Law / United States / 
Illinois
Student Online Personal Protection Act: public school duties to post agreements and data inventories, secure covered information and relay deletion requests
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Disclosure, Contract terms, Security, Data subject rights
What it requires
- If you are a public school, post and maintain on your website (or, with no website, make available for public inspection at your administrative office) an explanation a layperson can understand of the data elements of covered information you collect, maintain or disclose, how you use them, and to whom and why you disclose them (105 ILCS 85/27(a)(1)).
- Post a list of the operators you have written agreements with, a copy of each agreement and a business address for each operator, and post each agreement within 10 business days after entering into it (105 ILCS 85/27(a)(2) and (c)).
- Post for each operator a list of subcontractors to whom covered information may be disclosed, a written description of the procedures a parent may use to exercise the rights in section 33, and a list of breaches, and update the posted items no later than 30 calendar days after the start of a fiscal year and of a calendar year (105 ILCS 85/27(a)(3) to (5)).
- Adopt a policy designating which school employees are authorized to enter into written agreements with operators; an agreement entered into in violation of the Act is void and unenforceable as against public policy (105 ILCS 85/27(b)).
- Implement and maintain reasonable security procedures and practices that meet or exceed industry standards, and require in any written agreement under which covered information is disclosed to a third party that the recipient does the same (105 ILCS 85/27(e)).
- When a parent asks, request that the operator delete the student's covered information, so long as deletion does not violate State or federal records laws (105 ILCS 85/27(g)).
These lines are LexLint's reading of the law's text.
What this law does
Section 27 requires each school to post and maintain on its website, or make available for inspection at its administrative office if it has no website, the information the section lists. The school must post an explanation that a layperson can understand of the data elements of covered information that it collects, maintains, or discloses, how it uses them, and to whom and why it discloses them.
The school must post a list of the operators it has written agreements with, a copy of each written agreement, and a business address for each operator. For each operator, the school must also post a list of any subcontractors to whom covered information may be disclosed, or a link to a page on the operator's website that lists them, and a written description of the procedures a parent may use to exercise the rights in section 33.
The school must update the posted explanation, subcontractor lists, parent procedures and breach list no later than 30 calendar days after the start of each fiscal year and no later than 30 days after the beginning of each calendar year. The school must post each written agreement within 10 business days after entering into it. The school must adopt a policy designating which school employees may enter into written agreements with operators.
The policy requirement does not limit a school employee, acting outside the scope of employment, from entering into an agreement with an operator on the employee's own behalf for non-K through 12 school purposes, provided no covered information is provided to the operator. Any agreement or contract entered into in violation of the Act is void and unenforceable as against public policy.
Each school must implement and maintain reasonable security procedures and practices that meet or exceed industry standards, and any written agreement under which covered information is disclosed to a third party must require the recipient to do the same. A school must ask an operator to delete a student's covered information on behalf of a parent who requests it, so long as deletion does not violate State or federal records laws. Section 27 does not apply to nonpublic schools.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .