Illinois SOPPA Addendum

Supplemental Terms for Illinois K-12 Schools

Last Updated: July 1, 2021

In accordance with the amendments to the Illinois Student Online Personal Protection Act effective July 1, 2021, the parties agree to add the following supplemental terms to the K-12 (Primary and Secondary) and Higher Education Additional Terms for Student Data (“Student Data Terms”) for Illinois K-12 Schools only, effective as of July 1, 2021. Capitalized terms shall have the meanings set forth in the Student Data Terms.

I. Illinois Law. Each party agrees to uphold its responsibilities under applicable Illinois State laws governing Student Personal Information, including the Student Online Personal Protection Act (“SOPPA”) at 105 ILCS 85, the Illinois School Student Records Act (“ISSRA”) at 105 ILCS 10, and the Personal Information Protection Act (“PIPA”) at 815 ILCS 530.

II. Section 15(4) of SOPPA. The parties agree to add the following to the Student Data Terms pursuant to Section 15(4) of SOPPA.

A. Categories or Types of Student Data to be Provided to Adobe. Users may choose to disclose additional information beyond that listed in this Section II.A at their own discretion, but the following data elements are the minimum that Adobe must collect in order to provide the Services: (1) application technology metadata, which may include IP addresses of users, application logs related to functioning of application, and analytics data including usage data such as application launch or account creation; (2) Student identifiers, including the Adobe/application assigned student ID number, Student application username, and Student application passwords; and (3) Student Name, including first and/or last name.

B. Products or Services Provided to the School by Adobe. School may license Adobe’s general use products and services for deployment in the K-12 (primary and secondary) school environment. The specific products or services provided will be at the discretion of School. School may choose the products and services it licenses through the Adobe Admin Console.

C. School Official. In providing the Services to School, Adobe is acting as a “school official” with a “legitimate educational interest” as defined under FERPA and further described in Section 4.1(i) (“FERPA Compliance”) of the Student Data Terms. Adobe agrees to abide by the limitations and requirements applicable to a school official, that it is performing an institutional service or function for which School would otherwise use employees, and that it is under the direct control of School with respect to the use and maintenance of Student Data. Adobe agrees to use Student Data only for authorized purposes and not to redisclose it to third parties or affiliates, unless otherwise permitted, without permission from School or pursuant to court order.

D. Security Event Cost Allocation. If a Security Event occurs, each party shall bear its own costs for the activities described in Section 10 (“Data Security; Security Events”) of the Student Data Terms.

E. Deletion or Transfer of Student Data. School may modify or delete Student Data in a Student account through the Adobe Admin Console at its convenience, as further described in Section 7.1 (“Deletion Through Adobe Admin Console”) of the Student Data Terms. Adobe will retain any Student Data remaining in a Student account for a reasonable period of time after termination of such account to permit Student to download and store Student Assets to a personal account before deleting such Student Data, as further described in Section 7.2 (“Retention of Student Data; Student Personal Accounts”) of the Student Data Terms.

F. Publishing of Agreement on School Website. School shall post this Illinois SOPPA Addendum and the Student Data Terms on its website or make them available for inspection by the general public at its administrative office, if it does not maintain a website; provided, that Adobe may request portions of such terms be redacted in accordance with 105 ILCS 85/15(4)(F).

III. Section 15(6) of SOPPA: List of Sub-processors. A list of Adobe sub-processors, which will be updated from time to time, is available here: https://www.adobe.com/privacy/sub-processors.html.

IV. Section 27(e) of SOPPA: Security Procedures and Practices. Adobe has implemented reasonable administrative, technical, and physical security controls to protect Student Data that follow industry-standard security best practices as further described in Section 10.2 (“Adobe Obligations”) of the Student Data Terms.