Student Data Privacy

SOPPA is a state law that protects the privacy and security of student data when shared with and collected by educational technology companies. It governs companies providing web-based sites, services, and applications used primarily for K-12 education.

Key Provisions for Companies:

• Prohibits targeted advertising to students.
• Prevents the creation of student profiles.
• Bans the sale or rental of student information.
• Limits the use of student data to specific purposes.
• Requires companies to meet security standards, delete data upon district request, and maintain a public privacy policy.

Responsibilities for School Districts:

• School districts must establish data-sharing agreements with these companies.
• Parents are granted specific rights regarding their children's data under SOPPA.

SOPPA requires that all companies with whom Hawthorn shares covered information sign a Data Sharing Agreement. This agreement details what data is shared, the purpose of its collection, and how it will be used and protected. You can view all our vendor agreements by selecting "Hawthorn's DPAs" in the provided links, which include the vendor's name, services provided, and data elements shared.

Hawthorn has also adopted a SOPPA policy to guide the district’s implementation of SOPPA and designates who can enter into data-sharing agreements with vendors.

Additionally, Hawthorn consistently employs strong security measures to protect student data.

Under the Illinois Student Online Personal Protection Act (SOPPA), parents/guardians have the right to access and correct their child’s covered information. Covered information refers to personally identifiable information (PII) or data linked to PII that is not publicly available and is created, provided, or gathered by operators (such as educational technology vendors) for K-12 purposes.

Your Rights Under SOPPA:

1. Review and Inspect:
   You have the right to inspect and review your child’s covered information held by the District, the Illinois State Board of Education (ISBE), or an operator. The District will provide access within the time prescribed by state rules. If the data includes information about other students, your access will be limited to your child’s information.

2. Request a Copy:
   You can request a copy of your child’s covered information in either electronic or paper form. The District will provide the copy within the state-prescribed timeframe. Electronic copies will be provided unless the data is not maintained electronically. Paper copies may incur a reasonable copying fee, but you will not be denied a copy if you cannot pay.

3. Request Corrections:
   You can request corrections to factual inaccuracies in your child’s covered information. Upon receipt, the District will:

   • Review the request to determine if a factual inaccuracy exists.
   • If the inaccuracy is confirmed and the District maintains the data, it will correct it and notify you within 90 calendar days.
   • If the data is maintained by an operator or ISBE, the District will notify them to make the correction. The operator or ISBE must confirm the correction with the District, which will then confirm it with you within 10 business days of receiving the confirmation.

How to Make a Request: To inspect, review, copy, or correct your child’s covered information, contact:

John Reid
841 West End Ct, Vernon Hills, IL 60061
reidj@hawthorn73.org
(847) 990-4222

Submit your request in writing, specifying the nature of your request. You may need to use a specific form provided by the District.

School districts across Illinois, including ours, partner with various educational technology vendors to enhance K-12 education through personalized learning, innovative tools, and efficient school operations.

Under the Illinois Student Online Personal Protection Act (SOPPA) (105 ILCS 85/), these educational technology vendors, referred to as operators, are responsible for ensuring that student data is protected. SOPPA mandates that these operators, along with school districts and the Illinois State Board of Education, take specific measures to safeguard online student data.

Student Data Collection and Usage: Depending on the educational technology being used, our District may need to collect and share different types of student data with these operators. SOPPA strictly prohibits operators from selling or renting student information or using it for targeted advertising. Operators can only disclose student data for K-12 educational purposes and other limited, legally permitted uses.

Types of Student Data That May Be Collected and Shared:

• Basic identifying information (e.g., student/parent name, contact information, student ID number)
• Demographic information
• Enrollment details
• Assessment data, grades, and transcripts
• Attendance and class schedules
• Academic/extracurricular activities
• Special indicators (e.g., disability status, English language learner, free/reduced meals, homeless/foster care status)
• Behavioral and conduct data
• Health information
• Food purchases
• Transportation details
• In-application performance data
• Student-generated work
• Online communications
• Application metadata and usage statistics
• Permanent and temporary student records

Permitted Uses of Student Data by Operators: Operators may only use student data for K-12 purposes, which include:

• Classroom and remote instruction
• Administrative tasks
• Collaboration between students, staff, and parents/guardians
• Other activities that support and benefit the school district

Effective July 1, 2021, the Student Online Personal Protection Act (SOPPA) mandates that school districts provide enhanced protections for student data when collected by educational technology companies, ensuring data is used only for beneficial purposes (105 ILCS 85). SOPPA also imposes new requirements on the Illinois State Board of Education and online service operators.

District Requirements

Here is a summary of the key requirements for school districts under SOPPA:

1. Annual Posting of Operators:

   • Districts must annually post a list of all operators of online services or applications used.

2. Data Element Disclosure:

   • Annually post all data elements collected, maintained, or disclosed by the district. This must include the purpose of data use, and the entities to whom and why data is disclosed.

3. Contract Transparency:

   • Post contracts with operators within 10 days of signing.

4. Subcontractor Disclosure:

   • Annually post a list of subcontractors for each operator.

5. Parent Rights Process:

   • Post the process for parents to inspect, review, and correct student information maintained by the district, operators, or ISBE.

6. Data Breach Notification:

   • Post data breaches within 10 days and notify parents within 30 days.

7. Contract Signing Policy:

   • Create a policy outlining who is authorized to sign contracts with operators.

8. Security Procedures:

   • Maintain and enforce reasonable security procedures and practices.

Vendor Agreements: All agreements with vendors that involve sharing student information must include a provision requiring the vendor to maintain reasonable security procedures and practices.