Bill Text: IL SB2256 | 2023-2024 | 103rd General Assembly | Introduced

---

Bill Title: Amends the Student Online Personal Protection Act. Provides that "covered information" does not include de-identified or aggregate information from which all personally identifiable information of a student has been removed. Makes conforming changes. Provides that the covered information restrictions shall be included as part of the operator's terms of service agreement, privacy policy, or similar document (instead of requiring that an operator enter into a written agreement with the school, school district, or State Board before the covered information may be transferred) Removes provisions requiring that if the school maintains a website, the operator shall provide a statement that the school must publish the written agreement on the school's website. Makes related changes. Provides that a statement that the operator will implement and maintain reasonable security procedures and practices that otherwise meet or exceed industry standards designed to protect covered information from unauthorized access, destruction, use, modification, or disclosure Provides that the business address of the operator and a link to the terms of service agreement, privacy policy, or similar document shall be provided. Provides that de-identified or aggregate information from which all personally identifiable information of a student has been removed are not prohibited for an operator to use. Removes restrictions prohibiting a school from sharing, transferring, disclosing, or providing access to a student's covered information to an entity or individual. Makes other changes.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2023-02-10 - Referred to Assignments [SB2256 Detail]

Download: Illinois-2023-SB2256-Introduced.html

---

103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB2256 Introduced 2/10/2023, by Sen. Robert F. Martwick SYNOPSIS AS INTRODUCED:
105 ILCS 85/5
105 ILCS 85/15
105 ILCS 85/25
105 ILCS 85/26
105 ILCS 85/27
105 ILCS 85/30
Amends the Student Online Personal Protection Act. Provides that "covered information" does not include de-identified or aggregate information from which all personally identifiable information of a student has been removed. Makes conforming changes. Provides that the covered information restrictions shall be included as part of the operator's terms of service agreement, privacy policy, or similar document (instead of requiring that an operator enter into a written agreement with the school, school district, or State Board before the covered information may be transferred) Removes provisions requiring that if the school maintains a website, a the operator shall provide a statement that the school must publish the written agreement on the school's website. Makes related changes. Provides that a statement that the operator will implement and maintain reasonable security procedures and practices that otherwise meet or exceed industry standards designed to protect covered information from unauthorized access, destruction, use, modification, or disclosure Provides that the business address of the operator and a link to the terms of service agreement, privacy policy, or similar document shall be provided. Provides that de-identified or aggregate information from which all personally identifiable information of a student has been removed are not prohibited for an operator to use. Removes restrictions prohibiting a school from sharing, transferring, disclosing, or providing access to a students covered information to an entity of individual. Makes other changes.
LRB103 27298 RJT 53669 b
A BILL FOR
SB2256 LRB103 27298 RJT 53669 b
AN ACT concerning education.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The Student Online Personal Protection Act is
amended by changing Sections 5, 15, 25, 26, 27 and 30 as
follows:
(105 ILCS 85/5)
Sec. 5. Definitions. In this Act:
"Breach" means the unauthorized acquisition of
computerized data that compromises the security,
confidentiality, or integrity of covered information
maintained by an operator or school. "Breach" does not include
the good faith acquisition of covered personal information by
an employee or agent of an operator or school for a legitimate
purpose of the operator or school if the covered information
is not used for a purpose prohibited by this Act or subject to
further unauthorized disclosure.
"Covered information" means personally identifiable
information or material of a student or information that is
linked to personally identifiable information or material in
any media or format that is not publicly available and is any
of the following:
(1) Created by or provided to an operator by a student

SB2256 - 2 - LRB103 27298 RJT 53669 b
or the student's parent in the course of the student's or
parent's use of the operator's site, service, or
application for K through 12 school purposes.
(2) Created by or provided to an operator by an
employee or agent of a school or school district for K
through 12 school purposes.
(3) Gathered by an operator through the operation of
its site, service, or application for K through 12 school
purposes and personally identifies a student, including,
but not limited to, information in the student's
educational record or electronic mail, first and last
name, home address, telephone number, electronic mail
address, or other information that allows physical or
online contact, discipline records, test results, special
education data, juvenile dependency records, grades,
evaluations, criminal records, medical records, health
records, a social security number, biometric information,
disabilities, socioeconomic information, food purchases,
political affiliations, religious information, text
messages, documents, student identifiers, search activity,
photos, voice recordings, or geolocation information.
The term does not include de-identified or aggregate
information from which all personally identifiable information
of a student has been removed.
"Interactive computer service" has the meaning ascribed to
that term in Section 230 of the federal Communications Decency

SB2256 - 3 - LRB103 27298 RJT 53669 b
Act of 1996 (47 U.S.C. 230).
"K through 12 school purposes" means purposes that are
directed by or that customarily take place at the direction of
a school, teacher, or school district; aid in the
administration of school activities, including, but not
limited to, instruction in the classroom or at home,
administrative activities, and collaboration between students,
school personnel, or parents; or are otherwise for the use and
benefit of the school.
"Longitudinal data system" has the meaning given to that
term under the P-20 Longitudinal Education Data System Act.
"Operator" means, to the extent that an entity is
operating in this capacity, the operator of an Internet
website, online service, online application, or mobile
application with actual knowledge that the site, service, or
application is used primarily for K through 12 school purposes
and was designed and marketed for K through 12 school
purposes.
"Parent" has the meaning given to that term under the
Illinois School Student Records Act.
"School" means (1) any preschool, public kindergarten,
elementary or secondary educational institution, vocational
school, special educational facility, or any other elementary
or secondary educational agency or institution or (2) any
person, agency, or institution that maintains school student
records from more than one school. Except as otherwise

SB2256 - 4 - LRB103 27298 RJT 53669 b
provided in this Act, "school" includes a private or nonpublic
school.
"State Board" means the State Board of Education.
"Student" has the meaning given to that term under the
Illinois School Student Records Act.
"Targeted advertising" means presenting advertisements to
a student where the advertisement is selected based on
information obtained or inferred from that student's online
behavior, usage of applications, or covered information. The
term does not include advertising to a student at an online
location based upon that student's current visit to that
location or in response to that student's request for
information or feedback, without the retention of that
student's online activities or requests over time for the
purpose of targeting subsequent ads.
(Source: P.A. 100-315, eff. 8-24-17; 101-516, eff. 7-1-21.)
(105 ILCS 85/15)
Sec. 15. Operator duties. An operator shall do the
following:
(1) Implement and maintain reasonable security
procedures and practices that otherwise meet or exceed
industry standards designed to protect covered information
from unauthorized access, destruction, use, modification,
or disclosure.
(2) Delete, within a reasonable time period, a

SB2256 - 5 - LRB103 27298 RJT 53669 b
student's covered information if the school or school
district requests deletion of covered information under
the control of the school or school district, unless a
student or his or her parent consents to the maintenance
of the covered information.
(3) Publicly disclose material information about its
collection, use, and disclosure of covered information,
including, but not limited to, publishing a terms of
service agreement, privacy policy, or similar document.
(4) Except for a nonpublic school, for any operator
who receives seeks to receive from a public school, school
district, or the State Board in any manner any covered
information, must include as part of their service
agreement, privacy policy, or similar document the
following: enter into a written agreement with the school,
school district, or State Board before the covered
information may be transferred. The written agreement may
be created in electronic form and signed with an
electronic or digital signature or may be a click wrap
agreement that is used with software licenses, downloaded
or online applications and transactions for educational
technologies, or other technologies in which a user must
agree to terms and conditions before using the product or
service. Any written agreement entered into, amended, or
renewed must contain all of the following:
(A) A listing of the categories or types of

SB2256 - 6 - LRB103 27298 RJT 53669 b
covered information to be provided by the school to
the operator.
(B) A statement of the product or service being
provided to the school by the operator.
(C) A statement that, pursuant to the federal
Family Educational Rights and Privacy Act of 1974, the
operator is acting as a school official with a
legitimate educational interest, is performing an
institutional service or function for which the school
would otherwise use employees, under the direct
control of the school, with respect to the use and
maintenance of covered information, and is using the
covered information only for an authorized purpose and
may not re-disclose it to third parties or affiliates,
unless otherwise permitted under this Act, without
permission from the school or pursuant to court order.
(D) A statement that description of how, if a
breach is attributed to the operator, any costs and
expenses incurred by the school in investigating and
remediating the breach will be allocated to between
the operator and the school. The costs and expenses
shall may include, but are not limited to:
(i) providing notification to the parents of
those students whose covered information was
compromised and to regulatory agencies or other
entities as required by law or contract;

SB2256 - 7 - LRB103 27298 RJT 53669 b
(ii) providing credit monitoring to those
students whose covered information was exposed in
a manner during the breach that a reasonable
person would believe that it could impact his or
her credit or financial security;
(iii) legal fees, audit costs, fines, and any
other fees or damages imposed against the school
as a result of the security breach; and
(iv) providing any other notifications or
fulfilling any other requirements adopted by the
State Board or of any other State or federal laws.
(E) A statement that the operator must delete or
transfer to the school all covered information if the
information is no longer needed for the purposes of
the school's use of the operator's site, service, or
application the written agreement and to specify the
time period in which the information must be deleted
or transferred once the operator is made aware that
the information is no longer needed for the purposes
of the school's use of the operator's site, service,
or application written agreement.
(F) (Blank) If the school maintains a website, a
statement that the school must publish the written
agreement on the school's website. If the school does
not maintain a website, a statement that the school
must make the written agreement available for

SB2256 - 8 - LRB103 27298 RJT 53669 b
inspection by the general public at its administrative
office. If mutually agreed upon by the school and the
operator, provisions of the written agreement, other
than those under subparagraphs (A), (B), and (C), may
be redacted in the copy of the written agreement
published on the school's website or made available at
its administrative office.
(G) A statement that the operator will implement
and maintain reasonable security procedures and
practices that otherwise meet or exceed industry
standards designed to protect covered information from
unauthorized access, destruction, use, modification,
or disclosure.
(H) The business address of the operator and a
link to the terms of service agreement, privacy
policy, or similar document.
(5) In case of any breach, within the most expedient
time possible and without unreasonable delay, but no later
than 30 calendar days after the determination that a
breach has occurred, notify the school of any breach of
the students' covered information.
(6) Except for a nonpublic school, maintain provide to
the school a list of any third parties or affiliates to
whom the operator is currently disclosing covered
information or has disclosed covered information on its
site, service, or application. This list must, at a

SB2256 - 9 - LRB103 27298 RJT 53669 b
minimum, be updated and provided to the school by the
beginning of each State fiscal year and at the beginning
of each calendar year.
(Source: P.A. 100-315, eff. 8-24-17; 101-516, eff. 7-1-21.)
(105 ILCS 85/25)
Sec. 25. Operator actions that are not prohibited. This
Act does not prohibit an operator from doing any of the
following:
(1) Using de-identified or aggregate information from
which all personally identifiable information of a student
has been removed covered information to improve
educational products if that information is not associated
with an identified student within the operator's site,
service, or application or other sites, services, or
applications owned by the operator.
(2) Using de-identified or aggregate information from
which all personally identifiable information of a student
has been removed covered information that is not
associated with an identified student to demonstrate the
effectiveness of the operator's products or services,
including in their marketing.
(3) Sharing de-identified or aggregate information
from which all personally identifiable information of a
student has been removed covered information that is not
associated with an identified student for the development

SB2256 - 10 - LRB103 27298 RJT 53669 b
and improvement of educational sites, services, or
applications.
(4) Using recommendation engines to recommend to a
student either of the following:
(A) Additional content relating to an educational,
other learning, or employment opportunity purpose
within an online site, service, or application if the
recommendation is not determined in whole or in part
by payment or other consideration from a third party.
(B) Additional services relating to an
educational, other learning, or employment opportunity
purpose within an online site, service, or application
if the recommendation is not determined in whole or in
part by payment or other consideration from a third
party.
(5) Responding to a student's request for information
or for feedback without the information or response being
determined in whole or in part by payment or other
consideration from a third party.
(Source: P.A. 100-315, eff. 8-24-17.)
(105 ILCS 85/26)
Sec. 26. School prohibitions. A school may not do either
of the following:
(1) Sell, rent, lease, or trade covered information.
(2) (Blank). Share, transfer, disclose, or provide

SB2256 - 11 - LRB103 27298 RJT 53669 b
access to a student's covered information to an entity or
individual, other than the student's parent, school
personnel, appointed or elected school board members or
local school council members, or the State Board, without
a written agreement, unless the disclosure or transfer is:
(A) to the extent permitted by State or federal
law, to law enforcement officials to protect the
safety of users or others or the security or integrity
of the operator's service;
(B) required by court order or State or federal
law; or
(C) to ensure legal or regulatory compliance.
This paragraph (2) does not apply to nonpublic
schools.
(Source: P.A. 101-516, eff. 7-1-21.)
(105 ILCS 85/27)
Sec. 27. School duties.
(a) Each school shall post and maintain on its website or,
if the school does not maintain a website, make available for
inspection by the general public at its administrative office
all of the following information:
(1) An explanation, that is clear and understandable
by a layperson, of the data elements of covered
information that the school collects, maintains, or
discloses to any operator person, entity, third party, or

SB2256 - 12 - LRB103 27298 RJT 53669 b
governmental agency. The information must explain how the
school uses, to whom or what entities it discloses, and
for what purpose it discloses the covered information.
(2) A list of the operators of any educational sites,
services, or applications used by the school, that the
school has written agreements with, a copy of each written
agreement, and a business address for each operator, and a
link to each operator's terms of service, privacy policy,
or similar document. A copy of a written agreement posted
or made available by a school under this paragraph may
contain redactions, as provided under subparagraph (F) of
paragraph (4) of Section 15.
(3) For each operator, a list of any subcontractors to
whom covered information may be disclosed or a link to a
page on the operator's website that clearly lists the that
information third parties or affiliates to whom the
operator is currently disclosing covered information or
has disclosed covered information, as provided by the
operator to the school under paragraph (6) of Section 15.
(4) A written description of the procedures that a
parent may use to carry out the rights enumerated under
Section 33.
(5) A list of any breaches of covered information
maintained by the school or breaches under Section 15 that
includes, but is not limited to, all of the following
information:

SB2256 - 13 - LRB103 27298 RJT 53669 b
(A) The number of students whose covered
information is involved in the breach, unless
disclosing that number would violate the provisions of
the Personal Information Protection Act.
(B) The date, estimated date, or estimated date
range of the breach.
(C) For a breach under Section 15, the name of the
operator.
The school may omit from the list required under this
paragraph (5): (i) any breach in which, to the best of the
school's knowledge at the time of updating the list, the
number of students whose covered information is involved
in the breach is less than 10% of the school's enrollment,
(ii) any breach in which, at the time of posting the list,
the school is not required to notify the parent of a
student under subsection (d), (iii) any breach in which
the date, estimated date, or estimated date range in which
it occurred is earlier than July 1, 2021, or (iv) any
breach previously posted on a list under this paragraph
(5) no more than 5 years prior to the school updating the
current list.
The school must, at a minimum, update the items under
paragraphs (1), (3), (4), and (5) no later than 30 calendar
days following the start of a fiscal year and no later than 30
days following the beginning of a calendar year.
(b) Each school must adopt a policy for designating which

SB2256 - 14 - LRB103 27298 RJT 53669 b
school employees are authorized to enter into written
agreements with operators. This subsection may not be
construed to limit individual school employees outside of the
scope of their employment from entering into agreements with
operators on their own behalf and for non-K through 12 school
purposes, provided that no covered information is provided to
the operators. Any agreement or contract entered into in
violation of this Act is void and unenforceable as against
public policy.
(c) A school must post on its website or, if the school
does not maintain a website, make available at its
administrative office for inspection by the general public
each written agreement entered into under this Act, along with
any information required under subsection (a), no later than
10 business days after entering into the agreement.
(d) After receipt of notice of a breach under Section 15 or
determination of a breach of covered information maintained by
the school, a school shall notify, no later than 30 calendar
days after receipt of the notice or determination that a
breach has occurred, the parent of any student whose covered
information is involved in the breach. The notification must
include, but is not limited to, all of the following:
(1) The date, estimated date, or estimated date range
of the breach.
(2) A description of the covered information that was
compromised or reasonably believed to have been

SB2256 - 15 - LRB103 27298 RJT 53669 b
compromised in the breach.
(3) Information that the parent may use to contact the
operator and school to inquire about the breach.
(4) The toll-free numbers, addresses, and websites for
consumer reporting agencies.
(5) The toll-free number, address, and website for the
Federal Trade Commission.
(6) A statement that the parent may obtain information
from the Federal Trade Commission and consumer reporting
agencies about fraud alerts and security freezes.
A notice of breach required under this subsection may be
delayed if an appropriate law enforcement agency determines
that the notification will interfere with a criminal
investigation and provides the school with a written request
for a delay of notice. A school must comply with the
notification requirements as soon as the notification will no
longer interfere with the investigation.
(e) Each school must implement and maintain reasonable
security procedures and practices that otherwise meet or
exceed industry standards designed to protect covered
information from unauthorized access, destruction, use,
modification, or disclosure. Any written agreement under which
the disclosure of covered information between the school and a
third party takes place must include a provision requiring the
entity to whom the covered information is disclosed to
implement and maintain reasonable security procedures and

SB2256 - 16 - LRB103 27298 RJT 53669 b
practices that otherwise meet or exceed industry standards
designed to protect covered information from unauthorized
access, destruction, use, modification, or disclosure. The
State Board must make available on its website a guidance
document for schools pertaining to reasonable security
procedures and practices under this subsection.
(f) Each school may designate an appropriate staff person
as a privacy officer, who may also be an official records
custodian as designated under the Illinois School Student
Records Act, to carry out the duties and responsibilities
assigned to schools and to ensure compliance with the
requirements of this Section and Section 26.
(g) A school shall make a request, pursuant to paragraph
(2) of Section 15, to an operator to delete covered
information on behalf of a student's parent if the parent
requests from the school that the student's covered
information held by the operator be deleted, so long as the
deletion of the covered information is not in violation of
State or federal records laws and the school has determined
the covered information is not needed to administer its
curriculum.
(h) This Section does not apply to nonpublic schools.
(Source: P.A. 101-516, eff. 7-1-21; 102-558, eff. 8-20-21.)
(105 ILCS 85/30)
Sec. 30. Applicability. This Act does not do any of the

SB2256 - 17 - LRB103 27298 RJT 53669 b
following:
(1) Limit the authority of a law enforcement agency to
obtain any content or information from an operator as
authorized by law or under a court order.
(2) Limit the ability of an operator to use student
data, including covered information, for adaptive learning
or customized student learning purposes.
(3) Apply to general audience Internet websites,
general audience online services, general audience online
applications, or general audience mobile applications,
even if login credentials created for an operator's site,
service, or application may be used to access those
general audience sites, services, or applications.
(4) Limit service providers from providing Internet
connectivity to schools or students and their families.
(5) Prohibit an operator of an Internet website,
online service, online application, or mobile application
from marketing educational products directly to parents if
the marketing did not result from the use of covered
information obtained by the operator through the provision
of services covered under this Act.
(6) Impose a duty upon a provider of an electronic
store, gateway, marketplace, or other means of purchasing
or downloading software or applications to review or
enforce compliance with this Act on those applications or
software.

SB2256 - 18 - LRB103 27298 RJT 53669 b
(7) Impose a duty upon a provider of an interactive
computer service to review or enforce compliance with this
Act by third-party content providers.
(8) Prohibit students from downloading, exporting,
transferring, saving, or maintaining their own student
data or documents.
(9) Supersede the federal Family Educational Rights
and Privacy Act of 1974, the Illinois School Student
Records Act, or any rules adopted pursuant to those Acts.
(10) Prohibit an operator or school from producing and
distributing, free or for consideration, student class
photos and yearbooks to the school, libraries, students,
parents, or individuals authorized by parents and to no
others, in accordance with the terms of a written
agreement between the operator and the school.
(Source: P.A. 100-315, eff. 8-24-17; 101-516, eff. 7-1-21.)