SB3099 100TH GENERAL ASSEMBLY

LRB100 18745 AXK 33979 b

100TH GENERAL ASSEMBLY
State of Illinois
2017 and 2018
SB3099

Introduced 2/15/2018, by Sen. Jennifer Bertino-Tarrant

SYNOPSIS AS INTRODUCED:

105 ILCS 85/10
105 ILCS 85/20

Amends the Student Online Personal Protection Act. Provides that a national assessment provider may sell or rent a student's information if the provider secures express written consent from the student or the parent or guardian of the student given in response to a clear and conspicuous notice and the information is used solely to provide access to employment, educational scholarships or financial aid, or post-secondary educational opportunities. Provides that an operator may use or disclose covered information of a student, if no information is used for advertising or to amass a profile on the student for purposes other than K through 12 school purposes, for legitimate research purposes as required or allowed by State or federal law and in furtherance of K through 12 school purposes or post-secondary educational purposes (instead of for legitimate research purposes as required or allowed by State or federal law and under the direction of a school, a school district, or the State Board of Education if the information is not used for advertising or to amass a profile on the student for purposes other than for K through 12 school purposes). Effective immediately.

FISCAL NOTE ACT MAY APPLY

A BILL FOR

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Student Online Personal Protection Act is amended by changing Sections 10 and 20 as follows:

(105 ILCS 85/10)

Sec. 10. Operator prohibitions. An operator shall not knowingly do any of the following:

(1) Engage in targeted advertising on the operator's site, service, or application or target advertising on any other site, service, or application if the targeting of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator's site, service, or application for K through 12 school purposes.

(2) Use information, including persistent unique identifiers, created or gathered by the operator's site, service, or application to amass a profile about a student, except in furtherance of K through 12 school purposes. "Amass a profile" does not include the collection and retention of account information that remains under the control of the student, the student's parent or legal guardian, or the school.

(3) Sell or rent a student's information, including covered information. This subdivision (3) does not apply to the purchase, merger, or other type of acquisition of an operator by another entity if the operator or successor entity complies with this Act regarding previously acquired student information or to a national assessment provider if the provider secures express written consent from the student or the parent or legal guardian of the student given in response to a clear and conspicuous notice and the information is used solely to provide access to employment, educational scholarships or financial aid, or post-secondary educational opportunities.

(4) Except as otherwise provided in Section 20 of this Act, disclose covered information, unless the disclosure is made for the following purposes:

(A) In furtherance of the K through 12 school purposes of the site, service, or application if the recipient of the covered information disclosed under this clause (A) does not further disclose the information, unless done to allow or improve operability and functionality of the operator's site, service, or application.

(B) To ensure legal and regulatory compliance or take precautions against liability.

(C) To respond to the judicial process.

(D) To protect the safety or integrity of users of the site or others or the security of the site, service, or application.

(E) For a school, educational, or employment purpose requested by the student or the student's parent or legal guardian, provided that the information is not used or further disclosed for any other purpose.

(F) To a third party if the operator contractually prohibits the third party from using any covered information for any purpose other than providing the contracted service to or on behalf of the operator, prohibits the third party from disclosing any covered information provided by the operator with subsequent third parties, and requires the third party to implement and maintain reasonable security procedures and practices.

Nothing in this Section prohibits the operator's use of information for maintaining, developing, supporting, improving, or diagnosing the operator's site, service, or application.

(Source: P.A. 100-315, eff. 8-24-17.)

(105 ILCS 85/20)

Sec. 20. Permissive use or disclosure. An operator may use or disclose covered information of a student under the following circumstances:

(1) If other provisions of federal or State law require the operator to disclose the information, and the operator complies with the requirements of federal and State law in protecting and disclosing that information.

(2) If no covered information is used for advertising or to amass a profile on the student for purposes other than K through 12 school purposes, for For legitimate research purposes as required by State or federal law and subject to the restrictions under applicable State and federal law or as allowed by State or federal law in furtherance of and under the direction of a school, school district, or the State Board of Education if the covered information is not used for advertising or to amass a profile on the student for purposes other than for K through 12 school purposes or post-secondary educational purposes.

(3) To a State or local educational agency, including schools and school districts, for K through 12 school purposes, as permitted by State or federal law.

(Source: P.A. 100-315, eff. 8-24-17.)

Section 99. Effective date. This Act takes effect upon becoming law.