Technology

• SOPPA regulates vendors (operators) who provide web-based sites, services, online and mobile applications that are used primarily for K to 12 purposes. 
• Currently, SOPPA provides various prohibitions and responsibilities on these vendors, referred to in the law as “operators.”  The law prohibits operators from engaging in targeted advertising to students, amassing a profile on students, selling or renting student information, or using student information except in limited ways. Additionally, operators must maintain certain security protocols when storing student data, delete student data when requested by the district, and maintain a public privacy policy.
• The law has been amended, effective July 1, 2021 not only to expand the responsibilities and prohibitions of operators, but  also to place new responsibilities on school districts and on the Illinois State Board of Education (ISBE), as well as delineate the scope of parental rights.
• This 'What is SOPPA' video provides a nice overview of all the segments of this legislation.
   

District 99 implements and follows all applicable state and federal laws around data privacy. In addition to SOPPA (above), other notable protections include:

• Family Educational Rights and Privacy Act (FERPA)
  • Governs information in a student’s education record, restricting access and use of student information.
  • Provides parents with certain rights to their child’s education record, including the right to review their child’s education record and request to amend it if it is factually inaccurate.
• Children’s Internet Protection Act (CIPA)
  • Requires that we filter our network to prevent students from accessing harmful content, provide an internet safety curriculum, and monitor electronic communications as part of a program that provides us with federal discounts for internet access and other technology services.
• Schools are legally required to keep student data secure and safe
  • Current Laws

• We require all third-party vendors (operators) with which we share covered information, to sign a Data Privacy Agreement with us, which outlines what data is potentially shared, the purpose for collecting the data, what subcontractors they use and additional information.
• You can see all current executed agreements here. As we secure Data Privacy Agreements and amass the information required by SOPPA, agreements will be added to the list.
• At the start of each school year, District 99 will notify all families of what types of student data are collected and shared by providing access to our currently executed Data Privacy Agreements. 
• Our efforts to evaluate all applications for SOPPA compliance and secure Data Privacy Agreements are focused, ongoing and done in good faith. We continue to work toward full compliance with SOPPA regulations, understanding the importance and immensity of the task. 

• Parents may request to inspect and review their student’s covered information. Requests for reviewing records must be made in writing and include the date of the request, the parent’s name, address, phone number, student’s name, and the name of the school from which the request is being made. Please use this online form to submit your request to inspect, copy or challenge covered information. Parents will be required to provide proof of identity and relationship to the student before access to the covered information is granted. 
• The District shall provide an electronic copy of the records within 45 days of receiving a request for the covered information. If a parent requests a paper copy, the District will charge .35 cents per page. No parent will be denied a paper copy due to an inability to pay. 
• A parent may make a request to review and receive copies of covered information no more than two requests per student per quarter.
• Parents may request corrections of factual inaccuracies contained in their student’s covered information. The District will review the request, determine if an inaccuracy exists, and if so, will make any necessary corrections within 90 days of the request. If the correction needs to be made by the Illinois State Board of Education or a District’s vendor, any necessary corrections will also be made within 90 days of the request and the District will notify the parent of any necessary corrections within 10 days after receiving confirmation of the corrections. 
• If a parent requests the deletion of any covered information, the District will review the request to determine whether such a deletion would violate the law or result in the student being unable to articipate in the District’s curriculum. 
• Parents may also consult the District’s procedures on reviewing and challenging student records if the covered information also constitutes student records.

In the unlikely situation that an operator experiences a potential data breach, they must notify District 99 as soon as possible. After receiving notice of a potential breach, we will evaluate their report and if confirmed, provide notifications to parents. Information on past breaches will be publicly displayed below and contain the following information.

• Date or estimated date/range of the breach
• Description of covered information breached
• The number of students unless disclosure would violate the Personal Information Protection Act
• Contact information of the operator for questions
• Toll-free numbers, addresses, and websites of consumer reporting agencies and the FTC

The District will also notify parents and post information in the event the District’s data systems are breached.

Note:  A notice of breach may be delayed if a law enforcement agency determines that the notification will interfere with a criminal investigation. If a breach impacts less than 10% of the student enrollment, by law, it does not need to be disclosed in the manner described above.