110 ILCS 520/16

(a) The University, including its agents, employees, student or alumni organizations, or any affiliates, may not provide a student's name, address, telephone number, social security number, e-mail address, or other personal identifying information to a business organization or financial institution that issues credit or debit cards, unless the student is 21 years of age or older. This prohibition does not apply to service providers of the University that (i) assist the University in the electronic disbursement of refunds, including, but not limited to, financial aid refunds, and (ii) do not provide loan or credit services. (b) The University may not print an individual's social security number on any card or other document required for the individual to access products or services provided by the University.