Bill Text: IL SB2089 | 2019-2020 | 101st General Assembly | Introduced

---

Bill Title: Creates the Student Online Personal Protection Act of 2019. Provides for legislative intent and definitions. Provides for operator prohibitions, operator duties, school authority prohibitions, school authority duties, State Board of Education duties, and parent rights. Creates the Student Data Protection Oversight Committee and provides for the Committee's membership and support. Requires the Committee to submit an annual report to the General Assembly and the State Board of Education with recommendations, if any, for policy revisions and legislative amendments that would carry out the intent of the Act. Amends the Illinois School Student Records Act. Adds a definition of record. Requires written consent of a student's parent to publish student directories that list student names, addresses, and other identifying information and similar publications. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Repeals the Student Online Personal Protection Act. Effective immediately.

Spectrum: Partisan Bill (Democrat 11-0)

Status: (Failed) 2021-01-13 - Session Sine Die [SB2089 Detail]

Download: Illinois-2019-SB2089-Introduced.html

---

101ST GENERAL ASSEMBLY State of Illinois 2019 and 2020 SB2089 Introduced 2/15/2019, by Sen. Omar Aquino SYNOPSIS AS INTRODUCED:
New Act
105 ILCS 10/2 from Ch. 122, par. 50-2
105 ILCS 10/6 from Ch. 122, par. 50-6
105 ILCS 85/Act rep.
815 ILCS 505/2Z from Ch. 121 1/2, par. 262Z
Creates the Student Online Personal Protection Act of 2019. Provides for legislative intent and definitions. Provides for operator prohibitions, operator duties, school authority prohibitions, school authority duties, State Board of Education duties, and parent rights. Creates the Student Data Protection Oversight Committee and provides for the Committee's membership and support. Requires the Committee to submit an annual report to the General Assembly and the State Board of Education with recommendations, if any, for policy revisions and legislative amendments that would carry out the intent of the Act. Amends the Illinois School Student Records Act. Adds a definition of record. Requires written consent of a student's parent to publish student directories that list student names, addresses, and other identifying information and similar publications. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Repeals the Student Online Personal Protection Act. Effective immediately.
LRB101 09671 AXK 54770 b
FISCAL NOTE ACT MAY APPLY STATE MANDATES ACT MAY REQUIRE REIMBURSEMENT
A BILL FOR
SB2089 LRB101 09671 AXK 54770 b
AN ACT concerning education.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 1. Short title. This Act may be cited as the
Student Online Personal Protection Act of 2019.
Section 5. Legislative intent. Schools today are
increasingly using a wide range of technologies to help
students learn, but concerns have been raised about whether
sufficient safeguards exist to protect the privacy and security
of data about students and their families. This Act is intended
to ensure that students' and families' data will be protected,
safeguarded, and kept private and disclosed only to appropriate
educational authorities or to properly authorized designees
under their control to serve the best interests of the student
and that no student shall be required to disclose data or be
required to consent to a school authority sharing covered
information with an operator in order to receive a free,
high-quality public education.
Section 10. Definitions. In this Act:
"Biometric information" has the meaning given to that term
under Section 10-20.40 of the School Code.
"Breach" means the unauthorized disclosure of data or

SB2089 - 2 - LRB101 09671 AXK 54770 b
unauthorized provision of physical or electronic means of
gaining access to data that compromises the security,
confidentiality, or integrity of covered information or a
school student record.
"Covered information" means any information or records
regarding a student or generated by a student collected by or
provided to an operator, school authority, or the State Board
of Education for or in connection with a school purpose,
including personally identifiable information and information
that is linked to personally identifiable information.
"Covered information" does not include aggregated information
or records to the extent no student may be individually
identified from the information or records in any manner or
other information or records that do not include personally
identifiable information or other data by which a student may
be identified in any manner. "Covered information" does include
aggregated information or records that are capable of being
de-aggregated or reconstructed to the point that any student
may be individually identified from the information or records.
"Criminal records" means any criminal record or criminal
history, including, but not limited to, juvenile delinquency
records.
"Destroy" means to remove covered information so that it is
permanently irretrievable in the normal course of business.
"Educational benefit" means an educational or
instructional program, service, curriculum, course, material,

SB2089 - 3 - LRB101 09671 AXK 54770 b
aid, or intervention provided by a school authority.
"Electronic network activity information" means any
information collected via the use of a technological device,
including keystroke log, browsing history, search history,
information regarding the user's interaction with a website,
application, or advertisement and any persistent identifiers
used to recognize a user over time and across different
websites or online services. Persistent identifiers may
include, but are not limited to, a user number held in a
cookie, an Internet Protocol address, a processor or device
serial number, or unique device identifier.
"Geolocation information" means information that (i) is
not the contents of a communication, (ii) is generated by or
derived from, in whole or in part, the operation of a
technological device, and (iii) is sufficient to determine or
infer the precise location of that device.
"Health information" means information or records about
the past, present, or future physical or mental health
condition or disability of a student or the provision of health
care or medical treatment of a student.
"Highly sensitive student information" means covered
information that includes, but is not limited to, all of the
following types of information:
(1) Criminal records.
(2) Disciplinary records.
(3) Health information.

SB2089 - 4 - LRB101 09671 AXK 54770 b
(4) Immigration and citizenship status.
(5) Information protected under the federal Protection
of Pupil Rights Amendment of 1978.
(6) Personally identifiable information.
(7) Geolocation information.
(8) Electronic network activity information.
(9) Photograph, video, or audio files in which the file
contains a student's image or voice.
"Longitudinal data system" has the meaning given to that
term under the P-20 Longitudinal Education Data System Act.
"Operator" means any entity that, for a fee or free of
charge:
(1) provides a product or service to a school authority
that collects, maintains, utilizes, or discloses covered
information;
(2) designs or markets a product or service for use by
a school authority or, with the school authority's or its
officials' involvement, by the student that collects,
maintains, utilizes, or discloses covered information; or
(3) knows or reasonably should know that a product or
service that collects, retains, or uses covered
information will be used for a school purpose.
"Parent" has the meaning given to that term in the Illinois
School Student Records Act.
"Personally identifiable information" means any data
concerning a student by which a student may be individually or

SB2089 - 5 - LRB101 09671 AXK 54770 b
personally identified and includes, but is not limited to, any
of the following:
(1) The student's name.
(2) The name of the student's parent or other family
members.
(3) The address of the student or the student's family.
(4) A personal identifier, such as the student's social
security number, student number, or biometric information.
(5) Other indirect identifiers, such as the student's
date of birth, place of birth, or mother's maiden name.
(6) Other information that, alone or in combination, is
linked or linkable to a specific student and that would
allow a reasonable person in the school community who does
not have personal knowledge of the relevant circumstances
to identify the student with reasonable certainty.
(7) Information requested by a person whom a school
reasonably believes knows the identity of the student to
whom the school student record relates.
"Profile" means a file or other mechanism used to collect
and retain, and that uses, covered information or other
information by which to identify or otherwise keep track of an
individual student or group of students.
"Publicly available" means information that is lawfully
made available from federal, State, or local government
records. "Publicly available" does not mean biometric
information collected by an operator about a student without

SB2089 - 6 - LRB101 09671 AXK 54770 b
the parent's knowledge. "Publicly available" does not include
information that is used for a purpose that is not compatible
with the purpose for which the data is maintained and made
available in the government records or for which it is publicly
maintained and aggregate information or information that is
de-identified in a manner that precludes the possibility of
re-identification.
"Record" has the meaning given to that term under the
Illinois School Student Records Act.
"School" means (i) any preschool, day care center, nursery,
kindergarten, elementary or secondary educational institution,
vocational school, or special educational facility or any other
elementary or secondary educational agency or institution or
(ii) any person, agency, or institution that maintains school
student records from more than one school. "School" includes a
private or nonpublic school.
"School authority" means any school board, school
district, board of directors, or other governing body of a
school established under the School Code or through any other
means.
"School purpose" means any activity that is directed by or
takes place at the direction of a school authority or its
employees or designees. "School purpose" does not include
advertising that is not otherwise specifically authorized in
this Act is not a school purpose.
"School student record" has the meaning given to that term

SB2089 - 7 - LRB101 09671 AXK 54770 b
under the Illinois School Student Records Act.
"State Board" means the State Board of Education.
"Student" has the meaning given to that term under the
Illinois School Student Records Act.
"Targeted advertising" means advertising to an individual
student or group of students in which the advertisements are
selected based on a known or assumed trait of the student or
group of students or information obtained or inferred from the
student's or group of students' online behavior within an
operator's product or service or the student's or group of
students' use of an operator's products or services, whether
over time or at the time of access. "Targeted advertising" does
not include providing a response to a request for information
or feedback or a recommendation from a student, provided the
response or recommendation is not determined in whole or in
part by payment or other consideration from a third party.
"Technological device" means any computer, cellular phone,
smart phone, digital camera, video camera, audio recording
device, radio frequency identification tag reader, or other
electronic device that can be used for creating, storing, or
transmitting information in the form of electronic data.
Section 15. Operator prohibitions. An operator may not do
any of the following:
(1) Sell, lease, or rent covered information.
(2) Disclose covered information to any person,

SB2089 - 8 - LRB101 09671 AXK 54770 b
entity, or third party other than the school authority or
State Board.
(3) Unless it is already publicly available, use,
disclose, or share covered information, including
de-identified or aggregated student information, for any
commercial purpose that is not a school purpose, including,
without limitation:
(A) to develop, maintain, support, improve,
evaluate, or diagnose the operator's software or
website;
(B) for adaptive learning purposes or customized
student learning;
(C) to provide recommendation engines to recommend
content or services;
(D) to demonstrate or market the effectiveness of
the operator's website, online service, or mobile
application; or
(E) for targeted advertising.
(4) Disclose or otherwise allow any third party to have
access to covered information, unless such disclosure is:
(A) made only in furtherance of a school purpose
with the school authority's prior consent and the
recipient of the covered information is legally
required to comply with this Act;
(B) to the extent permitted by federal law, to law
enforcement to protect the safety of users or others or

SB2089 - 9 - LRB101 09671 AXK 54770 b
the security or integrity of the operator's service;
(C) required by court order or State or federal
law;
(D) to ensure legal or regulatory compliance; or
(E) to a subcontractor, agent, independent
contractor or other entity hired by the operator for
the purpose of enabling the operator to meet its
contractual obligations to the school authority if
that entity first acknowledges in writing that it has
read and understands the requirements of this Act and
agrees in writing to be bound by its provisions and the
terms of any agreement entered into between the
operator and the school authority and a copy of that
written acknowledgment and agreement is provided to
the school authority.
Section 20. Operator duties. An operator must do the
following:
(1) For any operator who seeks to receive from a school
authority or the State Board in any manner any covered
information, enter into a written agreement with the school
authority before any covered information may be
transferred, which agreement must contain all of the
following:
(A) Provisions consistent with each prohibition or
requirement set forth in this Act.

SB2089 - 10 - LRB101 09671 AXK 54770 b
(B) A listing of the categories or types of covered
information to be provided to the operator.
(C) A statement of the product or service being
provided to the school authority by the operator.
(D) A statement that the operator is acting as a
school official with a legitimate educational
interest, is performing an institutional service or
function for which the school authority would
otherwise use employees, under the direct control of
the school authority, with respect to the use and
maintenance of covered information, and is using the
covered information for only an authorized purpose and
will not re-disclose it to third parties or affiliates,
unless otherwise permitted under this Act, without
permission from the school authority or pursuant to
court order.
(E) A description of the actions the operator will
take, including a description of the training the
operator will provide to anyone who receives or has
access to covered information, to ensure the security
and confidentiality of covered information. Compliance
with this subparagraph shall not, in itself, absolve
the operator of liability in the event of an
unauthorized disclosure of covered information.
(F) A statement that the operator will destroy or
transfer to the school authority all covered

SB2089 - 11 - LRB101 09671 AXK 54770 b
information if the information is no longer needed for
the purposes of the contract and to specify the time
period in which the information must be destroyed or
returned.
(G) A statement that the school authority will
publish the contract on the school authority's
website.
(H) A statement that the agreement is the entire
agreement with the school authority, including school
authority employees and other end users, and the
operator.
(2) For any operator with covered information in its
possession, implement and maintain security procedures and
practices designed to protect covered information from
unauthorized access, destruction, use, modification or
disclosure that, based on the sensitivity of the data and
the risk from unauthorized access (i) uses technologies and
methodologies that are consistent with the guidance issued
pursuant to the federal American Recovery and Reinvestment
Act of 2009, (ii) maintains technical safeguards as it
relates to the possession of covered information in a
manner consistent with the provisions of 45 CFR 164.312,
and (iii) otherwise meets or exceeds industry standards.
(3) Destroy, within a reasonable time period, a
student's covered information if the school authority
requests destruction of covered information under the

SB2089 - 12 - LRB101 09671 AXK 54770 b
control of the operator, unless the student's parent
consents in writing to the maintenance of the covered
information. A school authority shall make such a request
to the operator on behalf of a student's parent if the
parent requests that the student's covered information be
destroyed, if the destruction is not in violation of the
Illinois School Student Records Act.
(4) In the case of any breach, within the most
expedient time possible and without unreasonable delay,
but no later than 72 hours after the determination that a
breach has occurred, notify the school authority of the
breach of the school authority's student's covered
information.
(5) Permit a school authority or its designee to audit
and inspect, on an annual basis or after any breach, the
operator's practices with respect to any covered
information received by the operator from the school
authority or any student profiles, provided that this
requirement shall be satisfied if the operator provides the
school authority with an independent, third-party audit
acceptable to the school authority that has been conducted
within the previous 12 months or, in the case of a breach,
within 3 months after the breach.
(6) In the event of a breach resulting, in whole or in
part, from the operator's conduct, in addition to any other
remedies available to the school authority under law or

SB2089 - 13 - LRB101 09671 AXK 54770 b
equity, reimburse the school authority in full for all
reasonable costs and expenses incurred by the school
authority as a result of the operator's conduct in
investigating and remediating the breach, including, but
not limited to:
(A) providing notification to the parents of those
students whose covered information was compromised and
to regulatory agencies or other entities as required by
law or contract;
(B) providing one year of credit monitoring to
those students whose covered information was exposed
in such a manner during the breach that a reasonable
person would believe that it could impact his or her
credit or financial security;
(C) legal fees, audit costs, fines, and any other
fees or damages imposed against the school authority as
a result of the security breach; and
(D) providing any other notifications or
fulfilling any other requirements adopted by the State
Board or of any other State or federal laws.
Section 25. School authority prohibitions. A school
authority may not do any of the following:
(1) Access, search, read, inspect, copy, monitor, log
or otherwise use information transmitted via a
technological device unless it is owned by a school

SB2089 - 14 - LRB101 09671 AXK 54770 b
authority and the information is used for a school purpose.
Information obtained or collected in violation of this
paragraph must be promptly destroyed and may not be used by
a school authority in any legal proceeding, disciplinary
action, or administrative hearing or for any other purpose.
(2) Require that any student must, as part of any
applicable program, disclose highly sensitive student
information to an operator without prior written consent of
the student's parent, which must include an explanation
that is clear and understandable by a layperson of the data
elements of highly sensitive student information to be
shared and for what purpose and to whom it will be
disclosed.
(3) Withhold an educational benefit from or take a
punitive measure against a student or a student's parent
based in whole or in part upon the student's or parent's
(i) refusal to allow disclosure or sharing of covered
information to an operator, (ii) revocation of consent for
disclosure or sharing of covered information to an
operator, or (iii) request for destruction of covered
information maintained by an operator.
(4) Sell, rent, lease, or trade covered information.
(5) Share, transfer, disclose, or provide access to a
student's covered information to an entity or individual,
other than the student's parent or the State Board, without
a contract, unless such disclosure or transfer is:

SB2089 - 15 - LRB101 09671 AXK 54770 b
(A) to the extent permitted by federal law, to law
enforcement to protect the safety of users or others or
the security or integrity of the operator's service;
(B) required by court order or State or federal
law; or
(C) to ensure legal or regulatory compliance.
Section 30. School authority duties.
(a) Each school authority shall post and maintain on its
website all of the following information:
(1) An explanation that is clear and understandable by
a layperson of the data elements of covered information
that the school authority collects, maintains, or
discloses to any person, entity, third party, or
governmental agency. The information must explain how the
school authority uses, to whom it discloses, and for what
purpose it discloses the covered information.
(2) A list of operators that the school authority
contracts with, a copy of each contract, and a business
address and telephone number for each operator.
(3) For each operator, a list of any subcontractors to
whom covered information may be disclosed under Section 15.
(4) A written description of the procedures that a
parent may use to carry out the rights enumerated under
Section 40.
(5) An explanation that if a school authority does not

SB2089 - 16 - LRB101 09671 AXK 54770 b
comply with the requirements of this subsection, a parent
may submit a complaint with the State Board in accordance
with the complaint policy adopted under Section 35.
(b) Each school authority must adopt a policy regarding
school employees who are authorized to enter into contracts
with operators. A school authority must post on its website
each contract, along with the information under subsection (a)
before the contract is implemented and before any covered
information is disclosed to an operator. Any agreement or
contract entered into in violation of this Act shall be void
and unenforceable as against public policy. This subsection may
not be construed to limit individual school employees outside
of the scope of their employment from entering into agreements
with operators on their own behalf and for a non-school
purpose, provided that no covered information is provided to
the operators.
(c) Upon receipt of notice of a breach under Section 20 or
determination of a breach of covered information maintained by
the school authority, a school authority shall electronically
notify, no later than 72 hours after receipt of the notice or
determination that a breach has occurred, the parent of any
student whose covered information is involved in the breach.
The school authority must also post the notice on the school
authority's website. The notification must include, but is not
limited to, all of the following:
(1) The date, estimated date, or estimated date range

SB2089 - 17 - LRB101 09671 AXK 54770 b
of the breach.
(2) A description of the covered information that was
compromised or reasonably believed to have been
compromised in the breach.
(3) Information that the parent may use to contact the
operator and school authority to inquire about the breach.
(4) The toll-free numbers, addresses, and websites for
consumer reporting agencies.
(5) The toll-free number, address, and website for the
Federal Trade Commission.
(6) A statement that the parent may obtain information
from the Federal Trade Commission and credit reporting
agencies about fraud alerts and security freezes.
(d) Each school authority must implement and maintain
security procedures and practices designed to protect covered
information from unauthorized access, destruction, use,
modification, or disclosure that, based on the sensitivity of
the covered information and the risk from unauthorized access,
(i) use technologies and methodologies that are consistent with
the guidance issued pursuant to the federal American Recovery
and Reinvestment Act of 2009, (ii) maintain technical
safeguards as they relate to the possession of student records
in a manner consistent with the provisions of 45 CFR 164.312,
and (iii) otherwise meet or exceed industry standards.
(e) Each school authority shall designate an appropriate
staff person as a privacy officer, who may also be official

SB2089 - 18 - LRB101 09671 AXK 54770 b
records custodian as designated under the Illinois School
Student Records Act, to carry out the duties and
responsibilities assigned to school authorities and to ensure
compliance with the requirements under Sections 25 and 30.
Section 35. State Board duties.
(a) The State Board may not sell, rent, lease, or trade
covered information.
(b) The State Board may not share, transfer, disclose, or
provide covered information to an entity or individual without
a contract or agreement, with an exception for disclosures
required by federal law to federal agencies.
(c) The State Board must publish and maintain on its
website a list of all of the entities or individuals,
including, but not limited to, operators, individual
researchers, research organizations, institutions of higher
education, and government agencies, that the State Board
contracts with or has agreements with and that hold covered
information and a copy of each contract or agreement. The list
must include all of the following information:
(1) The name of the entity or individual. In naming an
individual, the list must include the entity that sponsors
the individual or with which the individual is affiliated,
if any. If the individual is conducting research at an
institution of higher education, the list may include the
name of that institution and a contact person in the

SB2089 - 19 - LRB101 09671 AXK 54770 b
department that is associated with the research in lieu of
the name of the researcher. If the entity is an operator,
the list must include a business address and telephone
number for the operator.
(2) The purpose and scope of the contract or agreement.
(3) The duration of the contract or agreement.
(4) The types of covered information that the entity or
individual holds under the contract or agreement.
(5) The use of the covered information under the
contract.
(6) The length of time for which the entity or
individual may hold the covered information.
(7) A list of any subcontractors to whom covered
information may be disclosed under Section 15.
(d) The State Board shall create, publish, and make
publicly available an inventory, along with a dictionary or
index of data elements and their definitions, of covered
information collected or maintained by the State Board,
including, but not limited to, both of the following:
(1) Covered information that school authorities are
required to report to the State Board by State or federal
law.
(2) Covered information in the State longitudinal data
system or any data warehouse used by the State Board to
populate the longitudinal data system.
The inventory shall make clear for what purposes the State

SB2089 - 20 - LRB101 09671 AXK 54770 b
Board uses the covered information.
(e) Within 180 days after the effective date of this Act,
the State Board shall develop, publish, and make publicly
available for the benefit of school authorities model student
data privacy policies and procedures that comply with relevant
State and federal law, including, but not limited to, all of
the following:
(1) A model notice that school authorities must use to
provide notice to parents and students about operators. The
notice must be titled "Student Data Shared With Operators"
and state, in general terms, the types of student data that
are collected by the school authority and shared with
operators under this Act and the purposes of collecting and
using the student data. Upon the creation of the notice
under this paragraph, a school authority shall, at the
beginning of each school year, provide the notice to
parents by the same means generally used to send notices to
them.
(2) A model consent form that school authorities may
use to obtain written consent from a parent to allow
disclosure of highly sensitive information to an operator,
as required under Section 25. The consent form must be
titled "Consent for Highly Sensitive Data Sharing with
Operators" and must include an explanation that is clear
and understandable by a layperson of the data elements of
highly sensitive student information to be shared and for

SB2089 - 21 - LRB101 09671 AXK 54770 b
what purpose and to whom it will be disclosed.
(f) The State Board must adopt, implement, and administer a
policy for hearing complaints from a parent regarding a school
authority's compliance with Sections 25 and 30. At a minimum,
the policy must provide a parent the opportunity to submit
information and receive a hearing from the State Board and must
require the State Board to take action on the parent's
complaint no later than 60 days after the hearing.
Section 40. Parent rights.
(a) A student's covered information is the sole property of
the student's parent.
(b) A student's covered information shall be collected only
for specified, explicit, and legitimate school purposes and not
further processed in a manner that is incompatible with those
purposes.
(c) A student's covered information shall only be adequate,
relevant, and limited to what is necessary in relation to the
school purpose for which it is processed.
(d) The parent of a student enrolled in a school has the
right to all of the following:
(1) Inspect and review the student's student data,
regardless of whether it is maintained by the school, the
school authority, the State Board, or an operator.
(2) Request from a school authority a paper or
electronic copy of the student's covered information,

SB2089 - 22 - LRB101 09671 AXK 54770 b
including covered information maintained by an operator or
the State Board. If a parent requests an electronic copy of
the student's covered information under this paragraph,
the school authority must provide an electronic copy of
that information unless the school authority does not
maintain the information in an electronic format and
reproducing the information in an electronic format would
be unduly burdensome to the school authority. If a parent
requests a paper copy of the student's covered information,
the school authority may charge the parent the reasonable
cost for copying the information in an amount not to exceed
the amount fixed in a schedule adopted by the State Board,
except that no parent may be denied a copy of the
information due to the parent's inability to bear the cost
of the copying.
(3) Request corrections of factual inaccuracies
contained in the student's covered information. After
receiving a request for corrections that documents a
factual inaccuracy, a school authority must complete
either of the following:
(A) Confirm the correction with the parent within
90 days after receiving the parent's request if the
school authority or State Board maintains the covered
information that contains the factual inaccuracy.
(B) Notify the operator who must confirm the
correction with the parent within 90 days after

SB2089 - 23 - LRB101 09671 AXK 54770 b
receiving the parent's request if the covered
information that contains the factual inaccuracy is
maintained by an operator.
(e) Nothing in this Act shall be construed to limit the
rights granted to parents and students under the Illinois
School Student Records Act.
Section 45. Right of action.
(a) Any person aggrieved by a violation of this Act shall
have a right of action in a State circuit court or as a
supplemental claim in federal district court against an
offending party. A prevailing party may recover for each
violation any of the following:
(1) Against a private entity that negligently violates
a provision of this Act, liquidated damages of $1,000 or
actual damages, whichever one is greater.
(2) Against a private entity that intentionally or
recklessly violates a provision of this Act, liquidated
damages of $5,000 or actual damages, whichever one is
greater.
(3) Reasonable attorney's fees and costs, including
expert witness fees and other litigation expenses.
(4) Other relief, including an injunction, as the State
or federal court deems appropriate.
(b) An individual who knowingly or intentionally permits
the unauthorized collecting, sharing, or using of covered

SB2089 - 24 - LRB101 09671 AXK 54770 b
information under this Act is guilty of a class A misdemeanor.
Section 50. Oversight.
(a) There is created a Student Data Protection Oversight
Committee that consists of all of the following members,
appointed by the State Board of Education:
(1) A high school student enrolled in a public school
in this State.
(2) A parent of a student in a school district
organized under Article 34 of the School Code.
(3) A parent of a student in a school district located
in Lake, Kane, Will, DuPage, McHenry, or Cook County, but
not in a school district organized under Article 34 of the
School Code.
(4) A parent of a student enrolled in a small, rural
school district.
(5) An expert in information technology systems.
(6) An expert in digital privacy law.
(7) A representative of a computer and information
technology trade group.
(8) A representative of a civil rights advocacy
organization.
(9) A representative of a different civil rights or a
privacy rights advocacy organization.
(10) A representative of an association representing
principals in a city having a population exceeding 500,000.

SB2089 - 25 - LRB101 09671 AXK 54770 b
(11) A representative of a statewide association
representing school administrators.
(12) A representative of a statewide professional
teachers' organization.
(13) A representative of a different statewide
professional teachers' organization.
(14) A representative of a professional teachers'
organization in a city having a population exceeding
500,000.
(15) A representative of a statewide association
representing school boards.
(16) A representative of a school district organized
under Article 34 of the School Code.
(17) The Attorney General or his or her designee.
(18) The State Superintendent of Education or his or
her designee.
The State Board, in consultation with the Committee, may
appoint no more than 2 additional individuals to the Committee
who shall serve in an advisory role and may not have voting or
other decision-making rights.
(b) The Committee shall initially meet at the call of the
Governor, at which meeting it shall designate a chairperson.
The Committee shall meet thereafter at the call of the
chairperson, but no less than 4 times within one year after the
effective date of this Act and at least once per year
thereafter to review existing laws and federal regulations on

SB2089 - 26 - LRB101 09671 AXK 54770 b
covered information in light of technological and legal
developments. The Committee shall serve without compensation
but may be reimbursed for reasonable and necessary expenses
incurred in performing their duties from funds appropriated to
the State Board for that purpose. The State Board must provide
administrative and other support to the Committee. The
Committee shall submit an annual report to the General Assembly
and the State Board no later than December 15, 2019 and each
December 15 thereafter with recommendations, if any, for policy
revisions and legislative amendments that would carry out the
intent of this Act. The Committee is subject to the Open
Meetings Act.
Section 100. Severability. The provisions of this Act are
severable under Section 1.31 of the Statute on Statutes.
Section 105. The Illinois School Student Records Act is
amended by changing Sections 2 and 6 as follows:
(105 ILCS 10/2) (from Ch. 122, par. 50-2)
Sec. 2. As used in this Act,
(a) "Student" means any person enrolled or previously
enrolled in a school.
(b) "School" means any public preschool, day care center,
kindergarten, nursery, elementary or secondary educational
institution, vocational school, special educational facility

SB2089 - 27 - LRB101 09671 AXK 54770 b
or any other elementary or secondary educational agency or
institution and any person, agency or institution which
maintains school student records from more than one school, but
does not include a private or non-public school.
(c) "State Board" means the State Board of Education.
(d) "School Student Record" means any writing or other
recorded information concerning a student and by which a
student may be individually identified or personally
identified that is , maintained by a school or at its direction
or by an employee of a school, regardless of how or where the
information is stored. The following shall not be deemed school
student records under this Act: writings or other recorded
information maintained by an employee of a school or other
person at the direction of a school for his or her exclusive
use; provided that all such writings and other recorded
information are destroyed not later than the student's
graduation or permanent withdrawal from the school; and
provided further that no such records or recorded information
may be released or disclosed to any person except a person
designated by the school as a substitute unless they are first
incorporated in a school student record and made subject to all
of the provisions of this Act. School student records shall not
include information maintained by law enforcement
professionals working in the school.
(e) "Student Permanent Record" means the minimum personal
information necessary to a school in the education of the

SB2089 - 28 - LRB101 09671 AXK 54770 b
student and contained in a school student record. Such
information may include the student's name, birth date,
address, grades and grade level, parents' names and addresses,
attendance records, and such other entries as the State Board
may require or authorize.
(f) "Student Temporary Record" means all information
contained in a school student record but not contained in the
student permanent record. Such information may include family
background information, intelligence test scores, aptitude
test scores, psychological and personality test results,
teacher evaluations, and other information of clear relevance
to the education of the student, all subject to regulations of
the State Board. The information shall include information
provided under Section 8.6 of the Abused and Neglected Child
Reporting Act. In addition, the student temporary record shall
include information regarding serious disciplinary infractions
that resulted in expulsion, suspension, or the imposition of
punishment or sanction. For purposes of this provision, serious
disciplinary infractions means: infractions involving drugs,
weapons, or bodily harm to another.
(g) "Parent" means a person who is the natural parent of
the student or other person who has the primary responsibility
for the care and upbringing of the student. All rights and
privileges accorded to a parent under this Act shall become
exclusively those of the student upon his 18th birthday,
graduation from secondary school, marriage or entry into

SB2089 - 29 - LRB101 09671 AXK 54770 b
military service, whichever occurs first. Such rights and
privileges may also be exercised by the student at any time
with respect to the student's permanent school record.
(h) "Record" means any information maintained in any way,
including, but not limited to, electronically-generated data,
handwriting, print, computer media, video or audio tape, film,
microfilm, and microfiche.
(Source: P.A. 92-295, eff. 1-1-02.)
(105 ILCS 10/6) (from Ch. 122, par. 50-6)
Sec. 6. (a) No school student records or information
contained therein may be released, transferred, disclosed or
otherwise disseminated, except as follows:
(1) to a parent or student or person specifically
designated as a representative by a parent, as provided in
paragraph (a) of Section 5;
(2) to an employee or official of the school or school
district or State Board with current demonstrable
educational or administrative interest in the student, in
furtherance of such interest;
(3) to the official records custodian of another school
within Illinois or an official with similar
responsibilities of a school outside Illinois, in which the
student has enrolled, or intends to enroll, upon the
request of such official or student;
(4) to any person for the purpose of research,

SB2089 - 30 - LRB101 09671 AXK 54770 b
statistical reporting, or planning, provided that such
research, statistical reporting, or planning is
permissible under and undertaken in accordance with the
federal Family Educational Rights and Privacy Act (20
U.S.C. 1232g);
(5) pursuant to a court order, provided that the parent
shall be given prompt written notice upon receipt of such
order of the terms of the order, the nature and substance
of the information proposed to be released in compliance
with such order and an opportunity to inspect and copy the
school student records and to challenge their contents
pursuant to Section 7;
(6) to any person as specifically required by State or
federal law;
(6.5) to juvenile authorities when necessary for the
discharge of their official duties who request information
prior to adjudication of the student and who certify in
writing that the information will not be disclosed to any
other party except as provided under law or order of court.
For purposes of this Section "juvenile authorities" means:
(i) a judge of the circuit court and members of the staff
of the court designated by the judge; (ii) parties to the
proceedings under the Juvenile Court Act of 1987 and their
attorneys; (iii) probation officers and court appointed
advocates for the juvenile authorized by the judge hearing
the case; (iv) any individual, public or private agency

SB2089 - 31 - LRB101 09671 AXK 54770 b
having custody of the child pursuant to court order; (v)
any individual, public or private agency providing
education, medical or mental health service to the child
when the requested information is needed to determine the
appropriate service or treatment for the minor; (vi) any
potential placement provider when such release is
authorized by the court for the limited purpose of
determining the appropriateness of the potential
placement; (vii) law enforcement officers and prosecutors;
(viii) adult and juvenile prisoner review boards; (ix)
authorized military personnel; (x) individuals authorized
by court;
(7) subject to regulations of the State Board, in
connection with an emergency, to appropriate persons if the
knowledge of such information is necessary to protect the
health or safety of the student or other persons;
(8) to any person, with the prior specific dated
written consent of the parent designating the person to
whom the records may be released, provided that at the time
any such consent is requested or obtained, the parent shall
be advised in writing that he has the right to inspect and
copy such records in accordance with Section 5, to
challenge their contents in accordance with Section 7 and
to limit any such consent to designated records or
designated portions of the information contained therein;
(9) to a governmental agency, or social service agency

SB2089 - 32 - LRB101 09671 AXK 54770 b
contracted by a governmental agency, in furtherance of an
investigation of a student's school attendance pursuant to
the compulsory student attendance laws of this State,
provided that the records are released to the employee or
agent designated by the agency;
(10) to those SHOCAP committee members who fall within
the meaning of "state and local officials and authorities",
as those terms are used within the meaning of the federal
Family Educational Rights and Privacy Act, for the purposes
of identifying serious habitual juvenile offenders and
matching those offenders with community resources pursuant
to Section 5-145 of the Juvenile Court Act of 1987, but
only to the extent that the release, transfer, disclosure,
or dissemination is consistent with the Family Educational
Rights and Privacy Act;
(11) to the Department of Healthcare and Family
Services in furtherance of the requirements of Section
2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or
Section 10 of the School Breakfast and Lunch Program Act;
or
(12) to the State Board or another State government
agency or between or among State government agencies in
order to evaluate or audit federal and State programs or
perform research and planning, but only to the extent that
the release, transfer, disclosure, or dissemination is
consistent with the federal Family Educational Rights and

SB2089 - 33 - LRB101 09671 AXK 54770 b
Privacy Act (20 U.S.C. 1232g).
(b) No information may be released pursuant to subparagraph
(3) or (6) of paragraph (a) of this Section 6 unless the parent
receives prior written notice of the nature and substance of
the information proposed to be released, and an opportunity to
inspect and copy such records in accordance with Section 5 and
to challenge their contents in accordance with Section 7.
Provided, however, that such notice shall be sufficient if
published in a local newspaper of general circulation or other
publication directed generally to the parents involved where
the proposed release of information is pursuant to subparagraph
(6) of paragraph (a) of this Section 6 and relates to more than
25 students.
(c) A record of any release of information pursuant to this
Section must be made and kept as a part of the school student
record and subject to the access granted by Section 5. Such
record of release shall be maintained for the life of the
school student records and shall be available only to the
parent and the official records custodian. Each record of
release shall also include:
(1) the nature and substance of the information
released;
(2) the name and signature of the official records
custodian releasing such information;
(3) the name of the person requesting such information,
the capacity in which such a request has been made, and the

SB2089 - 34 - LRB101 09671 AXK 54770 b
purpose of such request;
(4) the date of the release; and
(5) a copy of any consent to such release.
(d) Except for the student and his parents, no person to
whom information is released pursuant to this Section and no
person specifically designated as a representative by a parent
may permit any other person to have access to such information
without a prior consent of the parent obtained in accordance
with the requirements of subparagraph (8) of paragraph (a) of
this Section.
(e) Nothing contained in this Act shall prohibit, with the
written consent of a student's parent, the publication of
student directories which list student names, addresses and
other identifying information and similar publications which
comply with regulations issued by the State Board.
(Source: P.A. 99-78, eff. 7-20-15.)
(105 ILCS 85/Act rep.)
Section 110. The Student Online Personal Protection Act is
repealed.
Section 115. The Consumer Fraud and Deceptive Business
Practices Act is amended by changing Section 2Z as follows:
(815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)
Sec. 2Z. Violations of other Acts. Any person who knowingly

SB2089 - 35 - LRB101 09671 AXK 54770 b
violates the Automotive Repair Act, the Automotive Collision
Repair Act, the Home Repair and Remodeling Act, the Dance
Studio Act, the Physical Fitness Services Act, the Hearing
Instrument Consumer Protection Act, the Illinois Union Label
Act, the Installment Sales Contract Act, the Job Referral and
Job Listing Services Consumer Protection Act, the Travel
Promotion Consumer Protection Act, the Credit Services
Organizations Act, the Automatic Telephone Dialers Act, the
Pay-Per-Call Services Consumer Protection Act, the Telephone
Solicitations Act, the Illinois Funeral or Burial Funds Act,
the Cemetery Oversight Act, the Cemetery Care Act, the Safe and
Hygienic Bed Act, the Illinois Pre-Need Cemetery Sales Act, the
High Risk Home Loan Act, the Payday Loan Reform Act, the
Mortgage Rescue Fraud Act, subsection (a) or (b) of Section
3-10 of the Cigarette Tax Act, subsection (a) or (b) of Section
3-10 of the Cigarette Use Tax Act, the Electronic Mail Act, the
Internet Caller Identification Act, paragraph (6) of
subsection (k) of Section 6-305 of the Illinois Vehicle Code,
Section 11-1431, 18d-115, 18d-120, 18d-125, 18d-135, 18d-150,
or 18d-153 of the Illinois Vehicle Code, Article 3 of the
Residential Real Property Disclosure Act, the Automatic
Contract Renewal Act, the Reverse Mortgage Act, Section 25 of
the Youth Mental Health Protection Act, the Personal
Information Protection Act, or the Student Online Personal
Protection Act of 2019 commits an unlawful practice within the
meaning of this Act.

SB2089 - 36 - LRB101 09671 AXK 54770 b
(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642,
eff. 7-28-16; 100-315, eff. 8-24-17; 100-416, eff. 1-1-18;
100-863, eff. 8-14-18.)
Section 999. Effective date. This Act takes effect upon
becoming law.