Student Data Privacy

As required by SOPPA, the MCV School Board appoints the Director for Technology as the Student Data Privacy officer.  This role oversees a committee of district personnel charged with making sure that all educational technology partners, services, and applications, adhere to the regulations of SOPPA.  These regulations are put in place to ensure the sale, rental, lease, or trading of any District student records or covered information by the District is prohibited.   Any operator of such service is required to have a signed agreement with the District accepting the strict regulations of SOPPA.  A list of District-approved operators, the information they collect, and a copy of the signed agreement can be found on our Data Privacy Portal. 

The Data Privacy Officer is also designated to sign contracts with operators and review operator privacy policies to ensure they meet the requirements of SOPPA. 

**The District's SOPPA Committee will meet quarterly to review staff requests, review current SOPPA policies, review any breaches, and review the District's current state of data privacy. **

In the event there is a data breach, the Moline-Coal Valley School District 40 is required to notify parents via the District's communication system within 30 days of the breach and within 60 days if a third party is responsible for the data breach.

SOPPA regulations state that parents and/or legal guardians have the right to inspect, review, and correct information maintained by the school, operator, and the Illinois State Board of Education.  All requests should be made via email to the Director for Technology (the designated Data Privacy Officer) using this email address:  mcv-soppa@molineschools.org.   

To ensure all educational technology partners, operators, and services that collect student data comply with SOPPA, the District has partnered with the Learning Technology Center (LTC) for the management of teacher/staff technology requests.  Teacher and staff requests to implement electronic services or applications are vetted through the District's SOPPA Office and approved or denied based on the operator's willingness to agree to the terms defined in SOPPA, and that the service fills an educational purpose.  A list of the web-based tools, applications, and services, with their related privacy policies, can be found on our Student Data Privacy Online Portal (SDPC). 

The District's Educational Technology Department maintains enterprise-level and current network security systems as described below. 

• Enterprise-level firewall appliance replaced every 5 years with annual renewal subscription/support agreements
• Enterprise-level core switch updated quarterly to the most stable release and renewed every 5 years
• Enterprise-level wireless management system
• Malware-Bytes antivirus/Malware subscription for all network clients, including servers
• Currently supported Windows server within a virtual environment that is patched for security updates weekly
• SysCloud Student Security system that monitors our Google Workplace environment for malware, viruses, as well as FERPA, and HIPPA violations 

The District also implements standard data security policies at the state and federal level:

• Children's Internet Protection Act (CIPA)
• Children's Online Privacy Protection Act (COPPA)
• Family Educational Rights and Privacy Act (FERPA)
• Illinois School Student Records Act (ISSRA)
• Student Online Personal Protection Act (SOPPA)

The Moline-Coal Valley CUSD 40 School Board has adopted these policies and guidelines:

• 6:235 Access to Electronic Networks and Acceptable Use Policy
• 7:345 Use of Educational Technologies: Student Data Privacy and Security

The District has with the Learning Technology Center to manage operator contracts, collect student data privacy policies, and provide a workflow for teachers and staff to request educational technology services, applications, and/or tools that are SOPPA compliant.  Click here to visit our public Student Data Privacy Portal. Here, you can search for contracts, or see a comprehensive list of approved operators. 

Additionally, operators are required to sign the Illinois  Student Data Privacy Agreement before any service, application, or tool can be adopted by the District or any contract renewed.  A copy of the IL-NDPA can be found at the bottom of this page under Useful Handouts or on the SDPC Website.  This agreement is directly tied to the strict regulations of SOPPA and helps ensure that the data we share with approved operators is not sold, leased, or rented and is used solely for educational purposes.  Each operator must specifically list the data elements they collect, and they must specifically state how this data is stored on their servers (or the servers of their subcontractors). 

• Student Online Personal Protection Act (SOPPA)
• Student Data Privacy Laws
• IL NDPA V1