105 ILCS 5/10-20.38

Provision of student information prohibited. A school district, including its agents, employees, student or alumni associations, or any affiliates, may not provide a student's name, address, telephone number, social security number, e-mail address, or other personal identifying information to a business organization or financial institution that issues credit or debit cards.