A close-up side view of a large print book with a white hard cover, open to the middle pages, with a closed padlock positioned in front of it to symbolize student data privacy.

Student Data Privacy

Home » Technology and Safety » Student Data Privacy
Additional Resources
Student Data Privacy
visiting our schools
1:1 Device FAQ
Alerts and Closings
TECH TIPS

Central 301 Student Data Privacy

Central 301 follows best practices in establishing and managing system and network access security. Access to student data is managed and controlled through what is known as role-based security. This means that the type and amount of access to student data and other information is governed in our systems by the role that staff members hold and the information they require to perform their job as a trusted member of Central 301 staff. To further enhance student data privacy, staff members must go through a process to gain access to authorized information that includes successfully logging into the District network or one of the systems they use as part of their job duties.

Once a staff member logs in using this method, the internal application controls, role based security, and application permissions restrictions are engaged, which limit the data read, write, add, or delete functionality and are specific to a staff member’s role in the District.

The District also follows all rules set forth by state and federal government such as the SOPPA, FERPA, COPPA, CIPA, PPRA, and HIPAA.

Managing Student Data: Student Online Personal Protection Act
(SOPPA)

Effective July 1, 2021, school districts will be required by the Student Online Personal Protection Act (SOPPA) to provide additional guarantees that student data is protected when collected by educational technology companies, and that data is used for beneficial purposes only (105 ILCS 85).

District Requirements

Below is a high-level overview of the new requirements. Please refer to the legislation for specific timelines and components of each element. School districts must:

  1. Annually post a list of all operators of online services or applications utilized by the district.
  2. Annually post all data elements that the school collects, maintains, or discloses to any entity. This information must also explain how the school uses the data, and to whom and why it discloses the data.
  3. Post contracts for each operator within 10 days of signing.
  4. Annually post subcontractors for each operator.
  5. Post the process for how parents can exercise their rights to inspect, review, and correct information maintained by the school, operator, or ISBE. (Coming in July 2021)
  6. Post data breaches within 10 days and notify parents within 30 days.
  7. Create a policy for who can sign contracts with operators.
  8. Designate a privacy officer to ensure compliance.
  9. Maintain reasonable security procedures and practices. Agreements with vendors in which information is shared must include a provision that the vendor maintains reasonable security procedures and practices.

Family Educational Rights and Privacy Act
(FERPA)

FERPA is a federal law that protects the privacy of student education records. The law applies to all schools that receive funds from the U.S. Department of Education. FERPA gives parents certain rights with respect to their children’s education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level.

Children’s Online Privacy Protection Act
(COPPA)

The primary goal of COPPA is to place parents in control over what information is collected from their young children online. COPPA was designed to protect children under age 13 while accounting for the dynamic nature of the Internet. The rule applies to operators of commercial websites and online services (including mobile apps) directed to children under 13 that collect, use, or disclose personal information from children, and operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Read more about COPPA.

Children’s Internet Protection Act
(CIPA)

CIPA was enacted by Congress in 2000 to address concerns about children’s access to obscene or harmful content over the Internet. CIPA imposes certain requirements on schools or libraries that receive discounts for Internet access or internal connections through the E-rate program. Read more about CIPA.

Protection of Pupil Rights Amendment
(PPRA)

PPRA is intended to protect the rights of parents and students in two ways:

  • It seeks to ensure that schools and contractors make instructional materials available for inspection by parents if those materials will be used in connection with an ED-funded survey, analysis, or evaluation in which their children participate; and
  • It seeks to ensure that schools and contractors obtain written parental consent before minor students are required to participate in any ED-funded survey, analysis, or evaluation that reveals certain information.

PPRA applies to programs that receive funding from the U.S. Department of Education. Read more about PPRA.

Health Insurance Portability and Accountability Act
(HIPAA)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.

Resources for Parents and Guardians

Home Filters

Sometimes filtering can be provided by your internet service provider.

Filtering for Mobile Devices

Games and Links for Kids

Cybercriminals exploit people and steal confidential and sensitive information through various digital strategies. Beware of the following:

  • Spam is unsolicited email, instant messages, or social media messages. These messages are fairly easy to spot and can be damaging if you open or respond.
  • Phishing is an email sent from an internet criminal disguised as an email from a legitimate, trustworthy source. The message is meant to lure you into revealing sensitive or confidential information.
  • Spear Phishing occurs when criminals obtain information about you from websites or social networking sites and customize a phishing scheme to you.
  • Spoofing describes a criminal who impersonates another individual or organization with the intent to gather personal or business information.
  • Pharming is a malicious website that resembles a legitimate website used to gather usernames and passwords.

How can you help keep us safe? Do what you can to avoid falling as a victim to cyber scams:

  • Use antivirus software.
  • Never give up your login information or personal information over email.
  • If a message doesn’t seem legitimate, send a new message to the sender instead of replying.
  • Keep your computer and browser up to date with the latest version and security patches.