Law / United States / 
Illinois
Student Online Personal Protection Act: breach notice from an operator to the school and from the school to parents
105 ILCS 85/15(5) and 85/27(a)(5) and (d)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Disclosure
What it requires
- If you are an operator, notify the school of any breach of the students' covered information within the most expedient time possible and without unreasonable delay, no later than 30 calendar days after you determine that a breach has occurred (105 ILCS 85/15(5)).
- If you are a school, notify the parent of each student whose covered information is involved in a breach no later than 30 calendar days after you receive the operator's notice or determine that a breach has occurred, stating the date or date range, a description of the compromised information, contact information for the operator and school, the toll-free numbers, addresses and websites for consumer reporting agencies and the Federal Trade Commission, and that the parent may obtain fraud alert and security freeze information from them; where a law enforcement agency has asked in writing for a delay because notice would interfere with a criminal investigation, give the notice as soon as it no longer would (105 ILCS 85/27(d)).
- Post a list of breaches of covered information stating the number of students involved, the date or estimated date range, and for an operator breach the operator's name, updated no later than 30 calendar days after the start of a fiscal year and of a calendar year; the list may omit a breach involving fewer than 10% of your enrollment, one for which parent notice is not required, one that occurred before , and one posted within the previous 5 years (105 ILCS 85/27(a)(5)).
These lines are LexLint's reading of the law's text.
What this law does
Section 15 requires an operator to notify the school of any breach of the students' covered information within the most expedient time possible and without unreasonable delay, but no later than 30 calendar days after the determination that a breach has occurred. Section 27(d) requires a school to notify the parent of any student whose covered information is involved in a breach no later than 30 calendar days after it receives the operator's notice or determines that a breach has occurred.
The notice to the parent must include the date or date range of the breach, a description of the compromised covered information, contact information for the operator and school, the toll-free numbers, addresses, and websites for consumer reporting agencies and the Federal Trade Commission, and a statement that the parent may obtain information about fraud alerts and security freezes from them.
The school may delay the notice if an appropriate law enforcement agency determines that the notification will interfere with a criminal investigation and gives the school a written request for a delay. The school must give the notice as soon as it will no longer interfere with the investigation.
Section 27(a)(5) requires a school to post a list of breaches of covered information that gives the number of students involved, the date or estimated date range of the breach, and for an operator breach the operator's name.
The school may omit from that list a breach that, to its knowledge when it updates the list, involves fewer than 10% of its enrollment, a breach for which it is not required to notify parents, a breach that occurred before , and a breach it posted on a list no more than 5 years before the current update.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .