SB2018 100TH GENERAL ASSEMBLY

LRB100 09670 NHT 19839 b

100TH GENERAL ASSEMBLY
State of Illinois
2017 and 2018
SB2018

Introduced 2/10/2017, by Sen. Thomas Cullerton

SYNOPSIS AS INTRODUCED:

New Act

Creates the Student Data Privacy Act. On and after October 1, 2017, requires the school board of a school district to enter into a written contract with a contractor any time the school board shares or provides access to student information, student records, or student-generated content with that contractor. Among other provisions, sets forth provisions concerning contract requirements, contractor and operator requirements and prohibitions, security breach procedures, and the establishment of a task force to study issues relating to student data privacy. Effective immediately.

FISCAL NOTE ACT MAY APPLY

STATE MANDATES ACT MAY REQUIRE REIMBURSEMENT

A BILL FOR

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Student Data Privacy Act.

Section 5. Definitions. In this Act:

"Contractor" means an operator or consultant that is in possession of or has access to student information, student records, or student-generated content as a result of a contract with a school board.

"Consultant" means a professional who provides noninstructional services, including, but not limited to, administrative, planning, analysis, statistical or research services, to a school board pursuant to a contract with the school board.

"De-identified student information" means any student information that has been altered to prevent the identification of an individual student.

"Directory information" has the same meaning as provided in 34 CFR 99.3.

"Operator" means any person who (i) operates an Internet web site, online service, or mobile application with actual knowledge that the Internet web site, online service, or mobile application is used for school purposes and was designed and marketed for school purposes, to the extent it is engaged in the operation of that Internet web site, online service, or mobile application, and (ii) collects, maintains, or uses student information.

"Persistent unique identifier" means a unique piece of information that can be used to recognize a user over time and across different Internet web sites, online services, or mobile applications and is acquired as a result of a student's use of an operator's Internet web site, online service, or mobile application.

"School purposes" means purposes that customarily take place at the direction of a teacher or a school board or aid in the administration of school activities, including, but not limited to, instruction in the classroom, administrative activities, and collaboration among students, school personnel, or parents or legal guardians of students.

"Student" means a person who is a resident of this State and who is (i) enrolled in a school district's preschool program, (ii) enrolled in any of grades kindergarten through 12 in a public school, (iii) receiving special education and related services under an individualized education program, or (iv) otherwise the responsibility of a school district.

"Student-generated content" means any student materials created by a student, including, but not limited to, essays, research papers, portfolios, creative writing, music or other audio files, or photographs, except "student-generated content" does not include student responses to a standardized assessment.

"Student information" means personally identifiable information or material of a student in any media or format that is not publicly available and is any of the following: (i) created or provided by a student or the parent or legal guardian of a student to the operator in the course of the student, parent, or legal guardian using the operator's Internet web site, online service, or mobile application for school purposes, (ii) created or provided by an employee or agent of a school board to an operator for school purposes, or (iii) gathered by an operator through the operation of the operator's Internet web site, online service, or mobile application and identifies a student, including, but not limited to, information in the student's records or electronic mail account, first or last name, home address, telephone number, date of birth, electronic mail address, discipline records, test results, grades, evaluations, criminal records, medical records, health records, Social Security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious affiliations, text messages, documents, student identifiers, search activity, photographs, voice recordings, survey responses, or behavioral assessments.

"Student record" means any information directly related to a student that is maintained by a school board or the State Board of Education or any information acquired from a student through the use of educational software assigned to the student by a teacher or employee of a school board, except "student record" does not include de-identified student information allowed under a contract to be used by the contractor to (i) improve educational products for adaptive learning purposes and customize student learning, (ii) demonstrate the effectiveness of the contractor's products in the marketing of those products, and (iii) develop and improve the contractor's products and services.

"Targeted advertising" means presenting an advertisement to a student where the selection of the advertisement is based on student information, student records, or student-generated content or inferred over time from the usage of the operator's Internet web site, online service, or mobile application by a student or the retention of a student's online activities or requests over time for the purpose of targeting subsequent advertisements. "Targeted advertising" does not include any advertising to a student on an Internet web site that the student is accessing at the time or in response to a student's response or request for information or feedback.

Section 10. Contract required.

(a) This Section applies beginning on October 1, 2017 and is applicable to contracts entered into, amended, or renewed on or after October 1, 2017. On and after October 1, 2017, the school board of a school district shall enter into a written contract with a contractor any time the school board shares or provides access to student information, student records, or student-generated content with the contractor. Each contract shall include, but need not be limited to, the following:

(1) a statement that student information, student records, and student-generated content are not the property of or under the control of a contractor;

(2) a description of the means by which the school board may request the deletion of student information, student records, or student-generated content in the possession of the contractor;

(3) a statement that the contractor shall not use student information, student records, and student-generated content for any purposes other than those authorized pursuant to the contract;

(4) a description of the procedures by which a student or parent or legal guardian of a student may review personally identifiable information contained in student information, student records, or student-generated content and correct erroneous information, if any, in the student record;

(5) a statement that the contractor shall take actions designed to ensure the security and confidentiality of student information, student records, and student-generated content;

(6) a description of the procedures that a contractor will follow to notify the school board, in accordance with the provisions of Section 20 of this Act, when there has been an unauthorized release, disclosure, or acquisition of student information, student records, or student-generated content;

(7) a statement that student information, student records, or student-generated content shall not be retained or available to the contractor upon completion of the contracted services unless a student or parent or legal guardian of a student chooses to establish or maintain an electronic account with the contractor for the purpose of storing student-generated content;

(8) a statement that the contractor and the school board shall ensure compliance with the federal Family Educational Rights and Privacy Act of 1974;

(9) a statement that the laws of this State shall govern the rights and duties of the contractor and the school board; and

(10) a statement that if any provision of the contract or the application of the contract is held invalid by a court of competent jurisdiction, the invalidity does not affect other provisions or applications of the contract that can be given effect without the invalid provision or application.

(b) All student-generated content shall be the property of the student or the parent or legal guardian of the student.

(c) A contractor shall implement and maintain security procedures and practices designed to protect student information, student records, and student-generated content from unauthorized access, destruction, use, modification, or disclosure that, based on the sensitivity of the data and the risk from unauthorized access:

(1) use technologies and methodologies that are consistent with the guidance issued pursuant to Section 13402(h)(2) of Public Law 111-5, as amended from time to time;

(2) maintain technical safeguards as it relates to the possession of student records in a manner consistent with the provisions of 45 CFR 164.312; and

(3) otherwise meet or exceed industry standards.

(d) A contractor shall not use (i) student information, student records, or student-generated content for any purposes other than those authorized pursuant to the contract or (ii) personally identifiable information contained in student information, student records, or student-generated content to engage in targeted advertising.

(e) Any provision of a contract entered into between a contractor and a school board on or after October 1, 2017 that conflicts with any provision of this Section shall be void.

(f) Any contract entered into on or after October 1, 2017 that does not include a provision required by subsection (a) of this Section shall be void, provided that the school board has given reasonable notice to the contractor and the contractor has failed within a reasonable time to amend the contract to include the provision required by subsection (a) of this Section.

(g) Not later than 5 business days after executing a contract pursuant to this Section, a school board shall provide electronic notice to any student and the parent or legal guardian of a student affected by the contract. The notice shall (i) state that the contract has been executed and the date that the contract was executed, (ii) provide a brief description of the contract and the purpose of the contract, and (iii) state what student information, student records, or student-generated content may be collected as a result of the contract. The school board shall post the notice and the contract on the school district's Internet web site.

Section 15. Operators.

(a) This Section applies beginning October 1, 2017. An operator shall:

(1) implement and maintain security procedures and practices that meet or exceed industry standards and that are designed to protect student information, student records, and student-generated content from unauthorized access, destruction, use, modification, or disclosure; and

(2) delete any student information, student records, or student-generated content within a reasonable amount of time if a student, parent or legal guardian of a student, or school board that has the right to control the student information requests the deletion of the student information, student records, or student-generated content.

(b) An operator shall not knowingly:

(1) engage in (i) targeted advertising on the operator's Internet web site, online service, or mobile application or (ii) targeted advertising on any other Internet web site, online service, or mobile application if the advertising is based on any student information, student records, student-generated content, or persistent unique identifiers that the operator has acquired because of the use of the operator's Internet web site, online service, or mobile application for school purposes;

(2) collect, store, and use student information, student records, student-generated content, or persistent unique identifiers for purposes other than the furtherance of school purposes;

(3) sell, rent, or trade student information, student records, or student-generated content unless the sale is part of the purchase, merger, or acquisition of an operator by a successor operator and the operator and successor operator continue to be subject to the provisions of this Section regarding student information; or

(4) disclose student information, student records, or student-generated content unless the disclosure is made:

(A) in furtherance of school purposes of the Internet web site, online service, or mobile application, provided that the recipient of the student information uses the student information to improve the operability and functionality of the Internet web site, online service, or mobile application and complies with subsection (a) of this Section;

(B) to ensure compliance with federal or State law or rules or pursuant to a court order;

(C) in response to a judicial order;

(D) to protect the safety or integrity of users or others or the security of the Internet web site, online service, or mobile application;

(E) to an entity hired by the operator to provide services for the operator's Internet web site, online service, or mobile application, provided that the operator contractually (i) prohibits the entity from using student information, student records, or student-generated content for any purpose other than providing the contracted service to or on behalf of the operator, (ii) prohibits the entity from disclosing student information, student records, or student-generated content provided by the operator to subsequent third parties, and (iii) requires the entity to comply with subsection (a) of this Section; or

(F) for a school purpose or other educational or employment purpose requested by a student or the parent or legal guardian of a student, provided that the student information is not used or disclosed for any other purpose.

(c) An operator may use student information:

(1) to maintain, support, improve, evaluate, or diagnose the operator's Internet web site, online service, or mobile application;

(2) for adaptive learning purposes or customized student learning;

(3) to provide recommendation engines to recommend content or services relating to school purposes or other educational or employment purposes, provided that the recommendation is not determined in whole or in part by payment or other consideration from a third party; or

(4) to respond to a request for information or feedback from a student, provided that the response is not determined in whole or in part by payment or other consideration from a third party.

(d) An operator may use de-identified student information or aggregated student information:

(1) to develop or improve the operator's Internet web site, online service, or mobile application or other Internet web sites, online services, or mobile applications owned by the operator; or

(2) to demonstrate or market the effectiveness of the operator's Internet web site, online service, or mobile application.

(e) An operator may share aggregated student information or de-identified student information for the improvement and development of Internet web sites, online services, or mobile applications designed for school purposes.

(f) Nothing in this Section shall be construed to:

(1) limit the ability of a law enforcement agency to obtain student information, student records, or student-generated content from an operator as authorized by law or pursuant to a court order;

(2) limit the ability of a student or the parent or legal guardian of a student to download, export, transfer, or otherwise save or maintain student information, student records, or student-generated content;

(3) impose a duty upon a provider of an interactive computer service, as defined in 47 U.S.C. 230, to ensure compliance with this Section by third-party information content providers, as defined in 47 U.S.C. 230;

(4) impose a duty upon a seller or provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software applications to review or enforce compliance with this Section on the software applications;

(5) limit an Internet service provider from providing a student, parent or legal guardian of a student, or school board with the ability to connect to the Internet;

(6) prohibit an operator from advertising other Internet web sites, online services, or mobile applications that are used for school purposes to parents or legal guardians of students, provided that the advertising does not result from the operator's use of student information, student records, or student-generated content; or

(7) apply to Internet web sites, online services, or mobile applications that are designed and marketed for use by individuals generally, even if the account credentials created for an operator's Internet web site, online service, or mobile application may be used to access Internet web sites, online services, or mobile applications that are designed and marketed for school purposes.

Section 20. Security breach.

(a) This Section applies beginning October 1, 2017.

(1) Upon the discovery of a breach of security that results in the unauthorized release, disclosure, or acquisition of student information, excluding any directory information contained in the student information, a contractor shall notify, without unreasonable delay, but not more than 30 days after the discovery, the school board of the breach of security. During the 30-day period, the contractor may:

(A) conduct an investigation to determine the nature and scope of the unauthorized release, disclosure, or acquisition and the identity of the students whose student information is involved in the unauthorized release, disclosure, or acquisition; or

(B) restore the reasonable integrity of the contractor's data system.

(2) Upon the discovery of a breach of security that results in the unauthorized release, disclosure, or acquisition of directory information, student records, or student-generated content, a contractor shall notify, without unreasonable delay, but not more than 60 days after the discovery, the school board of the breach of security. During the 60-day period, the contractor may:

(A) conduct an investigation to determine the nature and scope of the unauthorized release, disclosure, or acquisition and the identity of the students whose directory information, student records, or student-generated content is involved in the unauthorized release, disclosure, or acquisition; or

(B) restore the reasonable integrity of the contractor's data system.

(3) Upon receipt of notice of a breach of security under subdivisions (1) or (2) of this subsection (a), a school board shall electronically notify, not later than 48 hours after receipt of the notice, the student and the parents or legal guardians of the student whose student information, student records, or student-generated content is involved in the breach of security. The school board shall post the notice on the school district's Internet web site.

(b) Upon the discovery of a breach of security that results in the unauthorized release, disclosure, or acquisition of student information, student records, or student-generated content, an operator that is in possession of or maintains student information, student records, or student-generated content as a result of a student's use of the operator's Internet web site, online service, or mobile application shall:

(1) notify, without unreasonable delay, but not more than 30 days after the discovery, the student or the parents or legal guardians of the student of any breach of security that results in the unauthorized release, disclosure, or acquisition of student information, excluding any directory information contained in the student information; and

(2) notify, without unreasonable delay, but not more than 60 days after the discovery, the student or the parents or legal guardians of the student of any breach of security that results in the unauthorized release, disclosure, or acquisition of directory information, student records, or student-generated content of the student.

During the 30-day or 60-day period, the operator may (i) conduct an investigation to determine the nature and scope of the unauthorized release, disclosure, or acquisition and the identity of the students whose student information, student records, or student-generated content are involved in the unauthorized release, disclosure, or acquisition or (ii) restore the reasonable integrity of the operator's data system.

Section 25. Task force.

(a) There is established a task force to study issues relating to student data privacy. The study shall include, but not be limited to, an examination of:

(1) when a parent or legal guardian of a student may reasonably or appropriately request the deletion of student information, student records, or student-generated content that is in the possession of a contractor or operator;

(2) means of providing notice to parents and legal guardians of students when a student uses an Internet web site, online service, or mobile application of an operator for instructional purposes in a classroom or as part of an assignment by a teacher;

(3) reasonable penalties for violations of this Act, such as restricting a contractor or operator from accessing or collecting student information, student records, or student-generated content;

(4) strategies in effect in other states that ensure that school employees, contractors, and operators are trained in data security handling, compliance, and best practices;

(5) the feasibility of developing a school district-wide list of approved Internet web sites, online services, and mobile applications;

(6) the use of an administrative hearing process designed to provide legal recourse to students and parents and legal guardians of students aggrieved by any violation of this Act;

(7) the feasibility of creating an inventory of student information, student records, and student-generated content currently collected pursuant to State and federal law;

(8) the feasibility of developing a tool kit for use by school boards to:

(A) improve student data contracting practices and compliance, including a statewide template for use by districts;

(B) increase school employee awareness of student data security best practices, including model training components;

(C) develop district-wide lists of approved software applications and Internet web sites; and

(D) increase the availability and accessibility of information on student data privacy for parents and legal guardians of students and educators; and

(9) any other issue involving student data security that the task force deems relevant.

(b) The task force shall consist of all of the following members, who shall serve without compensation but may be reimbursed for their reasonable and necessary expenses from funds appropriated for that purpose:

(1) Members appointed by the State Superintendent of Education as follows:

(A) One operator, one representative of a contractor, and 2 experts in information technology systems.

(B) One representative or member of a statewide professional teachers' organization and one representative or member of a different statewide professional teachers' organization.

(C) One representative or member of a statewide parent teacher association and one high school student in this State.

(D) One student privacy advocate.

(E) One representative or member of a statewide association of school boards.

(F) One representative of a statewide association of school administrators and one representative or member of a statewide association of school district superintendents.

(2) The Attorney General or the Attorney General's designee.

(3) The State Superintendent of Education, who shall serve as chairperson.

(c) All appointments to the task force shall be made not later than 30 days after the effective date of this Act. Any vacancy shall be filled by the appointing authority.

(d) The chairperson shall schedule the first meeting of the task force, which shall be held not later than 60 days after the effective date of this Act.

(e) The State Board of Education shall provide administrative and other support to the task force.

(f) Not later than January 1, 2018, the task force shall submit a report on its findings and recommendations to the General Assembly. The task force shall terminate on the date that it submits its report or January 1, 2018, whichever is later.

(g) This Section is repealed on January 1, 2019.

Section 99. Effective date. This Act takes effect upon becoming law.