Law / United States / 
Illinois
School Code: student biometric information policies of school districts
105 ILCS 5/10-20.40 and 5/34-18.34
In force since .
A biometric privacy rule binding government bodies.
- Obligation class
- Biometric, Consent, Retention, Prohibition, Security
What it requires
- If you are a school district that collects biometric information from students, adopt a policy requiring written permission from the individual with legal custody of the student, or from the student at age 18, and do not refuse services otherwise available to a student because that permission was not given (105 ILCS 5/10-20.40(b)(1) and (c); 105 ILCS 5/34-18.34(b)(1) and (c)).
- Require in the policy that you discontinue use of a student's biometric information on the student's graduation or withdrawal or on a written request from the custodian or the adult student, and destroy all of it within 30 days after use is discontinued (105 ILCS 5/10-20.40(b)(2) and (3); 105 ILCS 5/34-18.34(b)(2) and (3)).
- Require in the policy that biometric information is used solely for identification or fraud prevention, that it is not sold, leased, or otherwise disclosed unless the custodian or adult student consents or a court orders the disclosure, and that all of it is stored, transmitted, and protected from disclosure (105 ILCS 5/10-20.40(b)(4) to (6); 105 ILCS 5/34-18.34(b)(4) to (6)).
These lines are LexLint's reading of the law's text.
What this law does
Section 10-20.40 of the School Code defines biometric information as any information collected through an identification process based on unique behavioral or physiological characteristics, including fingerprint, hand geometry, voice, or facial recognition or iris or retinal scans. A school district that collects biometric information from students must adopt policies requiring, at a minimum, written permission from the person with legal custody of the student, or from the student at age 18.
The policies must require discontinuing use of a student's biometric information on graduation or withdrawal or on a written request, and destroying all of it within 30 days after use is discontinued. The policies must limit use of biometric information to identification or fraud prevention, prohibit its sale, lease, or other disclosure unless the custodian or adult student consents or a court orders it, and require its storage, transmittal, and protection from disclosure.
Failure to give written consent must not be the basis for refusing any services otherwise available to the student. Student biometric information destroyed within 30 days after its use is discontinued may be destroyed without notice to or approval of a local records commission under the Local Records Act. Section 34-18.34 of the School Code requires a school district that collects biometric information from students to adopt a policy with the same minimum requirements.
Section 10-20.40 as in force carries the source note of Public Act 95-232, effective , and later amendments.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .