Bill Text: IL SB3092 | 2013-2014 | 98th General Assembly | Engrossed

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Amends the P-20 Longitudinal Education Data System Act. Provides that if an audit or evaluation or a compliance or enforcement activity in connection with legal requirements that relate to State-supported or school district-supported educational programs requires or is used as the basis for granting access to personally identifiable information, the State Board of Education or a public school shall designate parties only under its direct control to act as authorized representatives to conduct the audit, evaluation, or activity. Limits the disclosure of personally identifiable information by the State Board or a public school with respect to (i) a contractor, consultant, or other party to whom the State Board or school has outsourced services or functions; (ii) a party conducting certain studies for or on behalf of the State Board or school; (iii) any party for a commercial use; or (iv) the provision of services other than contracting, studies, and audits or evaluations. Limits the maintenance of personally identifiable information and provides for disclosure and notification. Limits appending education records with personally identifiable information obtained from other federal or State agencies through data matches. Provides for civil penalties. Effective immediately.

Spectrum: Moderate Partisan Bill (Democrat 6-1)

Status: (Failed) 2015-01-13 - Session Sine Die [SB3092 Detail]

Download: Illinois-2013-SB3092-Engrossed.html

---

SB3092 Engrossed LRB098 15075 NHT 50039 b
AN ACT concerning education.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The P-20 Longitudinal Education Data System Act
is amended by adding Section 32 as follows:
(105 ILCS 13/32 new)
Sec. 32. Personally identifiable information limitations.
(a) In this Section:
"Education records" has the meaning ascribed to that term
in 34 CFR 99.3.
"Organization" means not-for-profit organizations, think
tanks, or other organizations conducting research studies.
"Personally identifiable information" means (i) any
personally identifiable information under the federal Family
Educational Rights Act of 1974 (FERPA), other than "directory
information" as that term is defined in Section 99.3 of the
federal regulations implementing FERPA (34 CFR 99.3), and (ii)
the personally identifiable information of teachers, other
educators, and school administrators, other than publicly
available, school-related information such as the name, school
location, and grade levels or subjects taught.
(b) If an audit or evaluation or a compliance or
enforcement activity in connection with legal requirements

SB3092 Engrossed - 2 - LRB098 15075 NHT 50039 b
that relate to State-supported or school district-supported
educational programs requires or is used as the basis for
granting access to personally identifiable information, the
State Board or a school shall designate parties only under
their direct control to act as authorized representatives to
conduct the audit, evaluation, or activity.
(c) The State Board or schools may not disclose any
personally identifiable information, including personally
identifiable information from education records of students,
to a contractor, consultant, or other party to whom the State
Board or school has outsourced services or functions without
providing notice to parents, guardians, and eligible students
by posting the intent to disclose the information on the
Internet website of the school or State Board at least 30 days
in advance or as soon as practicable, unless that outside
party:
(1) performs an institutional service or function for
which the State Board or the school would otherwise use
employees;
(2) is under the direct control of the State Board or
the school with respect to the use and maintenance of
education records;
(3) limits internal access to education records to
those individuals who are determined to have legitimate
educational interests;
(4) does not use the education records for any purposes

SB3092 Engrossed - 3 - LRB098 15075 NHT 50039 b
other than those authorized in its contract;
(5) does not disclose any personally identifiable
information to any other party (i) without the prior
notification to the eligible student, parent, or guardian
or (ii) unless required by law and the party provides a
notice of the disclosure to the State Board or school board
that provided the information no later than the time the
information is disclosed, to the extent allowed by law or
by the terms of a court order;
(6) maintains reasonable administrative, technical,
and physical safeguards to protect the security,
confidentiality, and integrity of personally identifiable
information in its custody and conducts regular security
audits to confirm the efficacy of those safeguards;
(7) uses appropriate encryption technologies to
protect data while in motion or in its custody from
unauthorized disclosure;
(8) has sufficient administrative and technical
procedures to monitor continuously the security of
personally identifiable information in its custody;
(9) maintains a breach remediation plan prior to
initial receipts of the personally identifiable
information and reports breaches as specified by the
Personal Information Protection Act;
(10) reports all actual security breaches to the State
Board or the school that provided personally identifiable

SB3092 Engrossed - 4 - LRB098 15075 NHT 50039 b
information and education records as soon as possible, but
no later than 72 hours after an actual breach was known or
in the most expedient amount of time possible under the
circumstances;
(11) agrees, in the event of a security breach or an
unauthorized disclosure of personally identifiable
information, to pay all costs and liabilities incurred by
the State Board or school related to the security breach or
unauthorized disclosure, including without limitation the
costs of responding to inquiries about the security breach
or unauthorized disclosure, of notifying the subjects of
personally identifiable information about the breach, of
mitigating the effects of the breach for the subjects of
personally identifiable information, and of investigating
the cause or consequences of the security breach or
unauthorized disclosure; and
(12) destroys or returns to the State Board or school
all personally identifiable information in its custody
upon request and at the termination of the contract.
(d) The State Board or schools may disclose personally
identifiable information from an education record of a student
without the consent of the eligible student, parent, or
guardian to a party conducting studies for or on behalf of the
State Board or school to (i) develop, validate, or administer
predictive tests, (ii) administer student aid programs, or
(iii) improve instruction, provided that the outside party

SB3092 Engrossed - 5 - LRB098 15075 NHT 50039 b
conducting the study meets all of the requirements for
contractors set forth in subsection (c) of this Section.
(d-5) The State Board or schools may disclose personally
identifiable information from an education record of a student
to researchers at an organization or accredited post-secondary
educational institution conducting research pursuant to a
specific, written agreement with the school or State Board and
in accordance with the federal Family Educational Rights and
Privacy Act of 1974, provided that:
(1) the nature of the research is first publicly
disclosed to parents, guardians, and eligible students on
the Internet website of the school or State Board at least
30 days in advance of the research being conducted or as
soon as practicable;
(2) the organization or institution and the school or
State Board enter into a data use agreement that complies
with the federal Family Educational Rights and Privacy Act
of 1974 and its accompanying rules; and
(3) the organization or institution uses personally
identifiable information from school student records only
to meet the purpose or purposes of the study as stated in
the written agreement.
For purposes of this subsection (d-5), any information by
which a student may be individually or personally identified
may only be released, transferred, disclosed, or otherwise
disseminated as contemplated by the agreement between the

SB3092 Engrossed - 6 - LRB098 15075 NHT 50039 b
parties. The school student records must be redacted prior to
analysis by the organization or institution. Any personally
identifiable information used to link data sets must be stored
in a secure data file or location outside of the secure data
storage where redacted information from the school regarding
student records is stored. The organization or institution
shall implement and adhere to policies and procedures that
restrict access to information by which a student may be
individually or personally identified. The organization or
institution shall designate an individual to act as the
custodian of the personally identifiable information who is
responsible for restricting access to that information.
Nothing in this subsection (d-5) prohibits or limits the
ability of the State Board or any school to provide personally
identifiable information about individual students to a school
official, organization, or institution for the purposes of
developing, administering, scoring, or interpreting results of
student assessments or predictive tests if those assessments or
tests require individualized development or administration
based on the needs of individual students.
(e) The State Board or schools may not disclose any
personally identifiable information, including personally
identifiable information from education records of students,
without the written consent of eligible students, parents, or
guardians to any party for a commercial use, including without
limitation marketing products or services, compiling lists for

SB3092 Engrossed - 7 - LRB098 15075 NHT 50039 b
sale or rental, developing products or services, or creating
individual, household, or group profiles, nor may such
disclosure be made for the provision of services other than
contracting, studies, and audits or evaluations as authorized
and limited by subsections (c), (d), and (d-5) of this Section.
(f) The State Board or schools may not, directly or through
contracts with outside parties, maintain personally
identifiable information, including personally identifiable
information from education records of students, without the
proper notification to eligible students, parents, or
guardians, unless the maintenance of the information is:
(1) explicitly mandated in federal or State statute;
(2) administratively required for the proper
performance of their duties under the law and is relevant
to and necessary for the delivery of services; or
(3) designed to support a study of students or former
students.
(g) The State Board and schools shall publicly and
conspicuously disclose on their Internet websites and through
annual electronic notification to the chairperson of the House
of Representatives Elementary & Secondary Education Committee
and the chairperson of the Senate Education Committee the
existence and character of any personally identifiable
information that they, directly or through contracts with
outside parties, maintain. The disclosure and notification
shall include:

SB3092 Engrossed - 8 - LRB098 15075 NHT 50039 b
(1) the name and location of the data repository where
the information is maintained;
(2) the legal authority that authorizes the
establishment and existence of the data repository;
(3) the principal purpose or purposes for which the
information is intended to be used;
(4) the categories of individuals on whom records are
maintained in the data repository;
(5) the categories of records maintained in the data
repository;
(6) each expected disclosure of the records contained
in the data repository, including the categories of
recipients and the purpose of each disclosure;
(7) the policies and practices of the State Board or
school regarding storage, retrievability, access controls,
retention, and disposal of the records;
(8) the title and business address of the State Board
or school official who is responsible for the data
repository and the name and business address of any
contractor or other outside party maintaining the data
repository for or on behalf of the State Board or school;
(9) the procedures whereby eligible students, parents,
or guardians can be notified at their request if the data
repository contains a record pertaining to the student,
parent, or guardian;
(10) the procedures whereby eligible students,

SB3092 Engrossed - 9 - LRB098 15075 NHT 50039 b
parents, or guardians can be notified at their request on
how to gain access to any record pertaining to the student,
parent, or guardian contained in the data repository and
how they can contest its content; and
(11) the categories of sources of records in the data
repository.
(h) The State Board and schools may not append education
records with personally identifiable information obtained from
other federal or State agencies through data matches without
the proper notification to eligible students, parents, or
guardians unless the data matches are:
(1) explicitly mandated in federal or State statute;
(2) administratively required for the proper
performance of their duties under the law and are relevant
to and necessary for the delivery of services; or
(3) designed to support a study of students or former
students.
(i) Any person aggrieved by any violation of this Section
may institute an action for injunctive relief in the circuit
court of the county in which the violation has occurred or the
circuit court of the county in which the school is located. Any
person injured by a willful or negligent violation of this
Section may institute an action for damages in the circuit
court of the county in which the violation has occurred or the
circuit court of the county in which the school is located. In
the case of any successful action under this paragraph, any

SB3092 Engrossed - 10 - LRB098 15075 NHT 50039 b
person or school found to have willfully or negligently
violated any provision of this Section is liable to the
plaintiff for the plaintiff's damages, the costs of the action,
and reasonable attorney's fees, as determined by the court.
Actions for injunctive relief to secure compliance with
this Section may be brought by the State Board, by the State's
Attorney of the county in which the alleged violation has
occurred or the State's Attorney of the county in which the
school is located, in each case in the circuit court of such
county.
Willful failure to comply with this Section is a petty
offense, except that any person who willfully and maliciously
falsifies any school student record, student permanent record,
or student temporary record is guilty of a Class A misdemeanor.
Absent proof of malice, no cause of action or claim for
relief, civil or criminal, may be maintained against any
school, employee or official of a school, or person acting at
the direction of a school for any statement made or judgment
expressed in any entry to a school student record of a type
that does not violate this Section or rules adopted by the
State Board, provided that this paragraph does not limit or
deny any defense available under existing law.
(j) Nothing contained in this Section shall be construed as
creating a private right of action against the State Board or a
school.
(k) Nothing in this Section shall limit the administrative

SB3092 Engrossed - 11 - LRB098 15075 NHT 50039 b
use of personally identifiable information by a person acting
exclusively in the person's capacity as an employee of a
school, this State, a court, or the federal government that is
otherwise required by law.
Section 99. Effective date. This Act takes effect upon
becoming law.