SOPPA (Student Online Personal Protection Act)
What is SOPPA?
The Student Online Personal Protection Act (SOPPA), is the student data privacy law that regulates students’ covered information by schools, the Illinois State Board of Education, and education technology vendors.
Illinois Governor J.B. Pritzker signed into law a new version of SOPPA on August 23, 2019, that gives parents greater control over their student’s covered information. The new law outlines specific rights conveyed to parents and adds a requirement to notify the public of breaches of covered information.
SOPPA also requires Illinois school districts to provide additional guarantees that student-covered information is protected when collected by EdTech vendors. The law is effective on July 1, 2021.
SOPPA requires that school districts must:
- Enter into written agreements with all K-12 service providers who collect student data. Covered data includes, but is not limited to: information in the student's educational record, first/last name, address, phone number, email address, grades, test results, socioeconomic information, photos, search activity, voice recordings, geolocation information, and more.
- Implement and maintain reasonable security practices. Student data is protected through comprehensive privacy policies and security measures such as firewalls, secure servers, intrusion detection software, and other methods. Written agreements with vendors require that the vendor also maintains security procedures.
- Post a list of operators. This list will include what data elements are shared, written agreements/contracts with the operator within 10 days of signing, & subcontractors for each operator.
The district adheres to the following applicable laws regarding student data and privacy:
- Children's Internet Protection Act (CIPA)
- Family Educational Rights and Privacy Act (FERPA)
- Illinois School Student Records Act (ISSRA)
- Student Online Personal Protection Act (SOPPA)
District-approved Web-based Tools/Applications and Written Agreements
BBCHS values your child's privacy and strives to ensure that parents/guardians are aware of what web-based tools and applications that are being used for educational purposes. A list of all BBCHS approved web-based tools, written agreements with operators, and a list of data elements shared can be found here: BBCHS Data Privacy Agreements
Parent/Guardian Rights
Parents/guardians have the right to inspect, review, and correct information maintained by the school, operator, and the Illinois State Board of Education.
Security
We employ reasonable security methods to prevent unauthorized access, maintain data accuracy, and ensure correct use of information.
Data Breaches
In the event that there is a data breach, the District will notify parents/guardians via district communication systems within 30 days the data breach and within 60 days if a third-party is responsible for the data breach.