Law / United States / 
Illinois
Student Online Personal Protection Act: State Board of Education duties and the annual notice schools give parents
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Prohibition, Disclosure, Governance
What it requires
- If you are the State Board of Education, do not sell, rent, lease, or trade covered information, and do not share, transfer, disclose, or provide covered information to an entity or individual without a contract or written agreement, except for disclosures required by State or federal law (105 ILCS 85/28(a) and (b)).
- At least once annually, publish and maintain on your website a list of the entities and individuals that hold covered information under a contract or written agreement with you, with a copy of each, stating for each its purpose and scope, duration, the types of covered information held, their use, the length of time they may be held, and any subcontractors (105 ILCS 85/28(c)).
- Create, publish, and make publicly available an inventory of the covered information you collect or maintain, with a dictionary or index of data elements and their definitions, including covered information that schools must report to you and covered information in the State longitudinal data system (105 ILCS 85/28(d)).
- Develop, publish, and make publicly available model student data privacy policies and procedures for schools, including a model notice that schools use to tell parents and students about operators (105 ILCS 85/28(e)).
- If you are a public school, provide the State Board's model notice about operators to parents at the beginning of each school year by the means you generally use to send them notices (105 ILCS 85/28(e)).
These lines are LexLint's reading of the law's text.
What this law does
Section 28 bars the State Board of Education from selling, renting, leasing, or trading covered information. The State Board may not share, transfer, disclose, or provide covered information to an entity or individual without a contract or written agreement, except for disclosures required by State or federal law and except for its own employees and officials acting within their official capacity.
At least once annually the State Board must publish and maintain on its website a list of the entities and individuals that hold covered information under a contract or written agreement with it, with a copy of each contract or agreement. The State Board must create, publish, and make publicly available an inventory of the covered information it collects or maintains, with a dictionary or index of data elements and their definitions.
The State Board must develop, publish, and make publicly available model student data privacy policies and procedures for schools, including a model notice to parents and students about operators. The notice must state, in general terms, the types of student data the schools collect and share with operators and the purposes of collecting and using it.
Once the notice exists, a school other than a nonpublic school must provide it to parents at the beginning of each school year by the means it generally uses to send them notices.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .