Bill Text: IL SB3092 | 2013-2014 | 98th General Assembly | Amended

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Amends the P-20 Longitudinal Education Data System Act. Provides that if an audit or evaluation or a compliance or enforcement activity in connection with legal requirements that relate to State-supported or school district-supported educational programs requires or is used as the basis for granting access to personally identifiable information, the State Board of Education or a public school shall designate parties only under its direct control to act as authorized representatives to conduct the audit, evaluation, or activity. Limits the disclosure of personally identifiable information by the State Board or a public school with respect to (i) a contractor, consultant, or other party to whom the State Board or school has outsourced services or functions; (ii) a party conducting certain studies for or on behalf of the State Board or school; (iii) any party for a commercial use; or (iv) the provision of services other than contracting, studies, and audits or evaluations. Limits the maintenance of personally identifiable information and provides for disclosure and notification. Limits appending education records with personally identifiable information obtained from other federal or State agencies through data matches. Provides for civil penalties. Effective immediately.

Spectrum: Moderate Partisan Bill (Democrat 6-1)

Status: (Failed) 2015-01-13 - Session Sine Die [SB3092 Detail]

Download: Illinois-2013-SB3092-Amended.html

---

Sen. William Delgado

Filed: 4/10/2014

09800SB3092sam001 LRB098 15075 NHT 58512 a
AMENDMENT TO SENATE BILL 3092
AMENDMENT NO. ______. Amend Senate Bill 3092 by replacing
everything after the enacting clause with the following:
"Section 5. The P-20 Longitudinal Education Data System Act
is amended by adding Section 32 as follows:
(105 ILCS 13/32 new)
Sec. 32. Personally identifiable information limitations.
(a) In this Section:
"Education records" has the meaning ascribed to that term
in 34 CFR 99.3.
"Organization" means not-for-profit organizations, think
tanks, or other organizations conducting research studies.
"Personally identifiable information" means (i) any
personally identifiable information under the federal Family
Educational Rights Act of 1974 (FERPA), other than "directory
information" as that term is defined in Section 99.3 of the

09800SB3092sam001 - 2 - LRB098 15075 NHT 58512 a
federal regulations implementing FERPA (34 CFR 99.3), and (ii)
the personally identifiable information of teachers, other
educators, and school administrators, other than publicly
available, school-related information such as the name, school
location, and grade levels or subjects taught.
(b) If an audit or evaluation or a compliance or
enforcement activity in connection with legal requirements
that relate to State-supported or school district-supported
educational programs requires or is used as the basis for
granting access to personally identifiable information, the
State Board or a school shall designate parties only under
their direct control to act as authorized representatives to
conduct the audit, evaluation, or activity.
(c) The State Board or schools may not disclose any
personally identifiable information, including personally
identifiable information from education records of students,
to a contractor, consultant, or other party to whom the State
Board or school has outsourced services or functions without
providing notice to parents, guardians, and eligible students
by posting the intent to disclose the information on the
Internet website of the school or State Board at least 30 days
in advance or as soon as practicable, unless that outside
party:
(1) performs an institutional service or function for
which the State Board or the school would otherwise use
employees;

09800SB3092sam001 - 3 - LRB098 15075 NHT 58512 a
(2) is under the direct control of the State Board or
the school with respect to the use and maintenance of
education records;
(3) limits internal access to education records to
those individuals who are determined to have legitimate
educational interests;
(4) does not use the education records for any purposes
other than those authorized in its contract;
(5) does not disclose any personally identifiable
information to any other party (i) without the prior
notification to the eligible student, parent, or guardian
or (ii) unless required by law and the party provides a
notice of the disclosure to the State Board or school board
that provided the information no later than the time the
information is disclosed, to the extent allowed by law or
by the terms of a court order;
(6) maintains reasonable administrative, technical,
and physical safeguards to protect the security,
confidentiality, and integrity of personally identifiable
information in its custody and conducts regular security
audits to confirm the efficacy of those safeguards;
(7) uses appropriate encryption technologies to
protect data while in motion or in its custody from
unauthorized disclosure;
(8) has sufficient administrative and technical
procedures to monitor continuously the security of

09800SB3092sam001 - 4 - LRB098 15075 NHT 58512 a
personally identifiable information in its custody;
(9) maintains a breach remediation plan prior to
initial receipts of the personally identifiable
information and reports breaches as specified by the
Personal Information Protection Act;
(10) reports all actual security breaches to the State
Board or the school that provided personally identifiable
information and education records as soon as possible, but
no later than 72 hours after an actual breach was known or
in the most expedient amount of time possible under the
circumstances;
(11) agrees, in the event of a security breach or an
unauthorized disclosure of personally identifiable
information, to pay all costs and liabilities incurred by
the State Board or school related to the security breach or
unauthorized disclosure, including without limitation the
costs of responding to inquiries about the security breach
or unauthorized disclosure, of notifying the subjects of
personally identifiable information about the breach, of
mitigating the effects of the breach for the subjects of
personally identifiable information, and of investigating
the cause or consequences of the security breach or
unauthorized disclosure; and
(12) destroys or returns to the State Board or school
all personally identifiable information in its custody
upon request and at the termination of the contract.

09800SB3092sam001 - 5 - LRB098 15075 NHT 58512 a
(d) The State Board or schools may disclose personally
identifiable information from an education record of a student
without the consent of the eligible student, parent, or
guardian to a party conducting studies for or on behalf of the
State Board or school to (i) develop, validate, or administer
predictive tests, (ii) administer student aid programs, or
(iii) improve instruction, provided that the outside party
conducting the study meets all of the requirements for
contractors set forth in subsection (c) of this Section.
(d-5) The State Board or schools may disclose personally
identifiable information from an education record of a student
to researchers at an organization or accredited post-secondary
educational institution conducting research pursuant to a
specific, written agreement with the school or State Board and
in accordance with the federal Family Educational Rights and
Privacy Act of 1974, provided that:
(1) the nature of the research is first publicly
disclosed to parents, guardians, and eligible students on
the Internet website of the school or State Board at least
30 days in advance of the research being conducted or as
soon as practicable;
(2) the organization or institution and the school or
State Board enter into a data use agreement that complies
with the federal Family Educational Rights and Privacy Act
of 1974 and its accompanying rules and includes, at a
minimum, the following:

09800SB3092sam001 - 6 - LRB098 15075 NHT 58512 a
(A) the purpose, scope, and duration of the study
or studies and the information to be disclosed;
(B) provisions requiring the organization or
institution to use personally identifiable information
from school student records only to meet the purpose or
purposes of the study as stated in the written
agreement;
(C) provisions requiring the organization or
institution to conduct the study in a manner that does
not permit personal identification of parents or
guardians and students by anyone other than
representatives of the organization with legitimate
interests;
(D) provisions requiring the organization or
institution to destroy all personally identifiable
information when the information is no longer needed
for the purposes for which the study was conducted and
specifying the time period in which the information
must be destroyed;
(E) provisions requiring the organization or
institution to certify that it has the capacity to and
will restrict access to the school student records and
maintain the security of electronic information; and
(F) provisions requiring the organization or
institution to develop, implement, maintain, and use
appropriate administrative, technical, and physical

09800SB3092sam001 - 7 - LRB098 15075 NHT 58512 a
security measures to preserve the confidentiality,
integrity, and availability of all school student
records; and
(3) the organization or institution uses personally
identifiable information from school student records only
to meet the purpose or purposes of the study as stated in
the written agreement.
For purposes of this subsection (d-5), any information by
which a student may be individually or personally identified
may only be released, transferred, disclosed, or otherwise
disseminated as contemplated by the agreement between the
parties. The school student records must be redacted prior to
analysis by the organization or institution. Any personally
identifiable information used to link data sets must be stored
in a secure data file or location outside of the secure data
storage where redacted information from the school regarding
student records is stored. The organization or institution
shall implement and adhere to policies and procedures that
restrict access to information by which a student may be
individually or personally identified. The organization or
institution shall designate an individual to act as the
custodian of the personally identifiable information who is
responsible for restricting access to that information.
Nothing in this subsection (d-5) prohibits or limits the
ability of the State Board or any school to provide personally
identifiable information about individual students to a school

09800SB3092sam001 - 8 - LRB098 15075 NHT 58512 a
official, organization, or institution for the purposes of
developing, administering, scoring, or interpreting results of
student assessments or predictive tests if those assessments or
tests require individualized development or administration
based on the needs of individual students.
(e) The State Board or schools may not disclose any
personally identifiable information, including personally
identifiable information from education records of students,
without the written consent of eligible students, parents, or
guardians to any party for a commercial use, including without
limitation marketing products or services, compiling lists for
sale or rental, developing products or services, or creating
individual, household, or group profiles, nor may such
disclosure be made for the provision of services other than
contracting, studies, and audits or evaluations as authorized
and limited by subsections (c), (d), and (d-5) of this Section.
(f) The State Board or schools may not, directly or through
contracts with outside parties, maintain personally
identifiable information, including personally identifiable
information from education records of students, without the
proper notification to eligible students, parents, or
guardians, unless the maintenance of the information is:
(1) explicitly mandated in federal or State statute;
(2) administratively required for the proper
performance of their duties under the law and is relevant
to and necessary for the delivery of services; or

09800SB3092sam001 - 9 - LRB098 15075 NHT 58512 a
(3) designed to support a study of students or former
students.
(g) The State Board and schools shall publicly and
conspicuously disclose on their Internet websites and through
annual electronic notification to the chairperson of the House
of Representatives Elementary & Secondary Education Committee
and the chairperson of the Senate Education Committee the
existence and character of any personally identifiable
information that they, directly or through contracts with
outside parties, maintain. The disclosure and notification
shall include:
(1) the name and location of the data repository where
the information is maintained;
(2) the legal authority that authorizes the
establishment and existence of the data repository;
(3) the principal purpose or purposes for which the
information is intended to be used;
(4) the categories of individuals on whom records are
maintained in the data repository;
(5) the categories of records maintained in the data
repository;
(6) each expected disclosure of the records contained
in the data repository, including the categories of
recipients and the purpose of each disclosure;
(7) the policies and practices of the State Board or
school regarding storage, retrievability, access controls,

09800SB3092sam001 - 10 - LRB098 15075 NHT 58512 a
retention, and disposal of the records;
(8) the title and business address of the State Board
or school official who is responsible for the data
repository and the name and business address of any
contractor or other outside party maintaining the data
repository for or on behalf of the State Board or school;
(9) the procedures whereby eligible students, parents,
or guardians can be notified at their request if the data
repository contains a record pertaining to the student,
parent, or guardian;
(10) the procedures whereby eligible students,
parents, or guardians can be notified at their request on
how to gain access to any record pertaining to the student,
parent, or guardian contained in the data repository and
how they can contest its content; and
(11) the categories of sources of records in the data
repository.
(h) The State Board and schools may not append education
records with personally identifiable information obtained from
other federal or State agencies through data matches without
the proper notification to eligible students, parents, or
guardians unless the data matches are:
(1) explicitly mandated in federal or State statute; or
(2) administratively required for the proper
performance of their duties under the law and are relevant
to and necessary for the delivery of services.

09800SB3092sam001 - 11 - LRB098 15075 NHT 58512 a
(i) Each violation of this Section by an organization or
entity that is not the State Board or a school is subject to a
civil penalty of up to $1,000 for a first violation, up to
$5,000 for a second violation, and up to $10,000 for a third or
subsequent violation. Each violation involving a different
individual's personally identifiable information shall be
considered a separate violation for purposes of civil
penalties.
(j) The Attorney General shall have the authority to
enforce compliance with this Section by investigation and
subsequent commencement of a civil action to seek civil
penalties for violations of this Section and to seek
appropriate injunctive relief, including without limitation a
prohibition on obtaining personally identifiable information
for an appropriate time period. In carrying out an
investigation and in maintaining a civil action, the Attorney
General or any deputy or assistant Attorney General is
authorized to subpoena witnesses, compel their attendance,
examine them under oath, and require that any books, records,
documents, papers, or electronic records relevant or material
to the inquiry be turned over for inspection, examination, or
audit, pursuant to the Civil Practice Law and rules. Subpoenas
issued pursuant to this subsection (j) may be enforced pursuant
to the Civil Practice Law and rules.
(k) Nothing contained in this Section shall be construed as
creating a private right of action against the State Board or a

09800SB3092sam001 - 12 - LRB098 15075 NHT 58512 a
school.
(l) Nothing in this Section shall limit the administrative
use of personally identifiable information by a person acting
exclusively in the person's capacity as an employee of a
school, this State, a court, or the federal government that is
otherwise required by law.
Section 99. Effective date. This Act takes effect upon
becoming law.".