HB0332 Summary: Student Data Privacy

• Adds Section 22-83 to the School Code establishing comprehensive student data privacy protections, including prohibitions on vendors engaging in targeted advertising, selling student data, or creating student profiles for non-educational purposes.

• Requires vendors receiving student data to implement security safeguards, notify schools of data breaches, delete data upon request, permit annual audits, and maintain Illinois venue for disputes; vendors must enter written agreements with schools detailing data usage and limitations.

• Amends the Illinois School Student Records Act to allow researchers at accredited institutions to access student records for research purposes under strict conditions, including written data use agreements, parental notice requirements, and mandatory destruction of personally identifiable information within 36 months.

• Establishes that vendors breaching data security must reimburse schools for all costs related to investigation, remediation, notifications, credit monitoring, legal fees, and other damages; makes noncompliant vendor agreements voidable with 60-day data deletion requirements.

• Changes the definition of "child" in the Children's Privacy Protection and Parental Empowerment Act from under age 16 to under age 18 for enhanced privacy protections.