Law / United States / 
Illinois
P-20 Longitudinal Education Data System Act: data sharing arrangements and security measures
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Disclosure, Contract terms, Security, Retention
What it requires
- If you are a State Education Authority (the State Board of Education, the Illinois Community College Board or the Board of Higher Education), disclose data from the longitudinal data system only under a data sharing arrangement that is permissible under privacy protection laws, is approved by the official the Act names, permits personal identification only by the recipient's authorized representatives with legitimate interests in the information, and ensures the data is destroyed or returned when no longer needed (105 ILCS 13/25(a) and (c)(1) to (4)).
- Perform each data sharing arrangement under a written agreement that specifies its purpose, scope, and duration, limits the recipient's use of personally identifiable information from education records to the stated purposes, and describes the data access, use, and security restrictions the recipient will undertake (105 ILCS 13/25(c)(5)).
- Develop security measures and procedures that protect personal information from intentional or accidental release to unauthorized persons and from intentional or accidental use for unauthorized purposes (105 ILCS 13/30).
These lines are LexLint's reading of the law's text.
What this law does
Section 25 of the P-20 Longitudinal Education Data System Act lets the State Education Authorities, defined as the State Board of Education, the Illinois Community College Board and the Board of Higher Education, disclose data from the longitudinal data system only under a data sharing arrangement that meets its requirements.
The arrangement must be permissible under privacy protection laws, be approved by the State Superintendent of Education, the Community College Board's chief executive officer or the Board of Higher Education's executive director for the student data each oversees, and not permit the personal identification of any person except by authorized representatives of the recipient that have legitimate interests in the information.
The arrangement must ensure the destruction or return of the data when it is no longer needed for its purposes, and must be performed under a written agreement that specifies its purpose, scope, and duration, limits the recipient's use of personally identifiable information from education records to the stated purposes, and describes the data access, use, and security restrictions the recipient will undertake.
A non-public college may prohibit its data from being shared with any other state or included in any interstate data-sharing agreement. Section 30 requires the collection, use, maintenance, disclosure, and sharing of data under the Act to comply with privacy protection laws, which the Act defines to include the federal Family Educational Rights and Privacy Act, the Illinois School Student Records Act and the Personal Information Protection Act.
Each State Education Authority must develop security measures and procedures that protect personal information from intentional or accidental release to unauthorized persons and from intentional or accidental use for unauthorized purposes. Sections 25 and 30 carry the source note of Public Act 96-107, effective , and section 25 that of Public Act 96-1249, effective .
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .