A school district , including its agents, employees, student or alumni associations, or any affiliates, may not provide a student's name, address, telephone number, social security number, e-mail address, or other personal identifying information to a business organization or financial institution that issues credit or debit cards.
105 ILCS 5/10-20.38