1. Policy Statement
Illinois State University is committed to protecting the privacy of its students and ensuring compliance with applicable state and federal law, including the Illinois Credit Card Marketing Act (ICCMA) and the Family Education Rights Act (FERPA). This policy expressly prohibits the disclosure of personally identifying information as defined by the ICCMA of all students to business organizations or financial institutions for the purpose of marketing credit cards. The University recognizes its responsibility to safeguard student data and prevent its misuse for commercial solicitations.
2. Purpose
The purpose of this policy is to:
- Ensure compliance with the Illinois Credit Card Marketing Act (110 ILCS 26/25).
- Protect the privacy of student information.
- Prevent the disclosure by the University and its associated entities of student personally identifying information for use in credit card marketing.
- Establish clear guidelines for all University personnel, student groups, alumni organizations, and affiliates regarding credit card marketing activities.
3. Scope
This policy applies to:
- Illinois State University.
- All ISU employees, agents, and volunteers of Illinois State University.
- All registered student groups and organizations affiliated with Illinois State University.
- All alumni organizations associated with Illinois State University.
- Any other affiliates of Illinois State University.
- All students of Illinois State University.
4. Definitions
- Credit Card Marketing Act (110 ILCS 26/25): Illinois state law that prohibits institutions of higher education from providing personally identifying student information for credit card marketing.
- Business Organization: Any entity engaged in commercial activities, including but not limited to corporations, partnerships, or sole proprietorships.
- Financial Institution: Any entity engaged in commercial activities, including but not limited to banks, credit unions, and credit card issuers.
- Personally Identifying Information: For purposes of the Credit Card Marketing Act, Personally Identifying Information includes, but is not limited to:
- Name
- Address
- Telephone number
- Social Security number
- E-mail Address
- Other personally identifying information (e.g., student ID numbers, dates of birth, if they can be used to identify an individual for marketing purposes).
5. Prohibited Activities
In accordance with the Illinois Credit Card Marketing Act (110 ILCS 26/25), Illinois State University, its agents, employees, student groups, alumni organizations, and any affiliates MAY NOT provide personally identifying student information to a Financial Institution or other business organization for purposes of marketing credit cards. This prohibition applies to all forms of direct and indirect disclosure, including:
- Disclosure of data lists.
- Providing access to student information in university databases and systems.
- Endorsing or participating in events specifically designed to collect student information for credit card marketing.
- Any other action that would result in the provision of personally identifying information personally identifying information for credit card marketing.
6. Exceptions
This policy does not prohibit:
- Use by of student educational information by the University for legitimate educational purposes (i.e. any academic and other official university purpose).
- Disclosure of Directory Information (as defined by the University policy in accordance with FERPA) so long as it is not provided to a Financial Institution or other business organization for the purpose of credit card marketing.
- Students voluntarily providing their information directly to a business organization or financial institution.
- Acceptance by the University of credit cards for payment by students of goods and services, provided that such activities comply with Payment Card Industry Data Security Standard (PCI DSS) requirements and University policy.
7. Compliance and Enforcement
- All University departments, employees, student groups, alumni organizations, and affiliates are responsible for understanding and adhering to this policy.
- Violations of this policy should be reported to the University Ethics Officer.
- Non-compliance with this policy may result in disciplinary action, up to and including termination of employment and/or dissolution of student/alumni organization status.
8. Review and Revision
This policy will be reviewed periodically by the Office of the Comptroller to ensure its continued effectiveness and compliance with applicable law. Revisions will be submitted review and approval by Office of General Counsel.
9. Applicable Law and Policy
- Illinois Credit Card Marketing Act (110 ILCS 26/25)
- University Policy- 1.13 Identity Protection
- Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99)
- Illinois Identity Protection Act (5 ILCS 179/35)