Illinois § 10-20.40

§ 10-20.40.

Student biometric information. (a) For the purposes of this Section, "biometric information" means any information that is collected through an identification process for individuals based on their unique behavioral or physiological characteristics, including fingerprint, hand geometry, voice, or facial recognition or iris or retinal scans. (b) School districts that collect biometric information from students shall adopt policies that require, at a minimum, all of the following: (1) Written permission from the individual who has legal custody of the student, as defined in Section 10-20.12b of this Code, or from the student if he or she has reached the age of 18. (2) The discontinuation of use of a student's biometric information under either of the following conditions: (A) upon the student's graduation or withdrawal from the school district; or (B) upon receipt in writing of a request for discontinuation by the individual having legal custody of the student or by the student if he or she has reached the age of 18. (3) The destruction of all of a student's biometric information within 30 days after the use of the biometric information is discontinued in accordance with item (2) of this subsection (b). (4) The use of biometric information solely for identification or fraud prevention. (5) A prohibition on the sale, lease, or other disclosure of biometric information to another person or entity, unless: (A) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or (B) the disclosure is required by court order. (6) The storage, transmittal, and protection of all biometric information from disclosure. (c) Failure to provide written consent under item (1) of subsection (b) of this Section by the individual who has legal custody of the student or by the student, if he or she has reached the age of 18, must not be the basis for refusal of any services otherwise available to the student. (d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the use of the biometric information is discontinued in accordance with item (2) of subsection (b) of this Section. (Source: P.A. 95-232, eff. 8-16-07; 95-793, eff. 1-1-09; 95-876, eff. 8-21-08; 96-328, eff. 8-11-09.)