
2 procedures and practices that otherwise meet or exceed
3 industry standards appropriate to the nature of the covered
4 information and designed to protect that covered
5 information from unauthorized access, destruction, use,
6 modification, or disclosure.
7 (2) Delete, within a reasonable time period, a
8 student's covered information if the school or school
9 district requests deletion of covered information under
10 the control of the school or school district, unless a
11 student or his or her parent or legal guardian consents to
12 the maintenance of the covered information.
13 (3) Publicly disclose material information about its
14 collection, use, and disclosure of covered information,
15 including, but not limited to, publishing a terms of
16 service agreement, privacy policy, or similar document.
17 (4) Except for a nonpublic school, for any operator who
18 seeks to receive from a school, school district, or the
19 State Board in any manner any covered information, enter
20 into a written agreement with the school, school district,
21 or State Board before the covered information may be
22 transferred. The written agreement may be created in
23 electronic form and signed with an electronic or digital
24 signature or may be a click wrap agreement that is used
25 with software licenses, downloaded or online applications
26 and transactions for educational technologies, or other

HB3606 Enrolled- 8 -LRB101 09053 AXK 54146 b
1 technologies in which a user must agree to terms and
2 conditions before using the product or service. Any written
3 agreement entered into, amended, or renewed must contain
4 all of the following:
5 (A) A listing of the categories or types of covered
6 information to be provided to the operator.
7 (B) A statement of the product or service being
8 provided to the school by the operator.
9 (C) A statement that, pursuant to the federal
10 Family Educational Rights and Privacy Act of 1974, the
11 operator is acting as a school official with a
12 legitimate educational interest, is performing an
13 institutional service or function for which the school
14 would otherwise use employees, under the direct
15 control of the school, with respect to the use and
16 maintenance of covered information, and is using the
17 covered information only for an authorized purpose and
18 may not re-disclose it to third parties or affiliates,
19 unless otherwise permitted under this Act, without
20 permission from the school or pursuant to court order.
21 (D) A description of how, if a breach is attributed
22 to the operator, any costs and expenses incurred by the
23 school in investigating and remediating the breach
24 will be allocated between the operator and the school.
25 The costs and expenses may include, but are not limited
26 to:

HB3606 Enrolled- 9 -LRB101 09053 AXK 54146 b
1 (i) providing notification to the parents of
2 those students whose covered information was
3 compromised and to regulatory agencies or other
4 entities as required by law or contract;
5 (ii) providing credit monitoring to those
6 students whose covered information was exposed in
7 a manner during the breach that a reasonable person
8 would believe that it could impact his or her
9 credit or financial security;
10 (iii) legal fees, audit costs, fines, and any
11 other fees or damages imposed against the school as
12 a result of the security breach; and
13 (iv) providing any other notifications or
14 fulfilling any other requirements adopted by the
15 State Board or of any other State or federal laws.
16 (E) A statement that the operator must delete or
17 transfer to the school all covered information if the
18 information is no longer needed for the purposes of the
19 written agreement and to specify the time period in
20 which the information must be deleted or transferred
21 once the operator is made aware that the information is
22 no longer needed for the purposes of the written
23 agreement.
24 (F) If the school maintains a website, a statement
25 that the school must publish the written agreement on
26 the school's website. If the school does not maintain a

HB3606 Enrolled- 10 -LRB101 09053 AXK 54146 b
1 website, a statement that the school must make the
2 written agreement available for inspection by the
3 general public at its administrative office. If
4 mutually agreed upon by the school and the operator,
5 provisions of the written agreement, other than those
6 under subparagraphs (A), (B), and (C), may be redacted
7 in the copy of the written agreement published on the
8 school's website or made available at its
9 administrative office.
10 (5) In case of any breach, within the most expedient
11 time possible and without unreasonable delay, but no later
12 than 30 calendar days after the determination that a breach
13 has occurred, notify the school of any breach of the
14 students' covered information.
15 (6) Except for a nonpublic school, provide to the
16 school a list of any third parties or affiliates to whom
17 the operator is currently disclosing covered information
18 or has disclosed covered information. This list must, at a
19 minimum, be updated and provided to the school by the
20 beginning of each State fiscal year and at the beginning of
21 each calendar year.
22(Source: P.A. 100-315, eff. 8-24-17.)
23 (105 ILCS 85/26 new)
24 Sec. 26. School prohibitions. A school may not do either of
25the following:

HB3606 Enrolled- 11 -LRB101 09053 AXK 54146 b
1 (1) Sell, rent, lease, or trade covered information.
2 (2) Share, transfer, disclose, or provide access to a
3 student's covered information to an entity or individual,
4 other than the student's parent, school personnel,
5 appointed or elected school board members or local school
6 council members, or the State Board, without a written
7 agreement, unless the disclosure or transfer is:
8 (A) to the extent permitted by State or federal
9 law, to law enforcement officials to protect the safety
10 of users or others or the security or integrity of the
11 operator's service;
12 (B) required by court order or State or federal
13 law; or
14 (C) to ensure legal or regulatory compliance.
15 This paragraph (2) does not apply to nonpublic schools.
16 (105 ILCS 85/27 new)
17 Sec. 27. School duties.
18 (a) Each school shall post and maintain on its website or,
19if the school does not maintain a website, make available for
20inspection by the general public at its administrative office
21all of the following information:
22 (1) An explanation, that is clear and understandable by
23 a layperson, of the data elements of covered information
24 that the school collects, maintains, or discloses to any
25 person, entity, third party, or governmental agency. The

HB3606 Enrolled- 12 -LRB101 09053 AXK 54146 b
1 information must explain how the school uses, to whom or
2 what entities it discloses, and for what purpose it
3 discloses the covered information.
4 (2) A list of operators that the school has written
5 agreements with, a copy of each written agreement, and a
6 business address for each operator. A copy of a written
7 agreement posted or made available by a school under this
8 paragraph may contain redactions, as provided under
9 subparagraph (F) of paragraph (4) of Section 15.
10 (3) For each operator, a list of any subcontractors to
11 whom covered information may be disclosed or a link to a
12 page on the operator's website that clearly lists that
13 information, as provided by the operator to the school
14 under paragraph (6) of Section 15.
15 (4) A written description of the procedures that a
16 parent may use to carry out the rights enumerated under
17 Section 33.
18 (5) A list of any breaches of covered information
19 maintained by the school or breaches under Section 15 that
20 includes, but is not limited to, all of the following
21 information:
22 (A) The number of students whose covered
23 information is involved in the breach, unless
24 disclosing that number would violate the provisions of
25 the Personal Information Protection Act.
26 (B) The date, estimated date, or estimated date

HB3606 Enrolled- 13 -LRB101 09053 AXK 54146 b
1 range of the breach.
2 (C) For a breach under Section 15, the name of the
3 operator.
4 The school may omit from the list required under this
5 paragraph (5) (i) any breach in which, to the best of the
6 school's knowledge at the time of updating the list, the
7 number of students whose covered information is involved in
8 the breach is less than 10% of the school's enrollment,
9 (ii) any breach in which, at the time of posting the list,
10 the school is not required to notify the parent of a
11 student under subsection (d), (iii) any breach in which the
12 date, estimated date, or estimated date range in which it
13 occurred is earlier than July 1, 2021, or (iv) any breach
14 previously posted on a list under this paragraph (5) no
15 more than 5 years prior to the school updating the current
16 list.
17 The school must, at a minimum, update the items under
18paragraphs (1), (3), (4), and (5) no later than 30 calendar
19days following the start of a fiscal year and no later than 30
20days following the beginning of a calendar year.
21 (b) Each school must adopt a policy for designating which
22school employees are authorized to enter into written
23agreements with operators. This subsection may not be construed
24to limit individual school employees outside of the scope of
25their employment from entering into agreements with operators
26on their own behalf and for non-K through 12 school purposes,

HB3606 Enrolled- 14 -LRB101 09053 AXK 54146 b
1provided that no covered information is provided to the
2operators. Any agreement or contract entered into in violation
3of this Act is void and unenforceable as against public policy.
4 (c) A school must post on its website or, if the school
5does not maintain a website, make available at its
6administrative office for inspection by the general public each
7written agreement entered into under this Act, along with any
8information required under subsection (a), no later than 10
9business days after entering into the agreement.
10 (d) After receipt of notice of a breach under Section 15 or
11determination of a breach of covered information maintained by
12the school, a school shall notify, no later than 30 calendar
13days after receipt of the notice or determination that a breach
14has occurred, the parent of any student whose covered
15information is involved in the breach. The notification must
16include, but is not limited to, all of the following:
17 (1) The date, estimated date, or estimated date range
18 of the breach.
19 (2) A description of the covered information that was
20 compromised or reasonably believed to have been
21 compromised in the breach.
22 (3) Information that the parent may use to contact the
23 operator and school to inquire about the breach.
24 (4) The toll-free numbers, addresses, and websites for
25 consumer reporting agencies.
26 (5) The toll-free number, address, and website for the

HB3606 Enrolled- 15 -LRB101 09053 AXK 54146 b
1 Federal Trade Commission.
2 (6) A statement that the parent may obtain information
3 from the Federal Trade Commission and consumer reporting
4 agencies about fraud alerts and security freezes.
5 A notice of breach required under this subsection may be
6delayed if an appropriate law enforcement agency determines
7that the notification will interfere with a criminal
8investigation and provides the school with a written request
9for a delay of notice. A school must comply with the
10notification requirements as soon as the notification will no
11longer interfere with the investigation.
12 (e) Each school must implement and maintain reasonable
13security procedures and practices that otherwise meet or exceed
14industry standards designed to protect covered information
15from unauthorized access, destruction, use, modification, or
16disclosure. Any written agreement under which the disclosure of
17covered information between the school and a third party takes
18place must include a provision requiring the entity to whom the
19covered information is disclosed to implement and maintain
20reasonable security procedures and practices that otherwise
21meet or exceed industry standards designed to protect covered
22information from unauthorized access, destruction, use,
23modification, or disclosure. The State Board must make
24available on its website a guidance document for schools
25pertaining to reasonable security procedures and practices
26under this subsection.

HB3606 Enrolled- 16 -LRB101 09053 AXK 54146 b
1 (f) Each school may designate an appropriate staff person
2as a privacy officer, who may also be an official records
3custodian as designated under the Illinois School Student
4Records Act, to carry out the duties and responsibilities
5assigned to schools and to ensure compliance with the
6requirements of this Section and Section 26.
7 (g) A school shall make a request, pursuant to paragraph
8(2) of Section 15, to an operator to delete covered information
9on behalf of a student's parent if the parent requests from the
10school that the student's covered information held by the
11operator be deleted, so long as the deletion of the covered
12information is not in violation of State or federal records
13laws.
14 (h) This Section does not apply to nonpublic schools.
15 (105 ILCS 85/28 new)
16 Sec. 28. State Board duties.
17 (a) The State Board may not sell, rent, lease, or trade
18covered information.
19 (b) Except for an employee of the State Board or a State
20Board official acting within his or her official capacity, the
21State Board may not share, transfer, disclose, or provide
22covered information to an entity or individual without a
23contract or written agreement, except for disclosures required
24by State or federal law.
25 (c) At least once annually, the State Board must publish

HB3606 Enrolled- 17 -LRB101 09053 AXK 54146 b
1and maintain on its website a list of all of the entities or
2individuals, including, but not limited to, operators,
3individual researchers, research organizations, institutions
4of higher education, or government agencies, that the State
5Board contracts with or has written agreements with and that
6hold covered information and a copy of each contract or written
7agreement. The list must include all of the following
8information:
9 (1) The name of the entity or individual. In naming an
10 individual, the list must include the entity that sponsors
11 the individual or with which the individual is affiliated,
12 if any. If the individual is conducting research at an
13 institution of higher education, the list may include the
14 name of that institution and a contact person in the
15 department that is associated with the research in lieu of
16 the name of the researcher. If the entity is an operator,
17 the list must include its business address.
18 (2) The purpose and scope of the contract or agreement.
19 (3) The duration of the contract or agreement.
20 (4) The types of covered information that the entity or
21 individual holds under the contract or agreement.
22 (5) The use of the covered information under the
23 contract or agreement.
24 (6) The length of time for which the entity or
25 individual may hold the covered information.
26 (7) A list of any subcontractors to whom covered

HB3606 Enrolled- 18 -LRB101 09053 AXK 54146 b
1 information may be disclosed under Section 15 or a link to
2 a page on the operator's website that clearly lists that
3 information.
4 If mutually agreed upon by the State Board and the
5operator, provisions of a contract or written agreement, other
6than those pertaining to paragraphs (1) through (7), may be
7redacted on the State Board's website.
8 (d) The State Board shall create, publish, and make
9publicly available an inventory, along with a dictionary or
10index of data elements and their definitions, of covered
11information collected or maintained by the State Board,
12including, but not limited to, both of the following:
13 (1) Covered information that schools are required to
14 report to the State Board by State or federal law.
15 (2) Covered information in the State longitudinal data
16 system or any data warehouse used by the State Board to
17 populate the longitudinal data system.
18 The inventory shall make clear for what purposes the State
19Board uses the covered information.
20 (e) The State Board shall develop, publish, and make
21publicly available, for the benefit of schools, model student
22data privacy policies and procedures that comply with relevant
23State and federal law, including, but not limited to, a model
24notice that schools must use to provide notice to parents and
25students about operators. The notice must state, in general
26terms, the types of student data that are collected by the

HB3606 Enrolled- 19 -LRB101 09053 AXK 54146 b
1schools and shared with operators under this Act and the
2purposes of collecting and using the student data. After
3creation of the notice under this subsection, a school shall,
4at the beginning of each school year, provide the notice to
5parents by the same means generally used to send notices to
6them. This subsection does not apply to nonpublic schools.
7 (105 ILCS 85/30)
8 Sec. 30. Applicability. This Act does not do any of the
9following:
10 (1) Limit the authority of a law enforcement agency to
11 obtain any content or information from an operator as
12 authorized by law or under a court order.
13 (2) Limit the ability of an operator to use student
14 data, including covered information, for adaptive learning
15 or customized student learning purposes.
16 (3) Apply to general audience Internet websites,
17 general audience online services, general audience online
18 applications, or general audience mobile applications,
19 even if login credentials created for an operator's site,
20 service, or application may be used to access those general
21 audience sites, services, or applications.
22 (4) Limit service providers from providing Internet
23 connectivity to schools or students and their families.
24 (5) Prohibit an operator of an Internet website, online
25 service, online application, or mobile application from

HB3606 Enrolled- 20 -LRB101 09053 AXK 54146 b
1 marketing educational products directly to parents if the
2 marketing did not result from the use of covered
3 information obtained by the operator through the provision
4 of services covered under this Act.
5 (6) Impose a duty upon a provider of an electronic
6 store, gateway, marketplace, or other means of purchasing
7 or downloading software or applications to review or
8 enforce compliance with this Act on those applications or
9 software.
10 (7) Impose a duty upon a provider of an interactive
11 computer service to review or enforce compliance with this
12 Act by third-party content providers.
13 (8) Prohibit students from downloading, exporting,
14 transferring, saving, or maintaining their own student
15 data or documents.
16 (9) Supersede the federal Family Educational Rights
17 and Privacy Act of 1974, or rules adopted pursuant to that
18 Act or the Illinois School Student Records Act, or any
19 rules adopted pursuant to those Acts.
20 (10) Prohibit an operator or school from producing and
21 distributing, free or for consideration, student class
22 photos and yearbooks to the school, students, parents, or
23 individuals authorized by parents and to no others, in
24 accordance with the terms of a written agreement between
25 the operator and the school.
26(Source: P.A. 100-315, eff. 8-24-17.)

HB3606 Enrolled- 21 -LRB101 09053 AXK 54146 b
1 (105 ILCS 85/33 new)
2 Sec. 33. Parent and student rights.
3 (a) A student's covered information shall be collected only
4for K through 12 school purposes and not further processed in a
5manner that is incompatible with those purposes.
6 (b) A student's covered information shall only be adequate,
7relevant, and limited to what is necessary in relation to the K
8through 12 school purposes for which it is processed.
9 (c) Except for a parent of a student enrolled in a
10nonpublic school, the parent of a student enrolled in a school
11has the right to all of the following:
12 (1) Inspect and review the student's covered
13 information, regardless of whether it is maintained by the
14 school, the State Board, or an operator.
15 (2) Request from a school a paper or electronic copy of
16 the student's covered information, including covered
17 information maintained by an operator or the State Board.
18 If a parent requests an electronic copy of the student's
19 covered information under this paragraph, the school must
20 provide an electronic copy of that information, unless the
21 school does not maintain the information in an electronic
22 format and reproducing the information in an electronic
23 format would be unduly burdensome to the school. If a
24 parent requests a paper copy of the student's covered
25 information, the school may charge the parent the

HB3606 Enrolled- 22 -LRB101 09053 AXK 54146 b
1 reasonable cost for copying the information in an amount
2 not to exceed the amount fixed in a schedule adopted by the
3 State Board, except that no parent may be denied a copy of
4 the information due to the parent's inability to bear the
5 cost of the copying. The State Board must adopt rules on
6 the methodology and frequency of requests under this
7 paragraph.
8 (3) Request corrections of factual inaccuracies
9 contained in the student's covered information. After
10 receiving a request for corrections and determining that a
11 factual inaccuracy exists, a school must do either of the
12 following:
13 (A) If the school maintains or possesses the
14 covered information that contains the factual
15 inaccuracy, correct the factual inaccuracy and confirm
16 the correction with the parent within 90 calendar days
17 after receiving the parent's request.
18 (B) If the operator or State Board maintains or
19 possesses the covered information that contains the
20 factual inaccuracy, notify the operator or the State
21 Board of the correction. The operator or the State
22 Board must correct the factual inaccuracy and confirm
23 the correction with the school within 90 calendar days
24 after receiving the notice. Within 10 business days
25 after receiving confirmation of the correction from
26 the operator or State Board, the school must confirm

HB3606 Enrolled- 23 -LRB101 09053 AXK 54146 b
1 the correction with the parent.
2 (d) Nothing in this Section shall be construed to limit the
3rights granted to parents and students under the Illinois
4School Student Records Act or the federal Family Educational
5Rights and Privacy Act of 1974.
feedback