Bill Text: IL SB3092 | 2013-2014 | 98th General Assembly | Amended

---

Bill Title: Amends the P-20 Longitudinal Education Data System Act. Provides that if an audit or evaluation or a compliance or enforcement activity in connection with legal requirements that relate to State-supported or school district-supported educational programs requires or is used as the basis for granting access to personally identifiable information, the State Board of Education or a public school shall designate parties only under its direct control to act as authorized representatives to conduct the audit, evaluation, or activity. Limits the disclosure of personally identifiable information by the State Board or a public school with respect to (i) a contractor, consultant, or other party to whom the State Board or school has outsourced services or functions; (ii) a party conducting certain studies for or on behalf of the State Board or school; (iii) any party for a commercial use; or (iv) the provision of services other than contracting, studies, and audits or evaluations. Limits the maintenance of personally identifiable information and provides for disclosure and notification. Limits appending education records with personally identifiable information obtained from other federal or State agencies through data matches. Provides for civil penalties. Effective immediately.

Spectrum: Moderate Partisan Bill (Democrat 6-1)

Status: (Failed) 2015-01-13 - Session Sine Die [SB3092 Detail]

Download: Illinois-2013-SB3092-Amended.html

---

Rep. Scott Drury

Filed: 5/27/2014

09800SB3092ham001 LRB098 15075 KTG 59710 a
AMENDMENT TO SENATE BILL 3092
AMENDMENT NO. ______. Amend Senate Bill 3092 by replacing
everything after the enacting clause with the following:
"Section 5. The Illinois School Student Records Act is
amended by changing Sections 2 and 6 as follows:
(105 ILCS 10/2) (from Ch. 122, par. 50-2)
Sec. 2. As used in this Act,
(a) "Student" means any person enrolled or previously
enrolled in a school.
(b) "School" means any public preschool, day care center,
kindergarten, nursery, elementary or secondary educational
institution, vocational school, special educational facility
or any other elementary or secondary educational agency or
institution and any person, agency or institution which
maintains school student records from more than one school, but
does not include a private or non-public school.

09800SB3092ham001 - 2 - LRB098 15075 KTG 59710 a
(c) "State Board" means the State Board of Education.
(d) "School Student Record" means any writing or other
recorded information concerning a student and by which a
student may be individually or personally identified,
maintained by a school or at its direction or by an employee of
a school, regardless of how or where the information is stored.
The following shall not be deemed school student records under
this Act: writings or other recorded information maintained by
an employee of a school or other person at the direction of a
school for his or her exclusive use; provided that all such
writings and other recorded information are destroyed not later
than the student's graduation or permanent withdrawal from the
school; and provided further that no such records or recorded
information may be released or disclosed to any person except a
person designated by the school as a substitute unless they are
first incorporated in a school student record and made subject
to all of the provisions of this Act. School student records
shall not include information maintained by law enforcement
professionals working in the school.
(e) "Student Permanent Record" means the minimum personal
information necessary to a school in the education of the
student and contained in a school student record. Such
information may include the student's name, birth date,
address, grades and grade level, parents' names and addresses,
attendance records, and such other entries as the State Board
may require or authorize.

09800SB3092ham001 - 3 - LRB098 15075 KTG 59710 a
(f) "Student Temporary Record" means all information
contained in a school student record but not contained in the
student permanent record. Such information may include family
background information, intelligence test scores, aptitude
test scores, psychological and personality test results,
teacher evaluations, and other information of clear relevance
to the education of the student, all subject to regulations of
the State Board. The information shall include information
provided under Section 8.6 of the Abused and Neglected Child
Reporting Act. In addition, the student temporary record shall
include information regarding serious disciplinary infractions
that resulted in expulsion, suspension, or the imposition of
punishment or sanction. For purposes of this provision, serious
disciplinary infractions means: infractions involving drugs,
weapons, or bodily harm to another.
(g) "Parent" means a person who is the natural parent of
the student or other person who has the primary responsibility
for the care and upbringing of the student. All rights and
privileges accorded to a parent under this Act shall become
exclusively those of the student upon his 18th birthday,
graduation from secondary school, marriage or entry into
military service, whichever occurs first. Such rights and
privileges may also be exercised by the student at any time
with respect to the student's permanent school record.
(h) "Eligible Student" means a student who has reached 18
years of age.

09800SB3092ham001 - 4 - LRB098 15075 KTG 59710 a
(Source: P.A. 92-295, eff. 1-1-02.)
(105 ILCS 10/6) (from Ch. 122, par. 50-6)
Sec. 6. (a) No school student records or information
contained therein may be released, transferred, disclosed or
otherwise disseminated, except as follows:
(1) To a parent or student or person specifically
designated as a representative by a parent, as provided in
paragraph (a) of Section 5. ;
(2) To an employee or official of the school or school
district or State Board with current demonstrable
educational or administrative interest in the student, in
furtherance of such interest. ;
(3) To the official records custodian of another school
within Illinois or an official with similar
responsibilities of a school outside Illinois, in which the
student has enrolled, or intends to enroll, upon the
request of such official or student. ;
(4) Except as set forth in subparagraph (4.5) of this
paragraph (a), to To any person or entity for the purpose
of research, statistical reporting, or planning, audit, or
evaluation, provided that (i) such research, statistical
reporting, or planning, audit, or evaluation is
permissible under and undertaken in accordance with the
federal Family Educational Rights and Privacy Act (20
U.S.C. 1232g) and (ii) the school board, school district,

09800SB3092ham001 - 5 - LRB098 15075 KTG 59710 a
school, or State Board requires the person or entity to do
the following:
(A) Not use, share, disclose, or compile the school
student records or information contained therein for
any purpose other than that for which the information
is provided, which purpose shall be set forth in
writing by the school board, school district, school,
or State Board and signed by the person or entity.
(B) Not use, share, disclose, or compile the school
student records or information contained therein for
any commercial purpose, including, but not limited to,
advertising or profiling.
(C) Not, in any way whatsoever, allow, facilitate,
or aid in the marketing or advertising of a product or
service to a student whose school student records or
the information contained therein has been received by
the person or entity.
(D) Take all reasonable steps to protect the school
student records and information contained therein in a
manner that meets or exceeds reasonable and
appropriate commercial best practices. Where the
school student records or information contained
therein is maintained in an electronic format,
reasonable and appropriate commercial best practices
include, at a minimum, all of the following:
(i) Valid encryption processes for data at

09800SB3092ham001 - 6 - LRB098 15075 KTG 59710 a
rest in the person or entity's own data storage
systems that are consistent with NIST Special
Publication 800-111, Guide to Storage Encryption
Technologies for End User Devices.
(ii) Valid encryption processes for data in
motion on public networks that comply, as
appropriate, with NIST Special Publications
800-52, Guidelines for the Selection and Use of
Transport Layer Security (TLS) Implementations;
NIST Special Publication 800-77, Guide to IPsec
VPNs; or NIST Special Publication 800-113, Guide
to SSL VPNs, or others that are Federal Information
Processing Standards (FIPS) Publication 140-2
validated.
(E) Delete a school student record and information
contained therein if any of the following occurs:
(i) The school student record and information
contained therein is no longer being used for the
purpose directed by the school board, school
district, school, or State Board.
(ii) A parent or eligible student requests
deletion, unless the school student record or
information contained therein is being used or
maintained at the direction of a school board,
school district, or school, or the State Board and
is under the direct control of such school board,

09800SB3092ham001 - 7 - LRB098 15075 KTG 59710 a
school district, school, or State Board.
(iii) The school board, school district,
school, or State Board requests deletion.
(4.1) Nothing in paragraph (4) shall prohibit a person
or entity from sharing, disclosing, or compiling school
student records or the information contained therein if
other provisions of federal or State law require such
sharing, disclosure, or compilation, and the person or
entity complies with the requirements of federal and State
law in protecting that information.
(4.2) If a school board, school district, or school, or
the State Board is unable to gain compliance by a person or
entity with the requirements of paragraph (4), but
determines that releasing, transferring, disclosing, or
otherwise disseminating school student records or
information contained therein to such a person or entity is
essential to an educational objective, the school board,
school district, school, or State Board may release,
transfer, disclose, or otherwise disseminate such school
student records and the information contained therein
provided that all of the following occurs:
(A) The school board, school district, school, or
State Board publicly notifies parents and eligible
students at least 21 days in advance of the student's
school student records or information contained
therein being released, transferred, disclosed, or

09800SB3092ham001 - 8 - LRB098 15075 KTG 59710 a
otherwise disseminated of: (i) the planned release,
transfer, disclosure, or dissemination; and (ii) the
purpose of the planned release, transfer, disclosure,
or dissemination.
(B) The school board, school district, school, or
State Board provides parents and eligible students
with (i) the opportunity to opt out of having the
relevant school student records or information
contained therein released, transferred, disclosed, or
otherwise disseminated; and (ii) instructions setting
forth how to opt out. ;
(4.5) To researchers at an accredited post-secondary
educational institution or an organization conducting
research pursuant to a specific, written agreement with the
school or school district or State Board and in accordance
with the federal Family Educational Rights and Privacy Act,
provided that such researchers and organizations comply
with the following requirements:
(A) The nature of the research shall be first
publicly disclosed in advance of the research being
conducted by providing general notice regarding
planned studies or research to parents, guardians, or
eligible students prior to the beginning of each school
year and by posting an updated notice of additional
research or studies on the Internet website of the
school board, school district, school, or State Board

09800SB3092ham001 - 9 - LRB098 15075 KTG 59710 a
as additional research or studies are added. If the
school board, school district, or school does not have
an Internet website that can be updated with notice of
additional research or studies, the school board,
school district, or school shall send written
notification to affected parents, guardians, or
eligible students as additional research or studies
are added. Any notice provided under this paragraph
shall set forth, in general terms, the nature of the
research, the persons to whom the research will apply,
and the topics thereof. The notice requirements in this
paragraph do not apply to eligible students or parents
or guardians of students who have graduated or left the
school, school district, or State as of the effective
date of this amendatory Act of the 98th General
Assembly.
(B) The post-secondary educational institution or
an organization conducting research and the school,
school district, or State Board shall enter into a data
use agreement which shall be signed by the party
gaining access to the data and the school board, school
district, or school and which complies with the federal
Family Educational Rights and Privacy Act and its
accompanying regulations and, at a minimum, sets forth
the following:
(i) a requirement that the post-secondary

09800SB3092ham001 - 10 - LRB098 15075 KTG 59710 a
educational institution or the organization
conducting research shall abide by all
requirements of this subdivision (B);
(ii) the purpose, scope, subjects, and
duration of the study or studies, the information
to be disclosed, and the person or persons to whom
the information shall be disclosed; the person or
persons to whom the information shall be disclosed
may be updated to include additional persons;
(iii) a requirement that the persons described
in item (ii) shall use school student records only
to meet the purpose or purposes of the study as set
forth pursuant to item (ii) and only after written
or other recorded information concerning a student
and by which a student may be individually
identified has been removed from such records;
(iv) a requirement that the post-secondary
educational institution or the organization
conducting research shall use written or other
recorded information concerning a student and by
which a student may be individually or personally
identified only to link data files and, in such
instances, the post-secondary educational
institution or the organization conducting
research shall designate in writing the person or
persons to whom such information will be

09800SB3092ham001 - 11 - LRB098 15075 KTG 59710 a
disclosed;
(v) a requirement that the post-secondary
educational institution or the organization
conducting research shall destroy all written or
other recorded information that individually or
personally identifies a student when the
information is no longer needed, but in no event
later than 36 months after the study has been
completed;
(vi) a requirement that the post-secondary
educational institution or the organization
conducting research shall certify in writing that
it has the capacity to and shall restrict access to
school student records and shall maintain the
security of all written and electronic information
received pursuant to this Section in compliance
with rules that shall be adopted by the State
Board, which shall be consistent with and
regularly updated to comply with commonly accepted
data-security practices, including, but not
limited to, those set forth by the United States
Department of Education Privacy Technical
Assistance Center;
(vii) a requirement that, in compliance with
the rules adopted pursuant to item (vi), the
post-secondary educational institution or the

09800SB3092ham001 - 12 - LRB098 15075 KTG 59710 a
organization conducting research shall develop,
implement, maintain, and use appropriate
administrative, technical, and physical security
measures to preserve the confidentiality,
integrity, and availability of all school student
records.
(C) The post-secondary educational institution or
the organization conducting research shall use
personally identifiable information from school
student records only to meet the purpose or purposes of
the study as stated in the written data use agreement
described in subdivision (B) of this subparagraph
(4.5).
For purposes of this subparagraph (4.5), any
information by which a student may be individually or
personally identified shall be released, transferred,
disclosed, or otherwise disseminated only as contemplated
by the data use agreement between the parties containing
the provisions set forth in subdivision (B) of this
subparagraph (4.5). The school student records shall be
redacted prior to analysis by the post-secondary
educational institution or the organization conducting
research. Any personally identifiable information used to
link data sets shall be stored in a secure data file or
location outside of the secure data storage where redacted
information from the school student records is stored. The

09800SB3092ham001 - 13 - LRB098 15075 KTG 59710 a
post-secondary educational institution or the organization
conducting research shall implement and adhere to policies
and procedures that restrict access to information by which
a student may be individually or personally identified. The
post-secondary educational institution or the organization
conducting research shall designate an individual to act as
the custodian of the personally identifiable information
who is responsible for restricting access to that
information.
Nothing in this subparagraph (4.5) shall prohibit the
State Board or any school or school district from providing
personally identifiable information about individual
students to an accredited post-secondary educational
institution or an organization conducting research
pursuant to a specific, written agreement with the school
or school district or State Board and in accordance with
the federal Family Educational Rights and Privacy Act,
where necessary for the State Board, school, or school
district to comply with State or federal statutory
mandates.
(5) Pursuant to a court order, provided that the parent
shall be given prompt written notice upon receipt of such
order of the terms of the order, the nature and substance
of the information proposed to be released in compliance
with such order and an opportunity to inspect and copy the
school student records and to challenge their contents

09800SB3092ham001 - 14 - LRB098 15075 KTG 59710 a
pursuant to Section 7. ;
(6) To any person as specifically required by State or
federal law. ;
(6.5) To juvenile authorities when necessary for the
discharge of their official duties who request information
prior to adjudication of the student and who certify in
writing that the information will not be disclosed to any
other party except as provided under law or order of court.
For purposes of this Section "juvenile authorities" means:
(i) a judge of the circuit court and members of the staff
of the court designated by the judge; (ii) parties to the
proceedings under the Juvenile Court Act of 1987 and their
attorneys; (iii) probation officers and court appointed
advocates for the juvenile authorized by the judge hearing
the case; (iv) any individual, public or private agency
having custody of the child pursuant to court order; (v)
any individual, public or private agency providing
education, medical or mental health service to the child
when the requested information is needed to determine the
appropriate service or treatment for the minor; (vi) any
potential placement provider when such release is
authorized by the court for the limited purpose of
determining the appropriateness of the potential
placement; (vii) law enforcement officers and prosecutors;
(viii) adult and juvenile prisoner review boards; (ix)
authorized military personnel; (x) individuals authorized

09800SB3092ham001 - 15 - LRB098 15075 KTG 59710 a
by court. ;
(7) Subject to regulations of the State Board, in
connection with an emergency, to appropriate persons if the
knowledge of such information is necessary to protect the
health or safety of the student or other persons. ;
(8) To any person, with the prior specific dated
written consent of the parent designating the person to
whom the records may be released, provided that at the time
any such consent is requested or obtained, the parent shall
be advised in writing that he has the right to inspect and
copy such records in accordance with Section 5, to
challenge their contents in accordance with Section 7 and
to limit any such consent to designated records or
designated portions of the information contained therein.
;
(9) To a governmental agency, or social service agency
contracted by a governmental agency, in furtherance of an
investigation of a student's school attendance pursuant to
the compulsory student attendance laws of this State,
provided that the records are released to the employee or
agent designated by the agency. ;
(10) To those SHOCAP committee members who fall within
the meaning of "state and local officials and authorities",
as those terms are used within the meaning of the federal
Family Educational Rights and Privacy Act, for the purposes
of identifying serious habitual juvenile offenders and

09800SB3092ham001 - 16 - LRB098 15075 KTG 59710 a
matching those offenders with community resources pursuant
to Section 5-145 of the Juvenile Court Act of 1987, but
only to the extent that the release, transfer, disclosure,
or dissemination is consistent with the Family Educational
Rights and Privacy Act. ;
(11) To the Department of Healthcare and Family
Services in furtherance of the requirements of Section
2-3.131, 3-14.29, 10-28, or 34-18.26 of the School Code or
Section 10 of the School Breakfast and Lunch Program Act. ;
or
(12) To the State Board or another State government
agency or between or among State government agencies in
order to evaluate or audit federal and State programs or
perform research and planning, but only to the extent that
the release, transfer, disclosure, or dissemination is
consistent with the federal Family Educational Rights and
Privacy Act (20 U.S.C. 1232g).
(b) No information may be released pursuant to
subparagraphs (3) or (6) of paragraph (a) of this Section 6
unless the parent receives prior written notice of the nature
and substance of the information proposed to be released, and
an opportunity to inspect and copy such records in accordance
with Section 5 and to challenge their contents in accordance
with Section 7. Provided, however, that such notice shall be
sufficient if published in a local newspaper of general
circulation or other publication directed generally to the

09800SB3092ham001 - 17 - LRB098 15075 KTG 59710 a
parents involved where the proposed release of information is
pursuant to subparagraph 6 of paragraph (a) in this Section 6
and relates to more than 25 students.
(c) A record of any release of information pursuant to this
Section must be made and kept as a part of the school student
record and subject to the access granted by Section 5. Such
record of release shall be maintained for the life of the
school student records and shall be available only to the
parent and the official records custodian. Each record of
release shall also include:
(1) The nature and substance of the information
released;
(2) The name and signature of the official records
custodian releasing such information;
(3) The name of the person requesting such information,
the capacity in which such a request has been made, and the
purpose of such request;
(4) The date of the release; and
(5) A copy of any consent to such release.
(d) Except for the student and his parents, no person to
whom information is released pursuant to this Section and no
person specifically designated as a representative by a parent
may permit any other person to have access to such information
without a prior consent of the parent obtained in accordance
with the requirements of subparagraph (8) of paragraph (a) of
this Section.

09800SB3092ham001 - 18 - LRB098 15075 KTG 59710 a
(e) Nothing contained in this Act shall prohibit the
publication of student directories which list student names,
addresses and other identifying information and similar
publications which comply with regulations issued by the State
Board.
(Source: P.A. 95-331, eff. 8-21-07; 95-793, eff. 1-1-09;
96-107, eff. 7-30-09; 96-1000, eff. 7-2-10.)
Section 10. The Children's Privacy Protection and Parental
Empowerment Act is amended by changing Section 10 as follows:
(325 ILCS 17/10)
Sec. 10. Prohibited act.
(a) The sale or purchase of personal information concerning
an individual known to be a child without parental consent is
prohibited.
(b) This Section does not apply when the sale or purchase
described in subsection (a) is made under a criminal or civil
investigation that is otherwise lawful.
(Source: P.A. 93-462, eff. 1-1-04.)
(325 ILCS 17/15 rep.)
Section 15. The Children's Privacy Protection and Parental
Empowerment Act is amended by repealing Section 15.".